Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service between QVANTUS CAPITAL LLC ("Processor", "QVANTUS Agent") and its customers ("Controller") and governs the processing of personal data in accordance with Article 28 of the GDPR.

1. Roles & Responsibilities

• The Controller (customer) determines the purposes and means of processing personal data.
• The Processor (QVANTUS Agent) processes personal data only on documented instructions from the Controller.

2. Scope of Processing

• Data subjects: Controller's end users, customers, employees, and contacts.
• Data categories: names, email addresses, IP addresses, usage data, advertising account data, content data.
• Processing activities: platform operation, content management, campaign management, analytics, and AI-assisted services.
• Duration: for the term of the service agreement plus any legally required retention period.

3. Processor Obligations

• Process data only on documented instructions from the Controller.
• Ensure confidentiality — all personnel authorized to process data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures (see Security Policy).
• Assist Controller with data subject rights requests (access, erasure, rectification, portability).
• Notify Controller without undue delay (within 48 hours) upon becoming aware of a data breach.
• Maintain records of all processing activities carried out on behalf of the Controller.
• Make available all information necessary to demonstrate compliance and allow for audits.

4. Sub-Processors

The Processor may engage the following sub-processors. The Controller will be notified of any changes with 30 days' notice.

5. International Data Transfers

Any transfer of personal data outside the EEA is protected by Standard Contractual Clauses (SCCs) adopted by the European Commission, or equivalent safeguards recognized under GDPR.

6. Data Deletion & Return

Upon termination of the service agreement, the Processor will, at the Controller's choice, delete or return all personal data within 30 days, unless retention is required by applicable law. Certification of deletion will be provided upon request.

7. Governing Law

This DPA is governed by the laws of the Republic of Estonia and the GDPR. Any disputes shall be resolved in the courts of Tallinn, Estonia.

8. Contact