Data processing agreement

1.Parties and roles

The customer (the person or organisation that accepted the terms and owns the projects concerned) is the controller. Enqualia (Enqualia, KVK 97480169, Business address: to be added before publication) is the processor. If the customer is itself a processor for someone else, Enqualia is its sub-processor and this DPA applies in the same way.

Terms such as personal data, processing, controller, processor, sub-processor, data subject and personal data breach have the meaning the GDPR gives them.

2.What we process

Subject and purpose

Providing the Service to the customer: storing and processing the content of its workspaces, running Qualia and the APIs on that content, connecting the outside services the customer chooses, and supporting the customer.

Nature of the processing

Hosting, storing, structuring, searching, analysing, transforming and transmitting data, including sending it to AI models to produce the results the customer asks for.

Types of personal data

Whatever the customer puts in or connects. This can include names, contact details, job and company details, correspondence and e-mail, documents and notes, CRM and customer records, files, images, voice transcripts, and usage data of the customer's users.

Data subjects

The customer's users, employees and contractors; its clients, prospects, suppliers and other contacts; and people mentioned in the customer's content.

Special categories of data

Only if the customer chooses to process them, in which case the customer is responsible for the lawful basis and the safeguards.

Duration

As long as the customer uses the Service, plus the time needed to delete the data as described under Deletion and return.

3.Instructions

We process personal data only on the customer's documented instructions: the terms and this DPA, the customer's settings and configuration in the Service, and the requests its users make in the Service, including to Qualia. We process it otherwise only where EU or Dutch law requires it; we then tell the customer first, unless that law forbids it.

If we believe an instruction breaks the GDPR or other data protection law, we tell the customer and may decline to carry it out.

The customer is responsible for having a lawful basis for the processing, for informing the data subjects, and for the content it puts in the Service.

4.Confidentiality

Everyone at Enqualia with access to the customer's personal data is bound to confidentiality; today that is only the founder. We access workspace content only when that is needed to provide the Service, to solve a problem the customer reports, for security, or when the law requires it.

5.Security

We take the technical and organisational measures listed under Security measures, appropriate to the risk, as article 32 GDPR requires. We may change them, but never in a way that lowers the overall level of protection.

6.Sub-processors

The customer gives general authorisation for the sub-processors on our sub-processor list. We bind each of them to data protection obligations that protect at least as well as this DPA, and we remain responsible to the customer for them.

We announce a new or replaced sub-processor at least 30 days before it starts processing the customer's personal data, on the sub-processor page and by e-mail to project owners. The customer may object on reasonable grounds within that period. We then look for a solution together; if there is none, the customer may end the affected part of the Service, and we refund the prepaid part that has not been used.

Services the customer connects itself, such as its mailbox, Google Drive or databases, are not our sub-processors: the customer chooses them and has its own agreement with them.

7.Transfers outside the EU

We transfer personal data outside the European Economic Area only with a safeguard under chapter V of the GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) or the European Commission's Standard Contractual Clauses. The sub-processor list shows where each sub-processor processes data.

The customer can keep AI processing inside the EU by choosing EU Qualia's choice or an EU-hosted model, or by having its organisation set to EU-only processing. Some features, such as live voice, are not available then.

8.Help with data subjects' rights and compliance

The Service lets the customer find, export, correct and delete the personal data in its workspaces. If a data subject contacts us directly about the customer's data, we refer them to the customer and inform the customer without undue delay.

We help the customer, as far as can reasonably be expected given the nature of the processing and the information we have, with data protection impact assessments, prior consultation of a supervisory authority and its security obligations. We may charge reasonable costs for help that goes beyond what the Service itself offers.

9.Personal data breaches

We notify the customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach that affects its personal data. We provide the information we have that the customer needs for its own obligations: what happened, which data and data subjects are affected, the likely consequences, and the measures taken or proposed. We take the measures needed to limit the harm and keep the customer informed.

10.Deletion and return

The customer can export its content and delete it in the Service at any time. When the customer deletes content, a project or its account, or when the agreement ends, we delete the personal data concerned. Deleted data disappears from our backups when they are overwritten, at the latest after Number of days: to be added before publication days. We keep personal data longer only where EU or Dutch law requires it, such as for invoices.

If the agreement ends for a reason other than the customer deleting its account, the customer has at least 30 days to export its content before we delete it.

11.Information and audits

We make available the information needed to show that we meet our obligations under article 28 GDPR. Where possible we answer with documentation first, such as the certifications and audit reports of our hosting provider Google Cloud. The customer may have an audit carried out at most once a year, at its own cost, by an independent auditor bound to confidentiality, with at least 30 days' notice and without disturbing our operations unreasonably.

An audit after a personal data breach, or one that a supervisory authority requires, is not limited to once a year.

12.Liability and precedence

The limits of liability in the terms apply to this DPA, as far as the law allows. If this DPA and the terms conflict about personal data, this DPA prevails; Standard Contractual Clauses, where they apply, prevail over both.

This DPA is governed by Dutch law, like the terms.

13.Security measures

The technical and organisational measures we take, as an annex to this DPA:

• Location: the platform's servers, database and file storage run in the EU (Google Cloud in Belgium, with the database replicated to the Netherlands).
• Encryption: all traffic over HTTPS; data at rest encrypted by Google Cloud.
• Secrets: credentials for connected services in Google Secret Manager in the EU, never in the database. An API key the customer creates is stored only as a hash (keys created before the switch to hashes in 2026 may still be stored in full until that copy is removed). A project's workspace key, which opens Qualia for the project's members, and the key on Enact's Integrate tab, which calls one API granted to a personal space, are stored in full so that they can be handed out again; the workspace keys of an organisation's projects are replaced when a member is removed from the organisation.
• Access control: sign-in through Firebase Authentication; role-based access per project; API keys limited to chosen APIs; mail and other owner-only data hidden from members, share links and watchers; access to production limited to the founder.
• Separation: each customer's data is kept per project; APIs a customer deploys run on their own server; code written by the Workbench runs in an isolated sandbox without open network access.
• AI safeguards: content from mail and other outside sources is treated as untrusted; the agent cannot send e-mail, and what it may do after reading such content is restricted.
• Monitoring: request and error logs, error reports with keys and tokens removed, and automated tests on every change.
• Resilience: managed Google Cloud services and database backups.
• People: confidentiality obligations and a single, named administrator.
• Incidents: a procedure to assess, contain and report personal data breaches within the deadlines of this DPA.

14.Sub-processors

The current list, which is part of this DPA. Changes are announced as described under Sub-processors above.