1. Subject matter and duration
Les Solutions Yuzu Inc. processes personal information that the Firm or the Firm’s clients and booking guests enter into or upload to Dossierly (identity and contact data, language, immigration questionnaires, SIN and passport numbers when recorded, supporting documents, notes, bookings, portal activity, secure messages, contracts and electronic-signature records, calendar or meeting details when a consultant connects those tools, payment or accounting details when the Firm connects Square, Stripe, or Sage, and — when the Firm enables the finance module — invoices, payroll, bank imports, and partner records) only to provide the SaaS, for security, and as the law requires. This addendum lasts for the term of the Firm’s use of the service and until deletion or return of the information, subject to backups and legal holds.
2. Roles
- The Firm is responsible for the client file: purposes, consent (including express consent for sensitive information and parental authorization for children under 14 in Québec), College duties, and notices to individuals. - Les Solutions Yuzu Inc. processes that information on documented instructions of the Firm (use of the product, configuration, and this addendum). Les Solutions Yuzu Inc. is controller of staff-account information it needs to run the service. If an instruction would break the law, Les Solutions Yuzu Inc. may refuse it and will tell the Firm.
3. Processor obligations
Les Solutions Yuzu Inc. will: 1. Process personal information only on the Firm’s instructions, including with subprocessors listed in the public subprocessors document. 2. Ensure persons it authorizes to process the information are bound by confidentiality. 3. Implement safeguards proportionate to sensitivity: TLS; Canada-hosted system of record and application functions; per-firm application-layer encryption of documents and many client fields; tenant isolation; access controls; sign-in rate limits; audit logs. Access by Les Solutions Yuzu Inc. personnel to Firm data is limited to operating, securing, or restoring the service, or complying with the law. 4. Not sell client file contents or use them for advertising. 5. Assist the Firm with access, rectification, portability, withdrawal, and destruction requests reasonably related to the service (including in-product export and destroy tools). 6. Maintain a register of confidentiality incidents, kept for at least five years. Notify the Firm without undue delay after becoming aware of an incident affecting the Firm’s information, with the facts the Firm needs for notices to the CAI, the OPC, the Alberta Information and Privacy Commissioner, or individuals (what happened, when, categories of information, number of persons, measures taken). Take reasonable measures to reduce the risk of injury and prevent recurrence. Notify regulators directly when the law requires Les Solutions Yuzu Inc. to do so. 7. Delete or return Firm personal information at end of service. The Firm can export files and then delete the workspace, which purges the Firm’s records and stored files immediately; otherwise deletion follows the Firm’s retention settings and the six-year closed-file hold in the product. Backup/PITR copies expire on the cycles disclosed in the Privacy Policy. If Les Solutions Yuzu Inc. discontinues Dossierly, it will give the Firm at least 90 days’ notice and, before access ends, provide a complete export of the Firm’s data in commonly used formats for the Firm to keep as its archive; it will not delete the Firm’s data before that export has been made available. 8. Make available information reasonably necessary to demonstrate compliance with this addendum and to support the Firm’s own privacy impact assessments (security summary, subprocessors, data map, EFVP conclusions at a high level). 9. Not move the primary database, stored files, or application functions out of Canada without prior written notice to the Firm and an updated extra-Québec assessment. 10. Not use Firm personal information to train artificial-intelligence models, and not send it to a third-party OCR or AI service, without the Firm’s prior written instruction.
4. Extra-Québec processing
The Firm acknowledges that: - Database, authentication, stored files, and backups are hosted in Canada (AWS Montréal region via Supabase), and application functions run in Montréal (Vercel yul1). - Vercel’s global edge network and platform logs, transactional email (Resend), Stripe billing when the Firm subscribes, and optional Google, Microsoft, Zoom, Square, Stripe Connect, and Sage Accounting services may process personal information outside Québec, including the United States (and, for Sage, typically the United Kingdom). - Optional tools are off until the Firm or a staff member enables them. Enabling them is an instruction to communicate the related information to that provider. Stripe billing for the Firm’s subscription runs only when the Firm pays for the software. - Les Solutions Yuzu Inc. has conducted privacy impact assessments for the product and for those extra-Québec communications. The Firm remains responsible for its own Law 25 EFVP when it acquires this system and when it enables extra-Québec tools. Templates are provided in the download pack. A Firm subject to Alberta’s PIPA is responsible for the notice to individuals about service providers outside Canada (s. 13.1); the countries are listed in the subprocessors document.
5. Firm obligations
The Firm will: 1. Ensure a lawful basis and valid consent for client and guest personal information, including sensitive information. 2. Configure roles so only authorized staff open files. 3. Not instruct Les Solutions Yuzu Inc. to process information unlawfully. 4. Notify Les Solutions Yuzu Inc. promptly of incidents involving Firm credentials, misdirected portal invitations, or suspected unauthorized access. 5. Use destroy and export tools in line with College and privacy duties, and export what it must keep before deleting its workspace. 6. Be responsible for content it or its clients submit and for immigration advice and filings.
6. Subprocessors
The Firm authorizes the processors listed in yuzu-subprocessors.pdf as updated from time to time. Les Solutions Yuzu Inc. will impose comparable protection by contract and will update the public list when processors change. For a new extra-Québec processor, Les Solutions Yuzu Inc. will update its transfer assessment.
7. Liability
Each party’s liability under this addendum is subject to the limitation of liability and mandatory-law carve-outs in the Terms and Conditions. Nothing in this addendum requires either party to contract out of PIPEDA, Law 25, or other rules that cannot be waived.
8. Governing law
This addendum is governed by the laws of Québec and the federal laws of Canada applicable there, without prejudice to mandatory consumer protections. Disputes between the Firm and Les Solutions Yuzu Inc. about this addendum are submitted to the courts of Québec, district of Montréal, unless the law requires otherwise.
9. Execution
This addendum is a written contract. It is executed when a firm administrator (1) opens this addendum, (2) confirms authority to bind the Firm, and (3) agrees to this version, at workspace creation or later in Settings. Material updates require the same clickwrap. If an administrator does not accept a new version within seven days of publication, the workspace is locked to view-only until they do. Dossierly records the administrator’s user id, the timestamp, and the addendum version (2026-10-08). The French version of this addendum is made available before acceptance (/fr/dpa). An administrator who accepts the English version does so at the Firm’s express wish, as section 55 of the *Charter of the French language* permits. A wet-ink or electronic countersignature is optional. If the Firm wants a countersigned copy, download this addendum and send it to privacy@dossierly.ca.
Signatures (optional countersignature)
Firm (controller) Legal name: ________________________________ Signatory name / title: ________________________________ Date: ______________ Signature: ________________________________ Les Solutions Yuzu Inc., operating as Yuzu Solutions Inc. (processor) Signatory: Adrien Yvin, Privacy Officer (or other authorized officer) Email: privacy@dossierly.ca Date: ______________ Signature: ________________________________