Data Processing Addendum

Effective Date: August 30, 2026

GDPR / UK GDPR / U.S. state privacy law processor terms

Replaces the DPA dated July 2, 2026. Updated for the Workforce platform. Applies only where Customer submits personal data subject to the GDPR, UK GDPR, or a U.S. state privacy law. PHI is governed by the BAA.

This Data Processing Addendum ("DPA") forms part of the agreement between Quaspar Inc., a Delaware corporation with its principal place of business in Chicago, Illinois ("Quaspar" or "Processor") and Customer ("Controller") for the Quaspar Workforce platform (the "Service").

1. Roles and scope

Customer is the controller (or a processor acting for its own controllers) of personal data it submits to the Service ("Customer Personal Data"). Quaspar is the processor. Quaspar is an independent controller for account, billing, and usage data described in its Privacy Policy.

2. Processing details

Item	Description
Subject matter	Provision of the Service: building and running AI workers on Customer's data
Duration	The term of the Agreement plus the export and deletion period
Nature and purpose	Hosting, retrieval, analysis, generation, transmission to connectors and model providers, and storage as directed by Customer
Categories of data subjects	Customer's staff, patients, research subjects, contacts, and other individuals whose data Customer submits
Categories of personal data	Identifiers, contact details, professional data, health data (as PHI under the BAA), research data, communications, and any other data Customer chooses to process
Special categories	Health data and, if Customer processes it, genetic data. Customer is responsible for a lawful basis under Art. 9

3. Processor obligations

Quaspar will: (a) process Customer Personal Data only on Customer's documented instructions, including the Agreement and Customer's configuration of workers and connectors, unless required by law, in which case Quaspar will inform Customer unless prohibited; (b) ensure personnel are bound by confidentiality; (c) implement the technical and organizational measures in Annex 2; (d) assist Customer with data subject requests, DPIAs, and consultations with supervisory authorities, taking into account the nature of the processing; (e) notify Customer without undue delay and within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data; (f) delete or return Customer Personal Data at the end of the Agreement, subject to legal retention; (g) make available information necessary to demonstrate compliance and allow audits under Section 6; and (h) inform Customer if an instruction in Quaspar's view infringes data protection law.

4. Sub-processors

Customer authorizes the sub-processors in the Sub-processor List. Quaspar will give at least 30 days' notice of new sub-processors by email to the account admin and by updating the list. Customer may object on reasonable data-protection grounds within that period; if unresolved, Customer may terminate the affected Service with a pro-rated refund. Quaspar will impose data protection obligations on sub-processors equivalent to this DPA and remains liable for their performance.

5. International transfers

Where Customer Personal Data subject to the GDPR or UK GDPR is transferred to the United States, the parties incorporate the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, with Clause 7 (docking) included, Option 2 of Clause 9(a) with 30 days' notice, Clause 11 optional language excluded, Clause 17 governed by Irish law, and Clause 18 courts of Ireland, and Annexes I and II completed by Sections 2 and Annex 2 of this DPA. For UK transfers, the UK International Data Transfer Addendum applies. Quaspar will inform Customer if it can no longer comply with the Clauses.

6. Audits

Quaspar will provide, on request and not more than once a year, its most recent third-party audit reports, penetration test summaries, and completed security questionnaires. Where these do not reasonably satisfy Customer's legal obligations, Customer may conduct an audit with 30 days' notice, during business hours, under confidentiality, at Customer's cost, and without disrupting the Service.

7. U.S. state privacy laws

For personal data subject to the CCPA/CPRA or similar state laws, Quaspar is a service provider or processor. Quaspar will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship or for any purpose other than the Service, or combine it with data from other sources except as permitted. Quaspar certifies it understands these restrictions and will notify Customer if it can no longer meet them. Customer may take reasonable steps to stop and remediate unauthorized use.

8. AI model providers and learning

Model providers are sub-processors. Quaspar contracts with providers on terms that prohibit training on Customer Personal Data where available. Per-worker learning data is scoped to Customer's organization, redacted of direct identifiers, and is not used to train models for other customers.

9. Liability

Each party's liability under this DPA is subject to the limitations in the Agreement, except that nothing limits liability to data subjects under Article 82 GDPR.

Annex 2 — Technical and organizational measures

Encryption: TLS 1.2+ in transit; AES-256 at rest (Google Cloud SQL, Secret Manager, Memorystore with TLS and AUTH).
Access control: role-based access, least privilege, MFA for Quaspar staff, per-organization data isolation, workspace membership controls.
Policy engine: deterministic enforcement of worker permissions; per-organization AI budget caps.
Logging and monitoring: structured audit logs, OpenTelemetry tracing, alerting on anomalies, rate limiting.
Input handling: upload type-sniffing, input sanitization, content security policy headers, webhook signature verification.
Resilience: automated backups, idempotent migrations, shadow and canary rollouts, load testing.
Vendor management: BAAs and DPAs with sub-processors; annual review.
Personnel: confidentiality agreements, security and HIPAA training, sanctions policy.
Data lifecycle: export on request, deletion within 90 days of account deletion, backup overwrite within 35 days.

IN WITNESS WHEREOF, the parties have executed this Agreement as of the Effective Date.

By: ______________________________

Name: ____________________________

Title: _____________________________

Date: _____________________________

CUSTOMER

By: ______________________________

Name: ____________________________

Title: _____________________________

Date: _____________________________