Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms part of the agreement between CLIQR Inc. (“Processor”) and the Customer (“Controller”) who purchases or uses CLIQR Services that involve processing personal data subject to the GDPR, UK GDPR, or comparable laws (collectively, “Applicable Privacy Laws”).

This DPA applies where CLIQR processes personal data on behalf of the Controller in the course of providing the Services.

• Terms such as “personal data,” “processing,” “controller,” and “processor” have the meanings given in Applicable Privacy Laws.
• “Subprocessor” means third parties engaged by CLIQR to process personal data on behalf of the Controller.

CLIQR will process personal data only on documented instructions from the Controller — including those reflected in the Terms of Service, product functionality configured by the Controller, and documented support requests — unless otherwise required by law. CLIQR will inform the Controller if an instruction infringes Applicable Privacy Laws, where permitted.

CLIQR ensures that persons authorized to process personal data are bound by appropriate confidentiality obligations.

CLIQR implements technical and organizational measures appropriate to the risk, including access controls, encryption in transit where applicable, logging and monitoring, vulnerability management, and business continuity practices. Details are summarized on CLIQR’s Security page and may be expanded under confidentiality as needed for enterprise customers.

The Controller authorizes CLIQR to engage Subprocessors listed on CLIQR’s trust documentation or notified through the Services. CLIQR will impose data protection terms on Subprocessors that are materially no less protective than this DPA. CLIQR remains responsible for Subprocessor performance.

CLIQR will assist the Controller, taking into account the nature of processing, by appropriate technical and organizational measures to fulfill requests from data subjects exercising rights under Applicable Privacy Laws, to the extent CLIQR is reasonably able.

CLIQR will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data, and will provide information reasonably necessary for the Controller to meet regulatory obligations, consistent with known facts.

Upon termination of Services (subject to backup and legal retention requirements), CLIQR will delete or return personal data at the Controller’s choice, unless retention is required by law.

CLIQR will make available information reasonably necessary to demonstrate compliance and allow for audits mandated by Applicable Privacy Laws, including by providing summaries of controls or questionnaires, or allowing audits subject to reasonable scheduling, confidentiality, and scope limitations.

Where personal data originating in the EU, UK, or other restricted regions is processed in countries without an adequacy decision, CLIQR will implement appropriate safeguards such as Standard Contractual Clauses or other lawful mechanisms.

Privacy and DPA inquiries: privacy@cliqr.app.