Data Processing Agreement
Contractual template — applies when accepted in the service order. Use your browser’s print command to save this complete version as PDF.
This agreement defines how QEDARA S.R.L., Romania, CUI 54412264 (Qedara), processes personal data for the business customer identified in the QCM service order (Customer). It includes confidentiality obligations for all Customer Content. It becomes binding only when incorporated into an accepted service order or signed by both parties; publication alone does not execute it.
1 Scope and roles
Customer acts as controller, or as a processor authorised by its controller. Qedara acts as processor or subprocessor for Customer Personal Data. Customer Content means uploaded files, contracts, versions, messages, prompts, results, signing records and other material supplied or generated for Customer. Customer Personal Data is personal data within that content. Qedara handles its own invoicing, business contacts and legal administration as a separate controller under its privacy notice; this does not permit reuse of contract content.
2 Instructions and lawful processing
Qedara will process Customer Personal Data only to deliver the ordered QCM service, on documented instructions comprising the service order, this DPA, authorised product actions and written requests from Customer’s designated administrator. Instructions cover disclosure, deletion and transfers. Qedara will notify Customer if an instruction appears unlawful and suspend the affected instruction pending clarification. Legally compelled processing will be notified before processing unless the law prohibits notice.
Customer determines the purposes, lawful basis, notices and authority for uploading content and inviting signatories. Qedara will not sell Customer Personal Data, use Customer Content for advertising, train or fine-tune models on it, or authorise a provider to use it for general model training. Processing for a requested AI inference remains permitted within the approved service and transfer arrangements.
3 Confidentiality and ownership
All Customer Content is confidential, whether or not marked confidential and whether or not it contains personal data. Qedara will use it solely to perform the service and legal obligations, restrict access to persons with a documented need, and bind personnel and subcontractors to confidentiality before access. Customer retains its rights in its content. No licence is granted beyond what is necessary to perform the service.
Exceptions apply only to information demonstrably public without breach, lawfully received without restriction, independently developed without access, or lawfully known beforehand. Required disclosure will be limited to what is legally necessary, with notice when permitted and reasonable assistance seeking protective measures. Confidentiality survives termination for as long as the information remains confidential.
4 Security and assistance
Qedara will maintain the technical and organisational measures in Annex B, assess relevant risks and avoid materially reducing protection during the service. Qedara will provide reasonable assistance with data subject requests, security obligations, breach assessment, impact assessments and prior consultation, considering the nature of the processing and information available. It will forward a data subject request to Customer within two business days and will not substantively respond without instruction unless legally required.
5 Personal data breaches
Qedara will notify Customer without undue delay and in any event within 24 hours after becoming aware of a personal data breach affecting Customer Personal Data. The first notice will be sent to Customer’s designated security contact and account owner and may be preliminary. It will identify the nature of the breach, known data and persons affected, likely consequences, containment measures and a contact point, insofar as available. Missing information will follow without undue delay, with updates at least every 24 hours while material investigation continues.
Notification does not depend on completion of the investigation or a final assessment of fault. Customer remains responsible for its controller notifications to authorities and individuals; Qedara will assist and preserve relevant evidence. A service interruption alone is not necessarily a personal data breach. The incident procedure in QCM-INC-001 governs operational handling without weakening this clause.
6 Subprocessors and changes
Customer gives general written authorisation for the specifically identified subprocessors and purposes in QCM-SUB-001 as incorporated into the service order. Qedara will impose written obligations that provide equivalent data protection and remain responsible for its subprocessors’ performance of those obligations. A public supplier policy is not a substitute for the applicable supplier agreement.
Qedara will email Customer’s designated contact at least 30 calendar days before a new or replacement direct subprocessor first receives Customer Personal Data. The notice will identify the entity, countries, purpose, data and transfer safeguard. Customer may object on reasonable data protection grounds within 15 days. The affected processing will not start while a timely objection remains unresolved. Qedara will seek an alternative; if none is workable, Customer may terminate the affected service before the change with a pro rata refund of unused prepaid fees.
Urgency does not create automatic authorisation. If 30 days cannot be observed, Qedara will obtain specific written authorisation or pause the affected processing. Material downstream changes will be assessed, communicated promptly and handled so the agreed safeguards remain effective.
7 International transfers
Qedara will not make a restricted international transfer without a lawful Chapter V GDPR mechanism and the required supplementary measures. QCM-XFER-001 identifies the relevant transfer chains, supplier terms and SCC application. The European Commission’s unchanged 2021/914 clauses are supplied separately in the package. A customer DPA does not by itself bind an overseas AI provider or replace the provider’s own transfer agreement.
