Version: 1.0
Effective date: 2026-09-17
This Data Processing Addendum (“DPA”) forms part of the agreement between Strategies Beyond Limits (“Provider” or “Processor”), doing business as SBL Advisory, and the customer who accepts the Terms of Service via online checkout or a written Order Form (“Customer” or “Controller”) for the Motivra service (the “Service”), including the Terms of Service (the “Agreement”). Motivra is a product offered by Provider.
If there is a conflict between this DPA and the Agreement regarding the processing of Personal Information in Customer Data, this DPA controls.
1. Definitions
“Applicable Privacy Law” means privacy and data-protection laws applicable to the processing of Personal Information under this DPA, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws, and applicable U.S. state privacy laws to the extent they apply to the parties’ roles.
“Customer Data” has the meaning in the Terms of Service.
“Personal Information” means information about an identifiable individual (or “personal information” / “personal data” as defined under Applicable Privacy Law) contained in Customer Data.
“Processing” means any operation performed on Personal Information, including collection, storage, use, disclosure, transmission, and deletion.
“Subprocessor” means a third party engaged by Provider to Process Personal Information on behalf of Customer in connection with the Service.
Other capitalized terms have the meanings in the Agreement.
2. Roles of the parties
2.1 Customer determines the purposes and means of Processing Personal Information in Customer Data and is the controller (or “organization” / “business,” as applicable).
2.2 Provider Processes Personal Information in Customer Data on behalf of Customer as a processor / service provider, solely to provide the Service and as otherwise described in this DPA and the Agreement.
2.3 Provider acts as an independent controller for account, billing, support, and website information about Customer’s personnel, as described in the Privacy Policy—not under this DPA’s controller/processor rules for that category, except where those individuals’ data also appears inside Customer Data.
3. Subject matter and details of Processing
| Item | Description |
|---|---|
| Subject matter | Hosting and operation of Motivra for Customer |
| Duration | For the Subscription term plus any post-termination export/deletion period, and as required by law |
| Nature / purpose | Host, store, transmit, display, backup, and otherwise Process Customer Data to provide, secure, support, and improve the Service per Customer’s configuration and instructions |
| Types of Personal Information | May include names, contact details (email, phone, address), account credentials metadata, appointment and service history, invoice/quote details, notification preferences, communication content, vehicle-related identifiers (including VIN) linked to individuals, and other data Customer chooses to submit |
| Categories of data subjects | Customer’s staff; end customers and dealership contacts; other individuals whose information Customer enters into the Service |
| Customer instructions | Documented in the Agreement, Order Form (including online checkout), this DPA, Customer’s use of the Service (configuration), and reasonable written instructions consistent with the Service |
4. Provider obligations
Provider will:
4.1 Process Personal Information only on documented instructions from Customer, including as set out in the Agreement and this DPA, unless required by Applicable Privacy Law (in which case Provider will notify Customer before Processing, unless legally prohibited).
4.2 Ensure persons authorized to Process Personal Information are bound by confidentiality obligations.
4.3 Implement appropriate technical and organizational measures to protect Personal Information against unauthorized access, loss, or alteration, taking into account the nature of the Service and the sensitivity of typical shop CRM data. Measures may include encryption in transit, access controls, authentication safeguards, logging, and least-privilege administration.
4.4 Not use Personal Information in Customer Data for Provider’s own marketing to data subjects, or sell such Personal Information.
4.5 Notify Customer without undue delay after becoming aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Information in Customer Data (a “Security Incident”). Target initial notice: within seventy-two (72) hours of Provider’s confirmation, where feasible. Notice will include available details and steps taken or proposed. Provider will reasonably cooperate with Customer’s investigation and notification obligations. Provider’s notice is not an admission of fault.
4.6 Taking into account the nature of Processing, reasonably assist Customer (at Customer’s request and, where effort is material, at Customer’s expense) with: (a) data subject / individual requests; (b) security and breach assessments; and (c) privacy impact assessments required by Applicable Privacy Law, to the extent related to Provider’s Processing.
4.7 Upon termination or expiration of the Subscription, at Customer’s choice and request made within the export window in the Terms of Service, return a reasonably available export of Customer Data or delete Personal Information in Customer Data (and certify deletion on request), except where retention is required by law or contained in routine encrypted backups pending deletion cycles.
