Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between QualityProxy Inc. (the "Processor") and the customer (the "Controller") when the Controller processes personal data subject to the GDPR, the UK GDPR, or similar laws using QualityProxy's Services.

This DPA applies to personal data that QualityProxy processes on behalf of the Controller in connection with account management, billing, support, and service delivery. It does not cover data that the Controller collects from third parties through proxy traffic: that remains the Controller's responsibility.

"Personal Data", "Processing", "Data Subject", "Subprocessor", and "Supervisory Authority" have the meanings given to them by applicable Data Protection Laws.

"Data Protection Laws" means the GDPR, the UK GDPR, the CCPA where applicable, and other privacy laws governing the processing.

Process Personal Data only on documented instructions from the Controller, including those relating to transfers, unless required by law.

Ensure that personnel authorized to process Personal Data are subject to confidentiality obligations.

Implement appropriate technical and organizational measures, as described in our security documentation.

Assist the Controller with data subject requests, DPIAs, and breach notifications to the extent reasonably necessary.

Delete or return Personal Data upon completion of the Services, without prejudice to legal retention requirements.

The Controller authorizes QualityProxy to engage Subprocessors for cloud hosting, payment processing, analytics, and support tools. The current list of Subprocessors is available upon request.

We notify the Controller of the addition of new Subprocessors with a thirty-day period to object on reasonable grounds. Objections may require alternative arrangements or termination without penalty if unresolved.

When Personal Data is transferred outside the EEA or the United Kingdom, QualityProxy will rely on the Standard Contractual Clauses, the UK IDTA addendum, or other approved mechanisms. Supplementary measures will apply based on the assessment performed.

QualityProxy will notify the Controller without undue delay upon becoming aware of a Personal Data breach affecting the Controller's data, providing the information reasonably available for the Controller's regulatory obligations.

With reasonable notice, the Controller may request the information necessary to demonstrate compliance. Enterprise customers may conduct audits under confidentiality agreements no more than once per year, unless required by the Supervisory Authority.

This DPA is incorporated into the Terms of Service at the time of account creation. Enterprise customers can formalize a version signed by both parties by contacting legal@qualityproxy.com.