Law 25 agreement — Personal information

English courtesy translation. The French version (version française) prevails.

Between: Gusto Core (“the Provider”), acting as agent / service provider

And: the Client establishment, responsible for the personal information

Version: 1.0 — 2026-07-18

1. Roles

1.1 The Client is responsible for the processing of the personal information (that of its employees and, where applicable, of its own customers) entered into the platform.

1.2 The Provider processes this information solely to provide the service, according to the Client's instructions. It does not use this information for any other purpose.

2. Nature of the information processed

Depending on the modules enabled: identity and contact details of employees, employment and payroll information, training and occupational health and safety (OHS) records, and other operational data entered by the Client. Some categories may be sensitive (e.g. OHS medical information); they are subject to reinforced protection measures (encryption, masking).

3. Location and hosting

3.1 The data is hosted on infrastructure located in Canada.

3.2 Encrypted backups may be replicated to a cloud service; encryption is applied before any transfer.

3.3 No personal information is transferred outside Canada without a prior privacy impact assessment (PIA), as required by Law 25.

4. Security measures

The Provider implements reasonable security measures, including:

• isolation per instance (dedicated database and network for each Client);
• encryption of secrets and sensitive data (Fernet), encryption of backups;
• strong authentication for administration (strong password + TOTP two-factor authentication);
• strict restriction of technical access (administration key limited to authorized operations);
• logging of access and sensitive operations;
• automated monitoring and alerts.

5. Confidentiality

Provider staff with access to the information are bound by confidentiality. Access is limited to what is strictly necessary for operations and support.

6. Confidentiality incident

In the event of a confidentiality incident (unauthorized access, use or communication, or loss), the Provider:

6.1 promptly takes reasonable measures to reduce the risk of harm;

6.2 notifies the Client without delay so that it can meet its obligations to keep a register and, where applicable, to report to the Commission d'accès à l'information (CAI) and to the persons concerned.

7. Subcontractors

The Provider may use subcontractors (e.g. the Stripe payment provider for billing, a cloud hosting service for backups). Each subcontractor is bound by equivalent protection obligations. The list is provided on request.

8. Rights of the persons concerned

The Provider assists the Client in handling requests for access, rectification,

portability and de-indexing/deletion. Portable export and deletion features are available through the administration tools.

9. Retention and destruction

9.1 The information is kept as long as the subscription is active.

9.2 Upon termination, the Provider gives the Client a complete export, keeps the data for a reasonable period (safety net), then proceeds with its secure destruction.

9.3 A final validated backup is produced before any instance is destroyed.

10. Audit

On reasonable request, the Provider gives the Client the documentation showing compliance with this agreement.

11. Term

This agreement applies for the entire duration of the service and until the information is completely destroyed.

This agreement supplements the GustoCore Premium Terms of Service and prevails, with respect to the protection of personal information, in case of contradiction.