# Data processing agreement

> Part of the Cowliss docs. Markdown for every page: append `index.md` to its URL. Site map: /llms.txt

This is the data processing agreement (**DPA**) for Cowliss, between Capital Enesti Inc. (the processor) and each customer organization (the controller). It is incorporated by reference into the [terms of service](https://cowliss.com/terms): accepting the terms at sign-up binds the organization to this DPA. There is nothing to sign and no countersigned version.

## 1. Parties and roles

**Processor:** Capital Enesti Inc., registered in Canada at 1185 rue De Bougainville, Saint-Bruno-de-Montarville (Québec) J3V 3E8. NEQ 1181686743. Contact: support@capitalenesti.com.

**Controller:** the organization that creates a Cowliss workspace and accepts the terms of service.

Cowliss processes personal data on the controller's behalf. The controller decides the purposes and the lawful basis; Cowliss never decides what the data is for.

## 2. Subject matter, nature, and duration

Cowliss provides a customer data platform: the controller's applications send profile and event data; Cowliss stores it, computes segments, runs per-user automations, and delivers email and webhooks on the controller's behalf. Processing under this DPA is everything Cowliss does to provide that service, for as long as the controller's organization uses it, plus the wind-down in section 10. Annex A lists the data categories and data subjects.

## 3. Documented instructions

Cowliss processes personal data **only on documented instructions** (Art. 28(3)(a)). The instructions are:

1. The terms of service and this DPA.
2. The product documentation, including the documented defaults in [Data protection and your responsibilities](/guides/data-protection/), which the controller accepts by using the service. In short: events are ingested regardless of consent state; consent gates every send whose purpose a recipient can withhold; a `marketing` purpose is off until the controller records a yes, a named `transactional` purpose is on until turned off, and bare `transactional` mail is service mail that consent does not govern; which purpose a message belongs to is the controller's own classification, which Cowliss honors without inspecting the message; consent state is controller-supplied metadata that Cowliss stores and enforces but never interprets.
3. The controller's in-product actions across API, dashboard, CLI, and MCP: setting consent states, configuring retention, requesting erasure or export, defining automations, segments, and webhooks.

An instruction outside these documents needs written agreement. Cowliss informs the controller if it believes an instruction infringes data protection law (Art. 28(3), final paragraph).

## 4. The controller's responsibilities

- **Lawful basis (Art. 6).** The controller establishes and documents the lawful basis for every processing purpose. Cowliss takes no position on what the controller's data is for.
- **Consent records (Art. 7(1)).** Where consent is the basis, the controller must be able to demonstrate it. Cowliss stores the consent state the controller supplies; proving what the end user saw and agreed to is the controller's job.
- **Lawful instructions and content.** The controller warrants that its instructions, the data it sends, and the messages it causes Cowliss to deliver comply with applicable law, and indemnifies Capital Enesti Inc. against claims arising from them.

## 5. Processor commitments

- **Confidentiality.** Everyone processing controller data is bound by confidentiality (Art. 28(3)(b)).
- **No own-purposes use.** Cowliss does not use tenant data for its own purposes: no advertising, no cross-org profiling, no sale of data. The only numbers Cowliss derives are aggregate usage counts for metering and abuse protection.
- **Security.** Technical and organizational measures per Annex B (Art. 32).
- **Assistance (Art. 28(3)(e) and (f)).** Cowliss assists the controller through the product's own erasure, export, retention and consent features, which the controller operates itself. Cowliss provides no assistance beyond these features.
- **Breach notification (Art. 33(2)).** Cowliss informs the controller without undue delay after becoming aware of a personal data breach affecting its tenant, with what is then known. Notice is given through the dashboard, the published status of the service, or the controller's account email, at Cowliss's choice.
- **Subprocessors.** Per section 6.

## 6. Subprocessors

The controller authorizes the subprocessors on the [subprocessor list](/legal/subprocessors/) (Art. 28(2)). Additions and replacements are published on that list before they take effect; the controller may object, and where an objection stands, may terminate. The obligations of this DPA flow down to every subprocessor (Art. 28(4)).

## 7. International transfers

Capital Enesti Inc. is a Canadian processor; where the controller has data subjects in the EEA, the GDPR applies to it directly via Art. 3(2). Transfers of personal data to the Canadian entity are covered by the European Commission's adequacy decision for Canada (commercial organizations subject to PIPEDA), so no standard contractual clauses are required for the entity itself. Hosting locations are on the [subprocessor list](/legal/subprocessors/).

## 8. Other applicable law

Capital Enesti Inc. is also subject to PIPEDA and Québec's Law 25 as a Canadian organization; this DPA is intended to satisfy their service-provider contract requirements as well.

## 9. Information

This documentation, the [records of processing](/legal/records-of-processing/), and Annex B are the information Cowliss makes available to demonstrate compliance (Art. 28(3)(h)). Cowliss does not complete security questionnaires and does not host audits or on-site inspections.

## 10. End of service

On termination the controller may export its data and request erasure using the product's features before its workspace closes. Residual copies in backups expire on the operator's own schedule, which is not published.

## 11. Governing law and venue

This DPA is governed by the laws of the Province of Québec and the federal laws of Canada applicable therein. The parties submit to the non-exclusive jurisdiction of the courts of the judicial district of Montréal.

## Annex A: Processing details

| Item | Detail |
| ---- | ------ |
| Data subjects | The controller's end users (identified and anonymous); the controller's team members (dashboard accounts) |
| Personal data | User identifiers, traits, event stream (names, properties, timestamps), email addresses, consent states, suppression state, delivery metadata; team members' names and emails |
| Purposes | Per the controller's instructions: storage, identity resolution, segmentation, automation automation, email and webhook delivery, abuse protection, usage metering |
| Retention | Controller-configured event retention; profiles and state persist until erasure or termination |
| Categories of processing | Listed in the [records of processing](/legal/records-of-processing/) |

## Annex B: Security measures (Art. 32)

Cowliss applies measures appropriate to the risk of a small, single-operator service:

- Authentication of the dashboard, CLI and MCP through a third-party identity provider, with organization roles gating operations; the APIs authenticate with organization-scoped, revocable keys.
- Tenant scoping of data access by organization.
- Encryption in transit (TLS) on public endpoints.
- Signed outbound webhooks and signed, single-purpose tokens on public unsubscribe and verification links.
- Rate, quota and complaint-rate limits that bound the blast radius of a compromised or abusive tenant.
- Erasure and retention features as in section 5.

These measures are described, not warranted. They may change without notice as the service evolves.

## Annex C: Subprocessors

The current list is maintained at [Subprocessors](/legal/subprocessors/) and incorporated here by reference.