Data Processing Addendum
Applies when Dispense processes Personal Data on behalf of Business
1. Definitions and Roles
“Personal Data” means information relating or reasonably linkable to an identified or identifiable person and governed by applicable Data Protection Law. “Controller,” “Processor,” “Business,” “Service Provider,” “Consumer,” “Sale” and “Share” have their statutory meanings. For processing described in Annex A, Business is Controller/Business and Dispense is Processor/Service Provider. Each party may act independently for its own account, security, legal compliance, billing and Platform administration as disclosed in the Privacy Policy.
2. Processing Instructions
Dispense will process Personal Data only on documented instructions in the Agreement and Annex A, including to provide Requests, retailer-specific reporting, support, security, fraud prevention, legal compliance and approved features. Dispense will notify Business if it believes an instruction violates Data Protection Law, unless prohibited.
3. Restricted Uses
To the extent required for service-provider or processor status, Dispense will not sell or share Personal Data; retain, use or disclose it outside the direct business relationship or for a commercial purpose other than specified business purposes; or combine it with personal information from other persons or sources, except as permitted by Data Protection Law. Dispense may create aggregated or deidentified data using legally sufficient measures and may use such data as Derived Data, subject to non-reidentification commitments required by law.
4. Confidentiality and Security
Dispense will ensure persons authorized to process Personal Data are bound by confidentiality and will maintain reasonable administrative, technical and physical safeguards appropriate to risk, as described in Annex B. Business is responsible for secure configuration, user permissions, endpoints and data transmitted under its instructions.
5. Subprocessors
Business generally authorizes subprocessors. Dispense will provide information about current subprocessors on request and give notice of material additions where required. Business may object on reasonable data-protection grounds within 10 days; the parties will seek a practical solution, and Dispense may terminate the affected service if none is available.
6. Requests, Assessments and Cooperation
Taking into account the nature of processing, Dispense will reasonably assist Business with verified individual requests, impact assessments, consultations and compliance information. Business is responsible for responding and determining applicable rights. Dispense may charge reasonable fees for assistance beyond standard functionality unless caused by Dispense’s breach.
7. Security Incidents
Dispense will notify Business without undue delay after confirming unauthorized acquisition of or access to Business Personal Data requiring notice under applicable law (“Security Incident”). Notice will include available material details and updates. Notification is not an admission. Business controls legally required notices unless law assigns them to Dispense. Incidents caused by Business, users or Source Systems are excluded from Dispense responsibility.
8. Return and Deletion
At termination and on documented request, Dispense will delete or return Business Personal Data unless law permits or requires retention. Deletion from backups may occur on normal cycles if data is isolated from active use. Dispense may retain deidentified data, security logs, legal records and independent-controller data consistent with law.
9. Audits
No more than annually, Business may request available third-party reports or a reasonable questionnaire. Additional audits require reasonable notice, confidentiality, non-disruption, qualified independent auditors, reimbursement of costs and no access to other customers’ data or sensitive security information. Regulatory rights remain unaffected.
10. International Transfers
If required, the parties incorporate the applicable approved standard contractual clauses or other lawful transfer mechanism, completed to reflect the roles and processing. Canadian cross-border processing will be disclosed and safeguarded as required.
11. Liability and Priority
The Business Terms’ exclusions, cap, indemnity and dispute provisions apply to this DPA to the maximum extent permitted by law. If this DPA conflicts with the Agreement solely on Personal Data processing, this DPA controls.
Annex A - Processing Details
| Field | Description |
|---|---|
| Subject matter | Order or Request transmission, business-specific reporting, integration support, account support, security and approved services |
| Duration | Agreement term plus applicable retention and deletion periods |
| Nature and purpose | Collecting, hosting, transmitting, organizing, retrieving, supporting, securing, deleting and deidentifying as instructed |
| People | Consumers, patients or caregivers where applicable, Business personnel and account users |
| Data | Identifiers, contacts, Request contents and status, eligibility metadata, device and log data, support communications and other enabled fields |
| Sensitive data | Potential cannabis activity, medical eligibility or status, precise location and government-ID metadata if enabled |
| Frequency | Continuous or event-driven during enabled services |
| Business instructions | Agreement, feature configuration, support requests and lawful written instructions consistent with the services |
Annex B - Security Measures
Dispense maintains reasonable safeguards appropriate to the nature of the Personal Data and risks involved, including measures addressing access control, authentication, confidentiality, secure transmission, monitoring, incident response, continuity, vendor oversight, retention and deletion. Dispense may update its safeguards as technology, risks and legal requirements evolve, provided the overall level of protection is not materially reduced during an active service term.