Data Processing Addendum

Last updated: [DATE]

This Data Processing Addendum ("DPA") applies where QUOVARNE SERVICES LLC ("Quovarne") processes personal data on behalf of a customer ("Customer") in providing the Service, and where the customer asks for it. It forms part of the Terms of Service and any written agreement between the parties. [Counsel: Quovarne expects to hold very little data on behalf of customers (work contact details of their staff). Please advise whether to keep this DPA on request or as a click-through.]

1. Definitions

"Data Protection Law" means the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, and other applicable data protection law. "Personal Data", "controller", "processor", "processing", "data subject" and "supervisory authority" have the meanings in the GDPR. "Customer Personal Data" means Personal Data that Quovarne processes on Customer's behalf through the Service.

2. Roles and instructions

2.1 For Customer Personal Data, Customer is the controller (or a processor acting for its affiliates) and Quovarne is the processor (or sub-processor).

2.2 Quovarne will process Customer Personal Data only on Customer's documented instructions, which are the Terms of Service, this DPA and Customer's use of the portal, and will tell Customer if it believes an instruction infringes Data Protection Law.

2.3 The subject matter, nature, purpose, duration, data and data subjects are in Schedule 1.

3. Quovarne's obligations

Quovarne will:

• ensure that persons authorized to process Customer Personal Data are bound by confidentiality;
• apply the security measures in Schedule 2;
• assist Customer, at Customer's reasonable cost, with data subject requests and with its security, breach-notification, impact-assessment and prior-consultation duties;
• notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data breach affecting Customer Personal Data;
• at Customer's choice delete or return Customer Personal Data when the Service ends, and delete existing copies unless the law requires storage (standard deletion: within 90 days);
• make available the information needed to show compliance and allow audits as in section 6.

4. Sub-processors

4.1 Customer authorizes Quovarne to use the sub-processors listed at [URL] (currently Cloudflare, Inc., Stripe, Inc. / Stripe Payments Europe, Ltd. and Resend, Inc.). Quovarne will bind them to obligations no less protective than this DPA and remains responsible for them.

4.2 Quovarne will give at least 15 days' notice of any addition or replacement. Customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

5. International transfers

5.1 Quovarne is established in the United States. Customer Personal Data from the EEA, the UK or Switzerland is transferred under:

• the EU-US Data Privacy Framework and its UK and Swiss extensions, where the recipient is certified;
• otherwise, the Standard Contractual Clauses of Implementing Decision (EU) 2021/914, Module Two (controller to processor) (Module Three where Customer is a processor), incorporated by reference, with clause 7 applied; clause 9(a) Option 2 (general authorization, 15 days); clause 11 optional wording not applied; clause 17 Option 1, law of Spain; clause 18, courts of Spain; Annex I as in Schedule 1; Annex II as in Schedule 2;
• for the UK, the ICO's International Data Transfer Addendum (version B1.0), incorporated by reference;
• for Switzerland, the same clauses with references to the GDPR read as references to the Swiss FADP.

5.2 If a transfer mechanism is invalidated, the parties will promptly agree an alternative.

6. Audit

On 30 days' written notice, no more than once a year, Quovarne will answer a reasonable written security questionnaire. On-site audits are available only where a supervisory authority or the law requires them, at Customer's cost, in business hours and under confidentiality.

7. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If the Standard Contractual Clauses conflict with this DPA or the Terms of Service, the Clauses prevail.

Schedule 1 – Description of processing

Schedule 2 – Technical and organizational measures