Data Processing Addendum

This addendum ("DPA") is part of the Terms of Service between Quantra Innovation & Technology, Inc. ("Norma", the processor) and the customer (the controller). It applies when Norma processes personal data on the customer's behalf, and it is written to meet Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. Customers who need a countersigned copy can ask at support@normaqms.com.

1. What we process

• Subject matter and purpose: providing Norma to the customer under the Terms.
• Duration: for as long as the customer's account is open, plus the 90 days after closure described in the Terms.
• Kinds of personal data: names, work email addresses, job roles and org-chart positions, training and qualification records, signatures and the record of actions people took, and any personal data the customer chooses to put in documents, records and files.
• People concerned: the customer's employees, contractors, auditors and consultants; contacts at the customer's suppliers and customers.
• Special categories: Norma isn't designed for them, and the customer agrees not to upload them.

2. Our commitments as processor

We will:

1. process personal data only on the customer's documented instructions — the Terms, this DPA, and how the customer uses Norma — unless the law requires otherwise (we'll say so first, where allowed);
2. make sure everyone at Norma who can access customer data is bound to confidentiality;
3. apply the security measures in section 5;
4. use subprocessors only as in section 4;
5. help the customer, as far as Norma's functions allow, to answer requests from people exercising their rights;
6. help the customer with security, breach notification, data protection impact assessments and consultations with regulators, taking into account the information we have;
7. at the end of the service, let the customer export its data (Settings → Termination pack) and then delete it as in section 7;
8. make available the information needed to show we meet this DPA, and allow for and contribute to reasonable audits, as in section 8.

3. The customer's commitments

The customer is responsible for having a lawful basis for the personal data it puts into Norma, for giving people any notices the law requires, and for the accuracy of that data.

4. Subprocessors

The customer gives general authorization for the subprocessors on our Subprocessors page. We'll give at least 30 days' notice of a new one, by updating that page and, for customers who ask, by email. The customer may object on reasonable data protection grounds; if we can't resolve the objection, the customer may cancel the affected service and receive a refund of prepaid fees for the unused period. Each subprocessor is bound by data protection terms at least as protective as these, and we remain responsible for its work.

5. Security

We protect customer data with the measures described on our Security page, including: each organization's data separated by database row-level security, encrypted connections, password re-entry for signatures, a second sign-in step for administrators, a 15-minute idle sign-out, screening of uploaded files, an append-only record of every action, and daily backups. We review these measures as Norma changes.

6. Personal data breaches

If we become aware of a breach of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to customer personal data, we'll tell the customer without undue delay and within 72 hours, with what we know, and keep it updated as we learn more.

7. Return and deletion

The customer can download its data at any time. When the account is closed, we keep the data for 90 days, then delete it; backup copies age out within the following 7 days. We may keep data longer only where the law requires it, and then only for that purpose.

8. Audits

We'll answer reasonable written security questionnaires once a year, and share relevant documentation under confidentiality. We don't yet have a SOC 2 report. If the customer's regulator requires it, or a breach makes it necessary, the customer (or an independent auditor bound to confidentiality) may audit our compliance with this DPA, with at least 30 days' notice, during business hours, at the customer's cost, and without access to other customers' data.

9. International transfers

Customer data is stored in the United States. For personal data transferred from the European Economic Area, Switzerland or the UK, the parties agree to the European Commission's Standard Contractual Clauses (Module Two, controller to processor), and for the UK the International Data Transfer Addendum, which are incorporated into this DPA by reference. We'll provide a completed copy on request.

10. Order of precedence

If this DPA conflicts with the Terms about personal data, this DPA wins. If the Standard Contractual Clauses conflict with this DPA, the Clauses win.

Contact

Quantra Innovation & Technology, Inc., 2157 Clearwater Drive, Deltona, FL 32738. Email: support@normaqms.com.