Data processing agreement

This agreement applies whenever QUORIAN - F.Z.E(“Processor”) processes personal data on behalf of a client (“Controller”). It forms part of our Terms of service and takes effect automatically when you start using a module that involves personal data. No signature is needed, though we will sign a copy on request.

Drafted to match how the product works, on standard market terms, but not yet reviewed by a qualified lawyer. Have counsel check it before your first client. [CONFIRM]

1. Roles

You are the Controller. You decide whose personal data is processed and why. We are the Processor and act only on your instructions.

Your instructions are given through the platform: the lists you upload or approve, the sequences you approve, and the settings you choose. Using the product is how you instruct us. We will tell you if an instruction appears to breach applicable data protection law.

2. Subject matter and duration

Subject matter: providing the modules you have bought. Duration: for as long as your account is active, plus the retention periods in our Privacy policy.

3. Nature and purpose of processing

• Storing and organising the contact data you provide, and enriching it only where you ask.
• Generating and sending email to those contacts once you have approved the content.
• Receiving and classifying replies, and recording bounces and unsubscribes.
• Producing reporting on what was sent and what came back.

4. Types of personal data

• Your prospects. Name, work email address, job title, employer, and any other business field you choose to upload, plus the content of their replies.
• Your staff. Name, work email, and role, for the people you invite into the workspace.

We do not require special category data and our Acceptable use policy prohibits you from uploading it.

5. Categories of data subject

The business contacts you choose to approach, and your own personnel.

6. Our obligations

• Process personal data only on your documented instructions.
• Ensure people authorised to process it are bound by confidentiality.
• Apply appropriate technical and organisational security measures, set out in section 8.
• Assist you, so far as we reasonably can, with data subject requests, impact assessments, and regulator consultations.
• Notify you without undue delay, and in any event within 48 hours, if we become aware of a personal data breach affecting your data.
• Delete or return the data at the end of the agreement, as set out in section 10.
• Make available the information you reasonably need to demonstrate our compliance.

7. Sub-processors

You give us general authorisation to use sub-processors. The current list is published at quorian.com/subprocessors, with what each one does and where it operates.

We impose data protection obligations on each sub-processor that are no less protective than these, and we remain responsible to you for their performance.

We will give you at least 30 days notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds within that period, and we cannot offer an alternative, you may terminate the affected module without penalty and we will refund any fees you have paid for a period we no longer serve.

8. Security measures

• Row level isolation enforced in the database on every table, so a query from one organisation cannot return another’s rows.
• Credentials, including mailbox passwords and provider tokens, held in storage that no client account can read, separated from ordinary application data.
• Encryption in transit and at rest.
• Access to production data limited to personnel who require it, using individually attributed accounts.
• Logging of processing activity carried out on your behalf.
• Automated suppression, so an unsubscribe or a hard bounce prevents further contact without anyone having to act on it.

9. International transfers

Our sub-processors operate internationally, so data may be processed outside the country where you are based, including in the European Union and the United States.

Where the UK or EU GDPR applies to a transfer, it is made under the European Commission’s Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies, as incorporated into our agreement with the relevant provider. We assess each provider before engaging it and will provide the relevant terms on request.

10. Deletion and return

On termination, and on request at any time, we will delete the personal data we process for you, or return it in a machine readable format first if you ask.

Two exceptions. We keep what the law requires us to keep, such as billing records. And we keep suppression records, meaning addresses that must not be contacted again, because deleting those would allow someone who asked not to be contacted to be contacted again. Suppression records hold the address and the fact of the objection, nothing else.

11. Audits

We will respond to reasonable written questions about our processing, and provide any certifications or reports we hold. You may audit us once in any twelve month period, on 30 days notice, at your cost, subject to confidentiality and to not disrupting other clients.

12. Your obligations

You confirm that you have a lawful basis for the processing you instruct, that you have given the required privacy information to the people concerned where it applies, and that the data you upload was lawfully obtained. This is set out further in the Acceptable use policy.

13. Contact

Data protection matters: privacy@quorian.com. To request a signed copy of this agreement, write to legal@quorian.com.