Data Processing Agreement
Data Processing Agreement
This is the standard Data Processing Agreement (DPA) for Unionsuite. It sets out how we process member personal data on each union's behalf, the security we apply, the subprocessors we use, and your rights. A signed DPA is provided before onboarding; this page is that standard form.
Updated June 11, 2026.
Security & compliance
Data Security & Compliance Report
Our full security architecture and control environment — single-tenant isolation, encryption in transit and at rest, passwordless access control, per-record audit trails, and the complete data lifecycle — mapped control-by-control to the SOC 2 Trust Services Criteria and ISO/IEC 27001:2022, on certified Canadian infrastructure.
SOC 2-aligned ISO 27001-aligned Hosted in Canada
Subject matter and duration
- This Data Processing Agreement (DPA) governs our processing of personal data on behalf of your union in connection with the Unionsuite service.
- It applies for as long as we process personal data for your union, that is, for the term of your subscription and until the data is returned or deleted on termination.
- Where this DPA and your signed agreement differ, the signed agreement controls.
Roles of the parties
- Your union is the data controller of the member personal data in its workspace. Unionsuite Ltd. is the data processor, acting on your union's behalf.
- The subject matter is the operation of the Unionsuite platform; the nature and purpose of processing is hosting, storing, organizing, and supporting your union's records; the categories of data subjects are your union's members and the staff who administer the workspace.
- Categories of personal data include names, contact details, employment and classification, seniority, dues status, grievance histories, attached documents, and any custom fields your union configures.
Processing only on documented instructions
- We process personal data only on your union's documented instructions, including those given through the service, and as needed to provide and support it.
- If law requires us to process beyond your instructions, we will tell you first unless that law prohibits it.
- We will inform you if, in our opinion, an instruction infringes applicable data-protection law.
Confidentiality
- Personnel authorized to process your union's data are bound by confidentiality and are granted access on a need-to-know basis only.
- We do not sell personal data and do not use member data for advertising or to train third-party AI models.
Security measures
- We apply appropriate technical and organizational measures: single-tenant isolation (a separate database, storage, and web address per union), encryption in transit and at rest, passwordless and rate-limited authentication, row-level security, role-based permissions (47 capabilities across 4 roles), per-record audit logs, automatic backups, a manual saved copy before every bulk operation, and signed, time-limited file links.
- Member personal data is hosted in Canada. A fuller description is on our security page at /security.
Subprocessors
- Your union authorizes us to engage the subprocessors needed to run the service: Supabase (managed Postgres database, file storage, and authentication, Canadian region), Vercel (application hosting and CDN), Resend (transactional and bulk email delivery), Sentry (error monitoring), and Anthropic / Claude (the optional AI assistant).
- Each subprocessor is bound by a written contract imposing data-protection obligations no less protective than this DPA, and may use the data only to provide its service to us.
- We give you advance notice before adding or replacing a subprocessor that handles member personal data, and you may object on reasonable data-protection grounds.
Assistance with data-subject requests
- Taking into account the nature of the processing, we assist your union with appropriate measures to respond to members exercising their rights of access, correction, deletion, and portability.
- If a member contacts us directly, we refer them to your union and help you respond.
- We also assist your union with security, breach notification, and any required privacy assessments, given the information available to us.
Personal data breach notification
- We will notify your union without undue delay after becoming aware of a personal data breach affecting your data.
- Our notice will describe, as far as we know it, the nature of the breach, the likely consequences, and the measures taken or proposed to address it.
Return or deletion on termination
- On termination, the order is deliberate: export first, revoke access, then delete on an agreed schedule, confirmed in writing.
- At your choice, we return or delete your union's personal data and delete existing copies, except where law requires retention. You can also export everything yourself at any time, to CSV, Excel, or PDF.
- Backups expire on their normal rotation cycle after deletion.
Audits
- We make available the information reasonably necessary to demonstrate compliance with this DPA, including our security overview and subprocessor list.
- We will respond to a reasonable audit or questionnaire, including security checklists and privacy reviews, and can provide our subprocessors' certifications (for example Supabase's and Vercel's SOC 2 / ISO 27001).
International transfers
- Member personal data is hosted in Canada. Limited operational data (such as error diagnostics and email-delivery metadata) may be processed by subprocessors outside Canada.
- Any such transfer is covered by the subprocessor's contractual safeguards; member personal records remain hosted in Canada.
Liability and how to execute
- Liability under this DPA is subject to the limitations of liability in your signed agreement.
- A signed DPA is provided before onboarding; this page is the standard form. To put it in place, or to request a countersigned copy, write to security@unionsuite.net.
- Governing law: Ontario, Canada.
Questions? Email us, a real person answers.