Terms · Privacy · Subprocessors · Security · AI · Acceptable use · Accessibility · DPA · Français

Data Processing Addendum

Version 1.0 · Effective 2026-08-20 · Last updated 2026-08-20

This Addendum governs LobiSolutions' processing of personal data on behalf of an Organization customer of LobiPlan. It forms part of the Terms of Service and is deemed accepted when an Organization workspace is created. A signable copy is available on request from bsimba6@gmail.com.

0. Scope — read this first

This Addendum applies to Organization workspaces only.

In an Organization workspace, your organization decides why and how its members' work data is processed — who is assigned what, what the approval chain is, whether AI is enabled, whether meetings are recorded, what the visibility mode is. You are the controller. LobiSolutions executes those decisions and is your processor. That is the relationship this Addendum documents.

"LobiSolutions" means Benjamin Simba, an individual carrying on business under that name in Nova Scotia, Canada. It is not an incorporated company; see Terms of Service §2. The obligations in this Addendum bind that person.

In a Household workspace, LobiSolutions is the controller, not a processor. A family running its own household is not an organization engaged in commercial activity, and cannot discharge a controller's duties — it has no access to logs, backups, subprocessor contracts or the deletion sweeper. The accountability is ours. This Addendum does not apply to Household workspaces, and there is nothing for a household to sign. What we do with household data, and the rights of everyone in it including children, is in the Privacy Policy.

LobiSolutions is also a controller, not your processor, for its own layer even where an Organization workspace is involved: the person-global user profile (one human, one profile, however many workspaces they belong to), authentication and session records, billing, platform operational telemetry, anti-abuse records, and our own compliance records. You cannot instruct the deletion of a profile, because it is not held on your behalf. §7 explains what we do instead.

1. Definitions

We use as few as possible. "Controller", "processor", "personal data", "processing", "data subject" and "supervisory authority" have the meanings given in the General Data Protection Regulation. "Customer Data" means personal data you or your members put into your workspace. "Subprocessor" means a third party we engage to process Customer Data. "Applicable Law" means the data protection law binding on the processing, which for most of our customers is Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, the GDPR, Quebec's Law 25, or Alberta or British Columbia PIPA.

2. Subject matter, duration, nature and purpose

3. Categories of personal data and data subjects

Data subjects: your members and administrators; people they name as contacts; external guests invited to meetings; and job applicants or employees where you use the HR features.

Categories of Customer Data, which vary with the features you enable:

Special categories. LobiPlan does not ask for special-category data. Sickness entries on the availability calendar are health information, and evaluation answers may reveal more than a job title. Treat both accordingly when you set your visibility mode.

4. Your instructions

We process Customer Data only on your documented instructions, including for transfers. Your instructions are: this Addendum, the Terms of Service, and your use of the product's own settings — visibility mode, AI entitlement, recording and transcription toggles, retention choices, member roles and function tiers. Configuring the product is instructing us, which is why those settings are yours and not ours.

If we believe an instruction infringes Applicable Law, we will tell you promptly and may pause the affected processing until it is resolved.

We will not disclose Customer Data to a public authority unless legally compelled. Where we are compelled and not legally prohibited from telling you, we will tell you before disclosing, so you can seek relief.

5. Confidentiality

Everyone we authorise to process Customer Data is bound by a duty of confidentiality and is granted access only where needed to deliver or support the service.

LobiSolutions is currently operated by one person, so there is no staff roster to onboard or offboard, and we will not claim a joiner/mover/leaver process we do not have. What we do have is architectural, and you can verify it: our staff hold no standing access to your workspace; obtaining access inserts a real membership row under the operator's own name, which appears in your member list and is written to your administrator audit log. §5 of Security sets out the whole chain, including its limits.

6. Security measures

We implement technical and organisational measures appropriate to the risk. They are described, in full and with their gaps, at Security, which is versioned and dated and forms part of this Addendum by reference.

