Data Processing Addendum
Effective October 30, 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement between QIT and the customer (“Customer”) for the Services (the “Agreement”). It applies where QIT processes Customer Personal Data on Customer’s behalf. If there is a conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of personal data.
1. Definitions
“Data Protection Laws” means all laws applicable to the processing of personal data under the Agreement, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP and the California Consumer Privacy Act (“CCPA”). “Customer Personal Data” means personal data contained in Customer Content that QIT processes on Customer’s behalf. “Controller”, “Processor”, “Data Subject”, “Personal Data Breach” and “Processing” have the meanings given in the GDPR. “Sub-processor” means any processor engaged by QIT to process Customer Personal Data.
2. Roles and scope
Customer is the controller (or a processor acting for its own controllers) and QIT is a processor of Customer Personal Data. Details of the processing:
| Subject matter | Provision of AI model inference, compute and related Services |
|---|---|
| Duration | The term of the Agreement plus the deletion period in Section 9 |
| Nature and purpose | Receiving, transmitting, computing on, storing and returning Customer Content to provide the Services |
| Data subjects | Customer’s end users, employees and any individuals whose data Customer submits |
| Categories of data | Any personal data contained in Customer Content, as determined by Customer |
| Special categories | Only if Customer chooses to submit them; Customer is responsible for having a lawful basis |
3. QIT obligations
- Process Customer Personal Data only on Customer’s documented instructions, including those in the Agreement and given through the Services, unless required otherwise by law (in which case QIT will inform Customer unless legally prohibited).
- Never use Customer Personal Data to train models, and never sell or share it as those terms are defined in the CCPA.
- Ensure personnel authorised to process Customer Personal Data are bound by confidentiality.
- Implement the technical and organisational measures described in Section 7.
- Assist Customer, taking into account the nature of the processing, with Data Subject requests, data protection impact assessments and prior consultations.
- Inform Customer if, in QIT’s opinion, an instruction infringes Data Protection Laws.
4. Customer obligations
Customer is responsible for the lawfulness of the Customer Personal Data it submits, for providing required notices and obtaining required consents, and for the accuracy of its instructions.
5. Sub-processors
Customer authorises QIT to engage Sub-processors for infrastructure hosting, content delivery, payment processing, email and support, and third-party Model providers when Customer selects their Models. QIT maintains a current list of Sub-processors, available on request at hello@qit.energy. QIT will give at least 30 days’ notice of new Sub-processors; Customer may object on reasonable data protection grounds, and if the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period. QIT imposes data protection obligations on each Sub-processor no less protective than this DPA and remains liable for their performance.
6. International transfers
Where Customer Personal Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two, or Module Three where Customer is a processor) are incorporated by reference, together with the UK International Data Transfer Addendum and the Swiss amendments where applicable. Annex information is set out in Sections 2 and 7 of this DPA. Customers may select EU or US residency for compute workloads.
7. Security measures
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
- Logical tenant isolation and least-privilege, role-based access with MFA for all personnel access to production.
- Logging and monitoring of access to production systems, with alerting on anomalous activity.
- Physical security for QIT Pods: restricted access, surveillance and environmental controls.
- Vulnerability management, regular patching and third-party penetration testing.
- Business continuity and backup procedures for account and configuration data.
Further detail is available on our Security page.
8. Personal Data Breaches
QIT will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe the breach, likely consequences and measures taken or proposed, and QIT will provide updates as information becomes available.
9. Return and deletion
On termination of the Agreement, QIT will delete Customer Personal Data within 30 days, unless retention is required by law. Customer may export its data before termination through the Services. Generated outputs are deleted on the schedule described in the Privacy Policy; with Zero Data Retention enabled, request content is not stored after the response is delivered.
10. Audits
QIT will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party security assessments. Where this is insufficient or required by a regulator, Customer may conduct an audit once per year on 30 days’ notice, during business hours, at its own cost and subject to confidentiality.
11. CCPA
To the extent QIT processes personal information subject to the CCPA, QIT acts as a service provider, will not retain, use or disclose it for any purpose other than providing the Services, will not combine it with personal information from other sources except as permitted, and will notify Customer if it can no longer meet its obligations.
12. Execution
This DPA is effective automatically when the Agreement is accepted. Customers who need a countersigned copy can request one at hello@qit.energy.