8 Return and deletion
On termination or an authorised request, Customer may choose return and deletion or deletion alone. Qedara will make the agreed export available within 15 calendar days and complete deletion from active systems within 30 calendar days of the request or termination, unless Customer expressly instructs a later date. Backups expire within 30 further days after active deletion. QCM-RET-001 defines category-specific periods and evidence. No new ordinary processing is permitted merely because a backup copy remains.
A legal retention requirement or documented Customer legal hold must identify the records, basis, access restrictions and review date. Qedara will tell Customer of the exception unless prohibited, isolate retained data and delete it when the exception ends. It will provide a completion certificate on request, recording active deletion and the final backup expiry date separately.
9 Evidence and audit rights
Qedara will provide information reasonably necessary to demonstrate compliance and allow and contribute to audits and inspections by Customer or an independent auditor bound to confidentiality. Routine audits may use relevant reports and remote evidence first and be arranged on reasonable notice during business hours. A material incident, substantiated concern or regulator request allows additional or urgent review. Audit arrangements must protect other customers and must not prevent statutory audit rights. Findings will receive a corrective action plan and progress reporting.
10 Term precedence and acceptance
This DPA applies while Qedara processes Customer Personal Data, including retained copies. Mandatory data protection law and applicable SCCs prevail, followed by this DPA and its incorporated schedules, then the service agreement. Liability is governed by the service agreement only insofar as it does not restrict mandatory rights or SCC protections. Changes require the parties’ agreement or a legally required update preserving protection.
The effective date, Customer’s legal name and address, authorised representatives and security contact are those recorded in the executed service order or signature page. Qedara’s contact for this DPA is office@qedara.com. The following schedules are part of this DPA: Annex A and Annex B below; QCM-RET-001; QCM-SUB-001; and QCM-XFER-001, each version 1.2 when accepted.
Acceptance record: service order reference ____________________ Effective date ____________________ For Customer: name, role and signature ____________________ For QEDARA S.R.L.: name, role and signature ____________________ Customer security contact and fallback contact ____________________
Annex A Processing particulars
| Particular | Agreed scope |
|---|---|
| Subject and purpose | Hosting and managing contracts and document families; extraction, requested AI assistance, signing, obligations, partner checks and authorised exports. Optional integrations only when separately enabled. |
| Operations | Collection, organisation, storage, retrieval, analysis, controlled disclosure, export, restriction, return and deletion. |
| Data subjects | Customer users and staff; counterparties and their representatives; signatories; people named in authorised uploaded documents. |
| Data categories | Names and business contact details; roles; contractual and financial details in documents; signatures and verification evidence; account, access and activity metadata; AI inputs and outputs. |
| Sensitive data | Special-category or criminal-offence data is outside the standard intended use. Deliberate processing requires a documented assessment and agreed safeguards before upload. Incidental content remains protected by this DPA. |
| Duration and frequency | During the service, on user actions and authorised scheduled operations, followed by the return, deletion and backup periods in QCM-RET-001. |
| Customer instructions | Authorised workspace controls and the designated administrator. Additional purposes, destinations or materially different categories require a documented instruction and assessment. |
Annex B Technical and organisational measures
Access: workspace membership and operation permissions are checked server-side. Owner, admin, editor and viewer roles limit actions. Sessions support server-side revocation and a 120-minute inactivity limit, with warning at 115 minutes. Designated privileged actions have additional verification; universal MFA and customer SAML SSO are not represented as available.
Data handling: HTTPS protects service access. Passwords are salted hashes. Provider credentials use the configured secret vault when that feature is available. Customer Content is not placed in ordinary operational logs by policy. Access for support must be authorised, limited and recorded. Whole-disk encryption of all active data is not asserted by this annex.
Resilience and integrity: production and staging use separate storage. Backup procedures cover both the database and attachment objects and include encryption and an off-host copy. Signing workflows record verification and integrity evidence. Restore checks, retention execution and incident exercises must be evidenced and reviewed under the operating procedures.
Governance: changes are reviewed and tested for affected controls; incidents, deletion and supplier changes are recorded. Personnel are subject to confidentiality and access removal procedures. Measures will be reassessed at least annually and after material changes. These commitments do not claim ISO 27001, SOC 2, an independent penetration test, or a qualified electronic signature certification.