We do not reproduce them here, because two copies of a security description drift and the one you would be relying on is whichever you read last. The headline measures are: row-level security on every table in the application database; writes through database procedures rather than direct table access; financial data in tables with no policies and the table grant revoked; encryption in transit with HSTS; encryption at rest provided by the underlying platforms; private storage buckets with time-limited signed URLs; and append-only schema changes.

And the gaps, stated here as well as there, because you are entitled to know them before you sign: there is no multi-factor authentication; there is no SOC 2 report, ISO 27001 certificate, third-party audit or external penetration test; the application host's content security policy restricts framing only; and there is no operational monitoring or status page.

7. Subprocessors

You give general written authorisation for LobiSolutions to engage subprocessors. The current list, with what each receives and where it processes, is at Subprocessors.

We give 30 days' advance notice before a new or replacement subprocessor begins processing Customer Data, by email to your designated contact and in the register's changelog. Where a subprocessor must be replaced urgently for security or continuity reasons, we will give notice as soon as practicable instead.

You may object on reasonable grounds within the notice period. We will work with you to resolve it. If we cannot, you may terminate the affected service for the remainder of your term without penalty and with a pro-rata refund of amounts paid in advance for the terminated portion.

We impose data protection obligations on each subprocessor that are no less protective than those in this Addendum, and we remain liable to you for their performance.

8. Assistance with data subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures in responding to requests to access, correct, delete, restrict, object to or port personal data.

In practice this is cheaper than the clause makes it sound, because the machinery already exists. Members can export their own data self-serve. Administrators can correct and remove work records directly. Removing a member unassigns their work, clears their role tiers and offboards their HR record in one transaction.

Where a data subject contacts us directly about content in your workspace, we will not act on it ourselves. We will pass the request to your administrators within 5 business days and tell the person we have done so.

One limit, stated rather than buried. Deletion of an individual's account is by anonymisation, not deletion, and this is deliberate. 51 foreign keys point into the user profile table, and those pointers are the audit trail and the approval record — the records your organization relies on for its own compliance history, and which other parties to an approval also rely on. On anonymisation, personal identifiers are scrubbed such that every historical reference resolves to "Former member", the sign-in is disabled and private data is deleted, while approvals, work events and the ledger survive with the name removed. A re-runnable check asserts that the routine performs no deletion against approvals, approval history, work events, work items, messages or either ledger. If you need genuine erasure of an approval record, that is a decision about your own governance data — tell us and we will discuss it.

9. Breach notification

We will notify you without undue delay and in any event within 48 hours of confirming a breach of security safeguards affecting Customer Data in your workspace. Notice goes to your designated contact by email and to your administrators in the application.

The notice will describe what we know at the time: what happened and when, the categories of personal data and the approximate number of data subjects involved, the likely consequences, the measures we have taken or propose, and a contact point. Because a first notice is necessarily incomplete, we will update you as facts are established rather than delay notice until they are.

The clock starts when a breach is confirmed, not when an anomaly is observed. We do not offer 24 hours. A commitment a small team cannot reliably keep is a contract breach stacked on an incident, and 48 hours still leaves you 24 hours of your own 72-hour window under Article 33 GDPR.

We will assist you with your own notification obligations to supervisory authorities and data subjects, and we keep a record of every breach of security safeguards for at least 24 months whether or not it meets any reporting threshold.

Give us a designated security and privacy contact. Without one we have nowhere to send this notice.

10. Assistance with security, impact assessments and consultation

Taking into account the nature of the processing and the information available to us, we will assist you with your obligations under Articles 32 to 36 GDPR and their equivalents: security of processing, breach notification, data protection impact assessments, and prior consultation with a supervisory authority. In practice this means answering your questions, providing our current assessment, and describing our measures and our subprocessors.

11. Retention, and deletion or return on termination

On termination or expiry of your subscription, at your election, we will delete or return your Customer Data. Tell us which within 30 days of termination. If you do not, we will delete.

• Deletion. Complete tenant deletion removes the organization and its data. It requires re-authentication with an administrator's email and password.
• Return. Each member can export their own data self-serve at any time. Your general ledger exports separately, as CSV per statement — the one-click export does not contain the ledger, and we would rather say so than have you discover it at the wrong moment.