4.8 Make available information reasonably necessary to demonstrate compliance with this DPA and allow audits as described in Section 8.
5. Customer obligations
Customer will:
5.1 Comply with Applicable Privacy Law in its use of the Service and its Processing of Personal Information, including providing required notices and obtaining required consents (including for email/SMS under CASL, TCPA, and similar laws).
5.2 Ensure it has a lawful basis and all necessary rights to submit Personal Information to the Service and to instruct Provider to Process it.
5.3 Not instruct Provider to Process Personal Information in a manner that would cause Provider to violate Applicable Privacy Law.
5.4 Configure the Service and staff access appropriately (roles, approvals, retention practices within Customer’s control).
6. Subprocessors
6.1 Customer authorizes Provider to engage Subprocessors to Process Personal Information as needed to provide the Service. Provider will impose contractual obligations on Subprocessors no less protective in substance than this DPA regarding Personal Information.
6.2 Provider remains responsible for Subprocessors’ performance of their obligations with respect to Personal Information.
6.3 Current Subprocessors (as of 2026-09-17):
| Subprocessor | Purpose | Location |
|---|---|---|
| Render | Application hosting | United States |
| Neon | Managed PostgreSQL databases | United States |
| Amazon Web Services (S3) | Image and file storage | United States |
| Amazon Web Services (Secrets Manager) | Secure storage of tenant database credentials | United States |
| Stripe, Inc. | Subscription billing and payment processing for the Service | United States / global |
| Google LLC (reCAPTCHA) | Abuse prevention on public authentication forms | United States / global |
| Google LLC (Google Analytics 4) | Marketing-site usage measurement (consent-gated) | United States / global |
| db.vin (Autoiso Sp. z o.o.) | Vehicle identification number (VIN) lookup | Poland / EU |
| OpenAI (for the Moti assistant add-on, if enabled for Customer) | Answering questions asked in Moti chats. Receives the person's message and recent conversation, and the shop information and knowledge Customer has made available to Moti; never passwords, tokens, payment card data or API keys | United States / global |
| Microsoft Corporation (Microsoft Graph / Microsoft 365), Twilio SendGrid, or configured SMTP provider | Transactional and notification email | United States / as configured |
| Twilio Inc. and/or Amazon SNS | SMS notifications (if enabled for Customer) | United States / global |
Provider will keep this list accurate as the production stack changes.
6.4 Provider will provide notice of material changes to the Subprocessor list (for example by updating this DPA, posting an updated list, or emailing Customer’s admin contact). Customer may object on reasonable data-protection grounds within fifteen (15) days. If the parties cannot resolve the objection, Customer may terminate the affected Subscription for convenience as to the impacted Service with a pro-rata refund of prepaid unused fees for the terminated portion—Customer’s exclusive remedy for such objection.
7. International transfers
Customer acknowledges that Personal Information may be transferred to and Processed in Canada, the United States, and other countries where Provider or Subprocessors operate. Customer is responsible for ensuring such transfers are permitted under Applicable Privacy Law for Customer’s use case. Provider will use reasonable contractual and organizational safeguards with Subprocessors for cross-border Processing.
8. Audits
Upon written request no more than once per twelve (12) months (unless required after a Security Incident or by a regulator), Provider will provide reasonable documentation or responses regarding security and Processing practices. On-site audits are not required unless mandated by Applicable Privacy Law or mutually agreed; any audit will be during business hours, on reasonable notice, subject to confidentiality, and at Customer’s expense unless a material breach of this DPA is confirmed.
9. Liability
Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except to the extent Applicable Privacy Law prohibits limiting liability for specific obligations.
10. Term
This DPA takes effect when Customer accepts the Agreement (including via online checkout) or when Provider first Processes Personal Information under the Agreement, whichever is earlier, and continues until Provider ceases Processing Personal Information under the Agreement.
11. General
11.1 This DPA is governed by the same governing law and venue as the Terms of Service (Ontario, Canada).
11.2 If any provision is unenforceable, the remainder remains in effect.
11.3 Electronic acceptance via online checkout or a written Order Form constitutes execution of this DPA.
Contact
For privacy / DPA notices: motivraos@sbladvisory.com
Strategies Beyond Limits
190 Pineland Court, Waterloo, Ontario N2T 2T1 Canada
https://www.sbladvisory.com/en
Last updated: 2026-09-17