Data Processing Addendum

Scope & roles

This Data Processing Addendum ("DPA") forms part of the agreement between the Customer and Quelixa Technologies ("Quelixa") and applies where Quelixa processes personal data on the Customer's behalf in providing the Services.

The Customer is the controller and Quelixa is the processor (or, where the Customer is itself a processor, Quelixa is a sub-processor). For website and account data Quelixa processes for its own purposes, the Privacy Policy applies.

Definitions

"Personal Data", "processing", "controller", "processor" and "data subject" have the meanings given in applicable data-protection law, including the GDPR. "Sub-processor" means any processor engaged by Quelixa to process Personal Data.

Details of processing

• Subject matter — provision of the Quelixa Cloud platform.
• Duration — the term of the agreement, plus deletion/return as below.
• Nature & purpose — hosting, processing and securing Customer Data to deliver the Services.
• Data subjects — the Customer's staff, customers, suppliers and contacts.
• Data categories — those the Customer chooses to enter into its workspace (e.g. contact, financial, employment records).

Customer instructions

Quelixa processes Personal Data only on the Customer's documented instructions — including the agreement, configuration of the Services, and lawful written requests — unless required by law, in which case Quelixa will inform the Customer where permitted.

Confidentiality

Quelixa ensures that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations and access it on a least-privilege, need-to-know basis.

Security measures

Quelixa implements appropriate technical and organisational measures, including:

• Per-customer isolation — a dedicated container and database per tenant.
• Encryption of Personal Data in transit.
• Access controls, authentication and audit logging.
• Daily backups and monitoring.
• Regular review and patching of the platform.

Sub-processors

The Customer authorises Quelixa to engage sub-processors (e.g. cloud infrastructure, payment processing, email delivery and AI model providers) under written terms that impose data- protection obligations no less protective than this DPA. Quelixa remains responsible for their performance and will give notice of intended changes so the Customer may object on reasonable grounds.

Data subject requests

Taking into account the nature of the processing, Quelixa will assist the Customer with appropriate measures to respond to data subjects exercising their rights, including through the self-service controls available in the workspace.

Personal data breach

Quelixa will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting Customer Data, and will provide information reasonably available to help the Customer meet its own notification obligations.

International transfers

Where processing involves transferring Personal Data across borders, Quelixa relies on an appropriate transfer mechanism, such as the Standard Contractual Clauses, which are incorporated by reference where applicable.

Audits

Quelixa will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable confidentiality and frequency limits.

Deletion & return

On termination, the Customer may export its data for a reasonable period. Thereafter Quelixa will delete or return Customer Data containing Personal Data, except where retention is required by law. Backups are deleted on their normal cycle.

Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.