During the term, we delete on the schedule published at Security §8: meeting recordings 90 days, transcripts 365, AI chat 180, notifications 90, communication log 365, AI action trail 365, usage aggregates 730, meeting minutes 730.

Four classes are deliberately retained without limit while your workspace exists: the work-event audit trail, approvals and approval history, the general ledger, and person-to-person messages. Each is a record whose value is that it is complete.

On the ledger specifically: Canadian record-keeping duties under the Income Tax Act and Excise Tax Act run to six years, and that duty binds you, the taxpayer — not us, your software vendor. We do not auto-delete your books because doing so would create a compliance problem for you, not solve one for us. The decision to delete your ledger is yours.

We may retain Customer Data where Applicable Law requires it, in which case we will tell you what and why, and will continue to protect it under this Addendum.

12. Audit and information rights

We will make available the information reasonably necessary to demonstrate compliance with this Addendum, and allow for and contribute to audits, on this basis:

• A documented questionnaire, once per twelve months. We answer from a maintained response set, so you get the same answer as everyone else and the same answer as last time.
• Our most recent adversarial security assessment, under NDA. It is dated, records what was refuted as well as what was found, and states plainly that it is an internal exercise and not a third-party audit or penetration test.
• A live verification session on request. We will screen-share and run checks you nominate against our production database — that every table has row-level security, that our platform-administrator functions grant no tenant access — and you watch the query and the result. Very few vendors can offer this, because very few vendors' controls are expressible as a query.
• An on-site audit only where a supervisory authority requires it, at reasonable notice, during business hours, subject to confidentiality, and not more than once per twelve months unless a breach has occurred.

13. International transfers

Customer Data is stored in Canada, in Supabase's ca-central-1 region. Some processing happens outside Canada, and Subprocessors names every company and location.

EU/EEA to Canada. Canada holds a partial adequacy decision from the European Commission for organizations subject to PIPEDA. LobiSolutions is such an organization, so no further transfer instrument is required for a transfer to us.

Canada to the United States. Onward transfers to our United States subprocessors rest on those vendors' own data processing agreements, which incorporate the EU Standard Contractual Clauses.

Standard Contractual Clauses. Where you require them for the transfer from you to us, the Clauses (Module Two, controller to processor, or Module Three, processor to processor, as applicable) are incorporated into this Addendum on request, with this Addendum's §§2 and 3 as Annex I, Security as Annex II, and Subprocessors as Annex III. Contact bsimba6@gmail.com.

Alberta customers: the countries in which Customer Data may be stored or accessed, per subprocessor, are in the register. The person who can answer questions about it is reachable at bsimba6@gmail.com.

⚠ [TO CONFIRM: for each United States subprocessor, whether its data processing agreement has been accepted and countersigned and a copy filed, and its current EU-US Data Privacy Framework certification status against the official list.]

14. Liability, order of precedence and governing law

This Addendum is subject to the limitations of liability in the Terms of Service. Where this Addendum conflicts with the Terms on a matter of data protection, this Addendum prevails. Where the Standard Contractual Clauses have been incorporated and conflict with this Addendum, the Clauses prevail.

This Addendum is governed by the laws of the Province of Nova Scotia and the federal laws of Canada applicable there, and the parties submit to the courts of Nova Scotia — except where the Standard Contractual Clauses require otherwise for the processing they govern.

15. Contact and signature

We operate on this standard Addendum. It is published, versioned, and the same for every customer, which is the only version of this that survives ten customers.

For a countersigned copy, for the Standard Contractual Clauses, or to register your designated security and privacy contact: bsimba6@gmail.com.

Related: Terms of Service · Privacy Policy · Security · Subprocessors · How LobiPlan uses AI

Changes to this document

We notify material changes in advance, by email to your designated contact and in the application, at least 30 days before they take effect. Non-material corrections are noted below. Previous versions are available on request from bsimba6@gmail.com.

LobiPlan for organizations · LobiPlan for households · bsimba6@gmail.com