Data Processing Addendum

This Addendum applies when QATesty processes personal data on behalf of a customer under the Terms or an order form. The customer is the controller and QATesty is the processor unless applicable law assigns different roles.

QATesty processes personal data only on documented customer instructions, including those inherent in providing the service, and ensures authorized personnel are bound by confidentiality obligations.

Appropriate technical and organizational measures are maintained in light of processing risk. Confirmed personal-data breaches are communicated without undue delay as required by law and contract.

Subprocessors may be used under written data-protection obligations. Customers receive the notice and objection rights stated in their agreement. Restricted transfers rely on a recognized legal mechanism where required.

Taking account of the nature of processing, QATesty reasonably assists with data-subject requests, impact assessments, regulator consultations, deletion or return, and audit information, subject to confidentiality, security, and agreed commercial terms.