Data Processing Agreement — QanTech Platform

I. Scope

This Data Processing Agreement forms part of the Terms of Service between QanTech ("QanTech") and the Customer. It applies whenever QanTech processes personal data contained in Customer data on the Customer's behalf. Accepting the Terms puts this agreement in force without a separate signature. A counter-signed copy is available on request.

II. Roles

The Customer is the controller of the personal data in its case content, documents, messages, notes, tasks and AI inputs. QanTech is the processor of that data. QanTech acts as an independent controller only for the data it needs for account administration, security, usage tracking, billing and legal compliance.

III. Details of processing

• Subject matter: provision of the QanTech Platform.
• Duration: the term of the account, until Customer data is deleted under Section XII.
• Nature and purpose: storage, retrieval, organisation, and AI-assisted analysis of Customer data, solely to provide the service.
• Data subjects: the Customer's users, and the clients, counterparties, witnesses and other persons named in the Customer's case materials.
• Categories of data: identity and contact data, professional data, and any data contained in case materials, which may include sensitive data such as health, financial or criminal-record information.

IV. Instructions

QanTech processes Customer personal data only on the Customer's documented instructions, which are these Terms and the Customer's use of the Platform's features. QanTech will inform the Customer if it considers an instruction to be unlawful.

V. Confidentiality

Anyone authorised by QanTech to access Customer personal data is bound by an obligation of confidentiality. Access is limited to what is needed to operate, secure and support the service.

QanTech does not share, sell or disclose any information about the Customer or its lawyers, including their names, the firm's name, or the fact that they use the Platform. QanTech does not display their logos or name them in any case study, testimonial or other reference without the Customer's prior written consent.

The same applies to all Customer data, including case content, documents, messages, notes, and AI inputs and outputs.

The only exceptions are service providers that process information on QanTech's behalf under obligations of confidentiality, including the sub-processors referred to in Section VII, and disclosures required by Jordanian law or by court order.

VI. Security measures

• Encryption in transit (TLS) and at rest.
• Row-level security in the database, isolating each firm and each private case.
• A private document store, reachable only through short-lived signed links generated on the server.
• Server-side authentication and authorisation checks on every request.
• Per-user rate limits on AI features.
• Secrets held server-side only; restricted and logged administrative access.

VII. Sub-processors

The Customer gives general authorisation for QanTech to engage the sub-processors listed in the Privacy Policy. QanTech imposes data protection obligations on each sub-processor that are no less protective than this agreement, and remains responsible for their performance. QanTech will notify the Customer at least 15 days before adding or replacing a sub-processor. If the Customer objects on reasonable data protection grounds and the parties cannot resolve the objection, the Customer may terminate the affected service.

VIII. International transfers

Where Customer personal data is transferred outside Jordan, QanTech does so only to the extent needed to provide the service, under contractual safeguards with the receiving provider, and in accordance with the Personal Data Protection Law No. 24 of 2023.

IX. No model training

QanTech does not use Customer data, prompts or AI outputs to train or fine-tune any AI model, and uses AI providers only under terms that prohibit them from doing so.

X. Assistance

QanTech will assist the Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting its security and data protection obligations. Requests received directly by QanTech that concern Customer data will be forwarded to the Customer.

XI. Breach notification

QanTech will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer data. The notice will describe the nature of the breach, the data and data subjects likely affected, the likely consequences, and the measures taken or proposed.

XII. Return and deletion

The Customer may request an export or the deletion of its data at any time, including after the subscription ends, when the account remains available read-only. QanTech deletes Customer data from the live systems within 30 days of a deletion request; backup copies expire within 7 days after that. QanTech will confirm deletion in writing on request.

XIII. Audit

QanTech will make available the information reasonably necessary to demonstrate compliance with this agreement, including responses to reasonable security questionnaires. Any further audit requires 30 days' written notice, is limited to once a year, and is conducted at the Customer's cost under confidentiality.

XIV. Liability

Liability under this agreement is subject to the limitations in the Terms of Service.

XV. Contact

privacy@qantech.ai