Data Processing Agreement

Last updated October 7, 2026

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 ("DPA Standard Terms"), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be "none" or "not applicable" and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

Key Terms

Agreement: This DPA supplements the Quick Assistant Terms of Service.

Approved Subprocessors: The list of Subprocessors.

Provider Security Contact: security@quickassistant.ai

Security Policy: As defined in the Agreement.

Security Reports: Section 5.2 (Security Reports) of the DPA Standard Terms is deleted.

Restricted Transfers

Governing Member State:

• EEA Transfers: Ireland.
• UK Transfers: The laws of England and Wales.

Annex I(A) List of Parties

Data Exporter

• Name: Customer (as defined in the Agreement).
• Address: The address for Customer associated with its Quick Assistant account or as otherwise stated in the Agreement.
• Contact person: The contact details for Customer associated with its Quick Assistant account or as otherwise stated in the Agreement.
• Activities relevant to transfer: See Annex I(B).
• Role: Controller (or Processor for Customer's Controller, as applicable).

Data Importer

• Name: Provider (Quick Assistant LLC).
• Address: 30 N Gould St, Ste R, Sheridan, WY 82801, USA.
• Contact person: privacy@quickassistant.ai.
• Activities relevant to transfer: See Annex I(B).
• Role: Processor.

Annex I(B) Description of Transfer and Processing Activities

Service: Quick Assistant.

Categories of Data Subjects:

• Customer's end users or customers.
• Customer's employees and individuals authorized by Customer to access Customer's Quick Assistant account.

Categories of Personal Data:

• Name.
• Contact information such as email, phone number, or address.
• User activity and analysis such as device information or IP address.
• Conversation content (messages, prompts, responses, transcripts and attachments, and voice audio where voice features are used).

Special Category Data: No.

Frequency of Transfer: Continuous.

Nature and Purpose of Processing: Provider will Process Customer Personal Data as instructed in Section 2.2 of the DPA Standard Terms. The nature of processing includes:

• Receiving data, including collection, accessing, retrieval, recording, and data entry.
• Holding data, including storage, organization, and structuring.
• Using data, including analysis, consultation, testing, automated decision making, and profiling.
• Updating data, including correcting, adaptation, alteration, alignment, and combination.
• Protecting data, including restricting, encrypting, and security testing.
• Sharing data, including disclosure, dissemination, allowing access, or otherwise making available.
• Returning data to the data exporter or data subject.
• Erasing data, including destruction and deletion.

Duration of Processing: Provider will Process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the DPA Standard Terms; or (ii) by Applicable Laws.

Annex I(C) Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II Technical and Organizational Security Measures

• Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services: Access to infrastructure and internal resources is managed on the basis of the Principle of Least Privilege: individuals are granted only the privileges they require to execute their business duties, and said privilege is revoked when it is no longer needed.
• Ability to restore the availability of and access to Customer Personal Data in a timely manner following a physical or technical incident: The database is backed up and maintained using at least industry standard methods.
• User identification and authorization process and protection: Customers who interact with the Service via the user interface are required to authenticate before they are able to access their non-public data. Provider stores user passwords following industry standard practices for security.
• Protecting Customer Personal Data during transmission (in transit): Provider makes HTTPS encryption (also referred to as SSL or TLS) available on all its interfaces. Its HTTPS implementation uses industry-standard algorithms and certificates.
• Protecting Customer Personal Data during storage (at rest): The database is encrypted at rest. Sensitive credentials are also encrypted before storage.
• Allowing data portability and ensuring erasure: Personal Data submitted to the Service by Customer may be deleted by the Customer or at the Customer's request.