Introduction

This Data Processing Agreement ("DPA") forms part of the Developer Agreement between Quox LTD ("Quox", "Processor") and the Developer ("Controller") and governs the processing of personal data by Quox on behalf of the Developer through the QuoxCORE plugin runtime.

This DPA is entered into to ensure compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable data protection legislation. In the event of any conflict between this DPA and the Developer Agreement, this DPA shall prevail with respect to data protection matters.

1. Definitions

In this DPA, the following terms have the meanings set out below. Terms not defined here have the meanings given to them in the UK GDPR or the Developer Agreement.

"Controller" means the Developer, being the natural or legal person which determines the purposes and means of the processing of personal data.
"Processor" means Quox LTD, being the natural or legal person which processes personal data on behalf of the Controller.
"Data Subject" means an identified or identifiable natural person whose personal data is processed under this DPA.
"Personal Data" means any information relating to a Data Subject that is processed by the Processor on behalf of the Controller in connection with the QuoxCORE plugin runtime.
"Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
"Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

2. Scope

This DPA applies where Quox processes personal data on behalf of the Developer through the QuoxCORE plugin runtime. This includes, but is not limited to, the following processing activities:

Storage of data submitted by End Users through the Developer's plugin via the plugin API storage layer
Transmission of data between End Users and the Developer's plugin through the backend proxy
Processing of data within the QuoxCORE memory system where a plugin accesses or stores End User data
Logging and monitoring of plugin activity where such logs contain personal data

This DPA does not apply to personal data that Quox processes as an independent controller (such as Developer account information, billing data, or platform analytics). Quox's processing of such data is governed by the Quox Privacy Policy.

3. Quox's obligations as Processor

When processing personal data on behalf of the Developer, Quox shall:

3.1 Documented instructions

Process personal data only on the documented instructions of the Controller, unless required to do so by applicable law. Where Quox is required by law to process personal data other than in accordance with the Controller's instructions, Quox shall inform the Controller of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

3.2 Confidentiality

Ensure that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Quox shall limit access to personal data to those employees, contractors, and agents who require access to fulfil Quox's obligations under this DPA.

3.3 Security measures

Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as further described in Clause 7 of this DPA.

3.4 Data subject requests

Assist the Controller, by appropriate technical and organisational measures and insofar as is possible, in fulfilling the Controller's obligation to respond to requests from Data Subjects exercising their rights under the UK GDPR. This includes requests for access, rectification, erasure, restriction, data portability, and objection. Quox shall promptly notify the Controller if it receives any such request directly from a Data Subject, and shall not respond to such request without the Controller's prior written instructions, unless required by law.

3.5 Assistance with compliance

Assist the Controller in ensuring compliance with the Controller's obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing and the information available to Quox. This includes assistance with data protection impact assessments and prior consultation with the Information Commissioner's Office (ICO) where required.

3.6 Deletion and return of data

At the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of processing services, and delete existing copies unless applicable law requires storage of the personal data. The timeline for deletion or return is specified in Clause 10 of this DPA.

3.7 Audit and information

Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, as further described in Clause 9.

4. Developer's obligations as Controller

The Developer, as Controller, shall:

Lawful basis: Ensure that there is a valid lawful basis under Article 6 of the UK GDPR for the processing of personal data, and where special category data is involved, a valid condition under Article 9
Data minimisation: Ensure that only personal data that is necessary for the specified processing purpose is submitted to the QuoxCORE plugin runtime. The Developer shall not instruct Quox to process personal data that is excessive, irrelevant, or unnecessary for the stated purpose
Transparency: Inform Data Subjects about the processing of their personal data in accordance with Articles 13 and 14 of the UK GDPR, including informing them that Quox acts as a Processor on the Developer's behalf
Lawful instructions: Ensure that all processing instructions given to Quox comply with the UK GDPR and all applicable data protection legislation. The Developer shall be solely responsible for the accuracy, quality, and legality of personal data and the means by which it was obtained
Privacy policy: Maintain an up-to-date privacy policy that accurately describes the Developer's data processing activities, including the use of Quox as a Processor, and make this policy available to Data Subjects
Data protection impact assessments: Conduct data protection impact assessments where required under Article 35 of the UK GDPR and consult with Quox where such assessments relate to the processing carried out by Quox

5. Sub-processors

The Developer provides general written authorisation for Quox to engage Sub-processors to assist in the processing of personal data, subject to the conditions set out in this Clause.

5.1 Current Sub-processors

As of the date of this DPA, Quox uses the following Sub-processors:

Hetzner Online GmbH (Gunzenhausen, Germany) for infrastructure hosting and data storage
Stripe, Inc. (San Francisco, USA; with EU entity Stripe Payments Europe, Ltd in Dublin, Ireland) for payment processing
Cloudflare, Inc. (San Francisco, USA; with EU presence) for content delivery, DDoS protection, and DNS services

5.2 New Sub-processors

Quox shall notify the Developer at least 30 days before engaging any new Sub-processor or replacing an existing Sub-processor. Notification shall be sent to the email address associated with the Developer's QuoxCORE account.

