Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the Terms of Service / main agreement between the Customer (“Controller”) and Qiq LLC (“Processor” or “Company”) regarding the use of the SaaS platform Qiq smart and related services (collectively, the “Services”). In case of conflict, the provisions of this DPA shall prevail with respect to data protection matters.

1. Definitions

The terms “Personal Data”, “Processing”, “Controller”, “Processor”, “Sub-processor”, “Personal Data Breach”, “Supervisory Authority”, etc. have the meaning given to them in Regulation (EU) 2016/679 (“GDPR”). “Agreement” means the Terms of Service / main agreement with the Customer.

2. Scope & Roles

For the use of the Services, the Customer acts as Controller and Qiq LLC as Processor. Qiq LLC processes Personal Data only on behalf of the Customer and in accordance with this DPA.

3. Documented Instructions

• Qiq LLC processes Personal Data only on the basis of documented instructions from the Customer.
• If Qiq LLC considers that an instruction infringes applicable law, it shall inform the Customer without undue delay.

4. Processing Details (Exhibit A)

The categories of data subjects, types of data, purposes, duration and nature of the processing are described in Exhibit A.

5. Security

Qiq LLC implements appropriate technical and organizational measures (TOMs), such as encryption in transit & at rest, access control (MFA, least privilege), environment separation, logging/monitoring, backups and incident response plans. An indicative list is provided in Exhibit A3.

6. Confidentiality & Personnel

Authorized personnel are bound by confidentiality obligations and receive appropriate data protection training.

7. Sub-processors

The Customer authorizes the use of the Sub-processors listed in Exhibit B. Qiq LLC will notify the Customer of material changes (e.g. additions/replacements) with reasonable prior notice (e.g. 15–30 days) so that the Customer may raise objections.

8. Data Subject Rights

Qiq LLC assists the Customer in handling requests for access, rectification, erasure, restriction, portability and objection, as well as in providing information to data subjects where required.

9. Personal Data Breaches

Qiq LLC notifies the Customer without undue delay of any Personal Data Breach and provides available information about the nature of the incident, the categories / approximate volumes of data, the likely consequences and the mitigation measures taken.

10. DPIA Assistance & Cooperation with Authorities

Qiq LLC provides reasonable assistance with Data Protection Impact Assessments (DPIA) and cooperates with Supervisory Authorities where required.

11. International Transfers

Where transfers outside the EEA/UK take place, the applicable Standard Contractual Clauses (SCCs) and supplementary measures are applied in accordance with the GDPR. Qiq LLC shall ensure an equivalent level of protection.

12. Data Deletion or Return

Following termination/expiration of the Agreement, Qiq LLC shall, at the Customer’s choice, delete or return the Personal Data within 30 days, unless retention is required by law.

13. Audits & Information

Upon request and at reasonable intervals, Qiq LLC makes available information demonstrating compliance with this DPA and allows audits/inspections by the Customer or an appointed auditor, subject to confidentiality obligations and reasonable limitations.

14. Liability

The parties’ liability with respect to data protection is allocated in accordance with applicable law and the Agreement. Each party is liable for its own acts/omissions that conflict with this DPA or with applicable law.

15. Governing Law & Hierarchy

This DPA is governed by the applicable law specified in the Agreement, without prejudice to the requirements of the GDPR. The SCCs are governed by the law specified therein. In case of conflict, this DPA prevails for data protection matters.

16. Contact & Notices

• Processor (Qiq LLC): 809 Cuesta Dr Ste B, Mountain View, CA 94040, USA — Email: info@qiq.one
• Legal form: Qiq LLC (State of New Mexico, USA)
• Website: https://qiq.one

Exhibit A — Processing Details & Security Measures

A1. Data Subjects

• End customers of Qiq’s business customers (e.g. clients booking appointments).
• Users/staff/administrators of business customers.
• Billing and support contacts.

A2. Categories of Personal Data

• Identification & contact details (name, email, phone).
• Booking/appointment data, preferences, notes entered by the customer.
• Technical/usage data (IP, user agent, logs, timestamps).
• Billing/charging (payment provider tokens/IDs; no primary card data stored by Qiq).
• Support content (tickets, attachments, metadata).

A3. Purposes & Nature of Processing

• Provision and operation of the Qiq smart SaaS platform.
• Transactional communications (e.g. confirmations/reminders), support, maintenance.
• Billing/charging, abuse prevention, security, performance analytics.

A4. Duration & Retention

For the entire duration of the Agreement and as long as required for legal obligations. Data is deleted/anonymized in accordance with the Customer’s retention policies or upon request, unless retention is required by law.

A5. Technical & Organizational Measures (indicative)

• Encryption in transit (TLS 1.2+) and at rest (DB/volumes where applicable).
• Access management: MFA, RBAC, least privilege, segregation of duties.
• Secret/key management, regular patching, vulnerability scans.
• Event logging/monitoring, alerting, incident response plan.
• Backups, integrity checks, recovery tests, data segregation.
• Secure SDLC, change management, code reviews.

Exhibit B — Approved Sub-processors

• Hetzner Online GmbH (EU — current): hosting, compute, storage and network services.
• Pointer / pointer.gr (GR — current): reverse proxy, DNS/domain services and operational/security logs.
• Resend (conditional): delivery of internal lead notifications when configured.
• Stripe (future): payment/subscription processing only when paid checkout is enabled.
• Amazon Web Services — SES/S3 (future/conditional): email or object storage only when configured.

Current and conditional providers apply only to the live components that use them. Future providers do not receive data until enabled. Where an EEA/UK-to-third-country transfer requires it, the applicable 2021 SCC module, annexes and transfer assessment must be completed.

This public DPA is a framework and becomes binding only when accepted or executed with the applicable service agreement, order or customer onboarding.

In case of any inconsistency between the Greek and English versions, the English version shall prevail.