Data Processing Addendum

Last updated: November 7, 2026

This addendum is part of our Terms of Service between SixLabs Inc. ("SixLabs", "we") and the business that subscribes to WinCore ("you"). It covers personal information that you, or people acting for you, put into WinCore, such as your customers' and staff's names, addresses, contact details, quotes, jobs and payments ("Customer Personal Information"). Where it says something different from the Terms, this addendum wins for Customer Personal Information.

1. Roles

You decide why and how Customer Personal Information is collected and used, and are accountable for it under the privacy laws that apply to you. We process it on your behalf, as your service provider, only to provide WinCore to you.

2. Your instructions

• We'll process Customer Personal Information only on your documented instructions. The Terms, this addendum, and the way you set up and use WinCore are those instructions.
• We won't sell it, use it for advertising, or use it for our own purposes, except to keep WinCore secure, comply with the law, produce counts and measurements that identify no one, or anonymize it and use it combined with other customers' to improve WinCore and publish general insights about the industry. Anonymized means it can no longer identify anyone, directly or indirectly, and can't be made to again, following generally accepted practice and any criteria the law sets.
• If we think an instruction breaks privacy law, we'll tell you.

3. Your responsibilities

You're responsible for having a lawful basis and any consent needed to collect Customer Personal Information and put it into WinCore, for telling the people it's about how you use it (including that you use service providers like us), and for answering their requests.

4. Our people

Only SixLabs staff and contractors who need to, to run and support WinCore, can access Customer Personal Information, and each is bound to keep it confidential. Access to a workspace for support is read-only, time-limited and recorded, as described in our Privacy Policy.

5. Security

We keep reasonable technical and organizational safeguards in place, appropriate to the sensitivity of the information, including:

• encryption in transit (TLS) and at rest;
• separation of each customer's data, with database-level row security, and a separate database on Professional plans;
• least-privilege access, multi-factor authentication for our administrative console, and logs of administrative access;
• automated backups, kept for a limited period;
• passwords handled by our sign-in provider and never stored by us in readable form.

6. Subprocessors

You authorize us to use the subprocessors on our Subprocessors page. We'll bind each to data-protection terms at least as protective as this addendum, and stay responsible for their work. We'll give you 30 days' notice of a new subprocessor, and you can object as that page describes.

7. Where it's processed

Customer Personal Information is stored in Canada. Some subprocessors handle parts of it in other countries, as listed on the Subprocessors page. Where that happens, we make sure it gets protection comparable to what Canadian law requires, and you can rely on this to tell the people it's about.

8. Requests from individuals

If someone asks us directly to see, correct or delete information you hold about them, we'll pass the request on to you and not answer it ourselves unless you ask us to. WinCore lets you find, correct, export and delete the information yourself; if you need more help, we'll give it.

9. Security incidents

If we learn of a breach of security that affects Customer Personal Information, we'll tell you without undue delay, and in any case within 72 hours of confirming it, with what we know about what happened, the information involved and what we're doing about it. We'll keep you updated and help you meet any obligation you have to notify regulators or the people affected. We keep a record of every such breach.

10. Requests from authorities

If a government or court asks us for Customer Personal Information, we'll refer them to you where we can, tell you first unless the law forbids it, and disclose only what we're legally required to.

11. When the agreement ends

Your admin can export your data from WinCore, as CSV files along with the files you've uploaded, at any time, and for 90 days after your subscription ends. After that, or sooner if you ask us, we'll delete Customer Personal Information from WinCore, and it'll be gone from backups within a further 35 days, except where the law requires us to keep something.

12. Audits

Once a year, or after a security incident, you may ask us reasonable written questions about how we protect Customer Personal Information, and we'll answer them. Enterprise customers' audit rights are set out in their own agreement.

13. Contact

Our Privacy Officer: privacy@sixlabs.ca.