The Developer may object to the engagement of a new Sub-processor by providing written notice to Quox within 14 days of receiving the notification. The objection must state reasonable grounds relating to data protection. If the Developer objects, Quox shall use reasonable efforts to make available an alternative arrangement that avoids the use of the objected-to Sub-processor. If no alternative is reasonably available, either party may terminate the affected processing by giving 30 days' written notice.

5.3 Sub-processor obligations

Quox shall impose on each Sub-processor, by way of a written contract, data protection obligations no less protective than those set out in this DPA. Quox shall remain fully liable to the Developer for the performance of each Sub-processor's obligations.

6. Data transfers

Personal data processed under this DPA shall be processed within the United Kingdom and the European Economic Area (EEA).

Quox shall not transfer personal data to a country outside the UK and EEA unless:

The transfer is to a country that has been deemed to provide an adequate level of data protection by the UK Secretary of State under Section 17A of the Data Protection Act 2018 (adequacy regulations)
Appropriate safeguards are in place, such as the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses
A derogation under Article 49 of the UK GDPR applies and the Controller has provided prior written consent to the transfer

Where a Sub-processor is located outside the UK and EEA (for example, Stripe's US entity or Cloudflare's US entity), Quox shall ensure that appropriate transfer mechanisms are in place before any personal data is transferred.

7. Security measures

Quox shall implement and maintain the following technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage:

7.1 Encryption

Encryption of personal data in transit using TLS 1.2 or higher
Encryption of personal data at rest using AES-256 or equivalent

7.2 Access controls

Role-based access controls limiting access to personal data to authorised personnel only
Multi-factor authentication for administrative access to systems processing personal data
Regular review of access rights and prompt revocation upon role change or departure

7.3 Backup and recovery

Regular automated backups of systems containing personal data
Tested disaster recovery procedures
Geographically separated backup storage

7.4 Monitoring and incident response

Continuous monitoring of systems for security incidents
Documented incident response procedures
Regular security testing and vulnerability assessments

7.5 Organisational measures

Staff training on data protection and information security
Confidentiality obligations for all personnel with access to personal data
Documented information security policies and procedures

8. Data breach notification

Quox shall notify the Developer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting personal data processed on behalf of the Developer.

The notification shall include, to the extent reasonably available:

A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and personal data records affected
The name and contact details of Quox's point of contact for further information
A description of the likely consequences of the breach
A description of the measures taken or proposed to be taken to address the breach, including measures to mitigate its possible adverse effects

Quox shall cooperate with the Developer and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of the breach. The Developer, as Controller, is responsible for determining whether to notify the ICO and affected Data Subjects in accordance with Articles 33 and 34 of the UK GDPR.

9. Audit rights

The Developer may audit Quox's processing activities to verify compliance with this DPA, subject to the following conditions:

The Developer must provide at least 30 days' written notice of an intended audit
Audits shall be conducted no more than once per calendar year, unless a Personal Data Breach has occurred or a supervisory authority requests or mandates an audit
Audits shall be conducted during normal business hours and shall not unreasonably disrupt Quox's operations
The Developer (or its mandated auditor) must agree to reasonable confidentiality obligations before accessing Quox's premises or systems
The Developer shall bear its own costs in connection with any audit. Where an audit requires significant Quox resources beyond providing standard documentation, the parties shall agree on a reasonable contribution to costs in advance

As an alternative to an on-site audit, Quox may provide the Developer with a summary of the results of any independent third-party security audit or certification (such as ISO 27001 or SOC 2) that Quox has obtained. The Developer may accept such documentation in satisfaction of its audit rights for the relevant period.

10. Duration and termination

This DPA shall remain in effect for as long as the Developer Agreement between Quox and the Developer is in force. Upon termination or expiry of the Developer Agreement, this DPA shall automatically terminate.

Upon termination of this DPA, Quox shall, at the Developer's written election:

Return: Return all personal data to the Developer in a commonly used, machine-readable format within 90 days of termination
Delete: Securely delete all personal data within 90 days of termination, and provide the Developer with written confirmation of deletion

If the Developer does not provide written election within 30 days of termination, Quox shall delete all personal data within 90 days. Quox may retain personal data to the extent required by applicable law, provided that such retained data continues to be protected in accordance with this DPA.

The following Clauses shall survive termination of this DPA: Clause 1 (Definitions), Clause 7 (Security measures, with respect to any retained data), Clause 8 (Data breach notification, with respect to any breach discovered after termination), and Clause 9 (Audit rights, for a period of 12 months following termination).

11. Governing law

This DPA shall be governed by and construed in accordance with the laws of England and Wales. Any dispute arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

This DPA is subject to the UK GDPR and the Data Protection Act 2018. In the event of any conflict between this DPA and the UK GDPR, the provisions of the UK GDPR shall prevail.

Contact

For questions about this DPA or data protection matters, please contact us:

Email: [email protected]
Data Protection Enquiries: [email protected]
Address: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom