Qmo Data Processing Addendum

Effective date: [TBD] · Map2Close Inc. · legal@map2close.com
This Data Processing Addendum (including its annexes, this "DPA") forms part of the Qmo Terms of Service or other written agreement for Qmo (the "Agreement") between Map2Close Inc. ("Provider") and the customer that is party to the Agreement ("Customer"). It takes effect when Customer accepts the Agreement, without separate signature. Customer may request a countersigned copy at legal@map2close.com.
Section 10 sets out how Customer instructs Provider to use Personal Data for Workspace Learning and to create de-identified Network Insights. It replaces the general prohibition on AI training found in many processing agreements.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

• "Affiliate" means an entity that directly or indirectly controls, is controlled by, or is under common control with a party.
• "Applicable Data Protection Laws" means the privacy, data protection and data security laws applicable to Provider's Processing of Personal Data under the Agreement, including, as applicable, PIPEDA and substantially similar Canadian provincial laws (including Quebec's Act respecting the protection of personal information in the private sector), the GDPR, the FADP, the State Privacy Laws, and the privacy laws of Australia, New Zealand, Singapore and other countries where Customer uses the Services.
• "Controller" means the entity that, alone or jointly with others, determines the purposes and means of Processing Personal Data, including a "business" or "controller" under the State Privacy Laws.
• "Customer Data" has the meaning given in the Agreement.
• "Data Subject" means the identified or identifiable individual to whom Personal Data relates, including Authorized Users and Call Participants.
• "De-identified Data" means data that has been processed under Section 10.2 so that it no longer relates to an identified or reasonably identifiable individual, and that is not Personal Data under Applicable Data Protection Laws.
• "EEA" means the European Economic Area.
• "FADP" means the Swiss Federal Act on Data Protection of 25 September 2020, as amended.
• "GDPR" means, as applicable, Regulation (EU) 2016/679 (the "EU GDPR") and the EU GDPR as it forms part of UK law (the "UK GDPR"), with the UK Data Protection Act 2018 and any national implementing legislation.
• "Information Security Incident" means a breach of Provider's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in Provider's possession or control. It does not include unsuccessful attempts that do not compromise the security of Personal Data, such as failed log-ins, pings, port scans or blocked network attacks.
• "Personal Data" means Customer Data that is "personal data", "personal information" or similar under Applicable Data Protection Laws. It does not include information about Customer's own account administrators and billing contacts that Provider processes as a Controller to manage the customer relationship, which is governed by Provider's Privacy Policy.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, combination, restriction, erasure or destruction.
• "Processor" means an entity that Processes Personal Data on behalf of a Controller, including a "service provider" or "contractor" under the State Privacy Laws.
• "Restricted Transfer" means a transfer of Personal Data from the EEA, the UK or Switzerland to a country that does not benefit from an adequacy decision under the relevant law, where the transfer would be prohibited without a legal basis under Chapter V of the GDPR or the FADP.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
• "State Privacy Laws" means the comprehensive U.S. state privacy laws and regulations applicable to Provider's Processing of Personal Data, including the California Consumer Privacy Act as amended (the "CCPA").
• "Subprocessor" means an Affiliate of Provider or third party that Provider engages to Process Personal Data in connection with the Services.
• "Supervisory Authority" means a regulator with authority to enforce Applicable Data Protection Laws.
• "UK Transfer Addendum" means the International Data Transfer Addendum B.1.0 issued by the UK Information Commissioner's Office, as revised under its Mandatory Clauses.

2. Duration and scope

2.1 This DPA remains in effect for as long as Provider Processes Personal Data, even after the Agreement ends.

2.2 Annex 2 (European Annex) applies to Processing subject to the GDPR or the FADP. Annex 3 (State Privacy Laws Annex) applies to Processing subject to the State Privacy Laws. Annex 6 (Canada Annex) applies to Processing subject to Canadian privacy laws.

3. Roles and Customer instructions

3.1 Roles. For Personal Data in Customer Data, Customer is the Controller (or a Processor acting for its own customers) and Provider is a Processor, except as stated in Section 10.3 for the creation of Network Insights.

3.2 Instructions. Provider will Process Personal Data only on Customer's documented instructions, which are: (a) to provide, secure, support and improve the Services under the Agreement, including Workspace Learning; (b) to de-identify Personal Data as described in Section 10; (c) to follow instructions Customer gives through its configuration and use of the Services; and (d) any other written instructions consistent with the Agreement. Instructions outside the scope of the Services require a written amendment. Provider will inform Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Laws.

3.3 Details. The details of the Processing are set out in Annex 1.

4. Security

4.1 Security Measures. Provider will implement and maintain the technical and organizational measures in Annex 4 (the "Security Measures"), taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of the Processing and the risks to Data Subjects. Provider may update the Security Measures, provided that updates do not materially decrease the overall protection of Personal Data.

4.2 Personnel. Provider will ensure that its personnel authorized to Process Personal Data are bound by appropriate confidentiality obligations.

4.3 Information Security Incidents. Provider will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of an Information Security Incident. The notice will describe, to the extent then known, the nature of the incident, the categories and approximate volume of Personal Data affected, the likely consequences, and the steps taken and recommended to mitigate it. Provider will reasonably cooperate with Customer's investigation. Notification is not an acknowledgement of fault or liability. Customer is responsible for notifications that Applicable Data Protection Laws require of it, and, where legally permitted, will consult Provider in advance on any notice that refers to Provider.

5. Customer's security responsibilities

5.1 Customer is responsible for its use of the Services, including securing its account credentials, devices and Connected Accounts, configuring user roles appropriately, and maintaining its own backups where needed.

5.2 Customer has reviewed the Services and the Security Measures and determined that they provide a level of security appropriate to the risk for the Personal Data it submits.

6. Data Subject requests

6.1 Assistance. Taking into account the nature of the Processing, Provider will give Customer reasonable assistance, through features of the Services or otherwise, to respond to requests from Data Subjects to exercise their rights ("Data Subject Requests"). Where assistance requires work beyond the normal Services, Provider may charge its reasonable professional services rates, with a good-faith estimate on request.

6.2 Requests received by Provider. If Provider receives a Data Subject Request relating to Personal Data, it will promptly notify Customer, unless prohibited by law, and direct the Data Subject to Customer. Customer is responsible for responding.

6.3 Objections to Network Insights. If a Data Subject objects to the use of their Personal Data to create Network Insights, Provider will, at Customer's request or directly where Provider acts as a Controller under Section 10.3, exclude that Data Subject's Personal Data from future de-identification for Network Insights, to the extent reasonably identifiable.

7. Customer responsibilities

7.1 Notices and consents. Customer is solely responsible for providing all notices to, and obtaining all consents from, Data Subjects that Applicable Data Protection Laws and call-recording laws require for Provider to Process Personal Data as described in the Agreement and this DPA, including: (a) notice to, and where required consent from, Call Participants that calls are recorded, transcribed and analyzed using artificial intelligence; and (b) notice that Personal Data may be de-identified and used to create Network Insights, as described in the Qmo AI & Data Use Policy.

7.2 Lawful basis. Customer will ensure that it has, throughout the term of the Agreement, a valid lawful basis under Applicable Data Protection Laws (including, where applicable, Article 6 of the GDPR) for Provider's Processing of Personal Data under this DPA.

7.3 Restricted Data. Customer will not deliberately submit to the Services any government-issued identification numbers; health, medical or health insurance information; biometric information; financial account or payment card numbers; passwords or credentials for third-party accounts (other than credentials used to connect Connected Accounts through the Services' integration features); Personal Data of children under 16; or special category data under Article 9 of the GDPR or data relating to criminal convictions and offences (together, "Restricted Data"). Customer acknowledges that Restricted Data may be spoken incidentally on calls; Provider will exclude it from Network Insights using reasonable measures and delete it on Customer's request.

8. Subprocessors

8.1 Authorization. Customer gives Provider general authorization to engage Subprocessors under this Section 8, including those listed on the Qmo Sub-processor List at heyqmo.com/subprocessors (the "Subprocessor Site") on the date Customer accepts the Agreement.

8.2 Requirements. Provider will enter into a written contract with each Subprocessor containing data protection obligations no less protective than those in this DPA, to the extent applicable to the services it provides. Provider remains responsible for each Subprocessor's performance and is liable for its acts and omissions as if they were Provider's own.

8.3 No model training by Subprocessors. Provider will contractually prohibit its Subprocessors, including AI model and transcription providers, from using Personal Data to train, fine-tune or improve their own models or services, and will use available account settings to disable such use and limit their retention of Personal Data.

8.4 Changes and objections. Provider will give at least thirty (30) days' notice before engaging a new Subprocessor, by updating the Subprocessor Site and emailing Customer's account administrator. If Customer objects in writing within fifteen (15) days of the notice, on reasonable grounds relating to data protection, the parties will work in good faith to resolve the objection. If they cannot within a reasonable time, Customer may, as its sole remedy, terminate the affected Services on written notice and receive a refund of prepaid Fees for the unused portion of the term. Provider may replace a Subprocessor on shorter notice where needed for security or continuity of the Services, and will notify Customer as soon as practicable.

9. Audits

9.1 Provider will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and, where available, third-party audit reports or certifications.

9.2 Where that information is not sufficient to meet Customer's obligations under Applicable Data Protection Laws, or a Supervisory Authority requires it, Customer may audit Provider's compliance with this DPA no more than once per year, on at least thirty (30) days' written notice with a proposed audit plan. Audits will take place during business hours, under a mutually agreed plan and confidentiality terms, and without unreasonable disruption to Provider's business. Provider may object to a third-party auditor that is a competitor or not independent. Customer bears its own audit costs and will reimburse Provider's reasonable costs. Customer will share audit findings with Provider and use them only to confirm compliance.

10. Artificial intelligence, Workspace Learning and Network Insights

10.1 Workspace Learning. Customer instructs Provider to Process Personal Data to improve the Services for Customer, including by tuning cards, scripts, scoring, prompts and models used within Customer's workspace. This Processing is part of the Services.

10.2 De-identification. Customer instructs and authorizes Provider to de-identify Personal Data in Customer Data by: (a) removing or replacing names of individuals and organizations, email addresses, phone numbers, street addresses, URLs, account and deal identifiers, and deal values and other financial figures; (b) excluding Restricted Data using reasonable technical measures; (c) aggregating the results with data from other customers; and (d) applying any additional measures needed for the result to be De-identified Data under Applicable Data Protection Laws. Provider will maintain De-identified Data in de-identified form, will not attempt to re-identify it (except to test that its de-identification processes work), and will contractually prohibit any recipient from re-identifying it.

10.3 Network Insights. De-identified Data, and Network Insights derived from it, are not Personal Data and are not subject to this DPA. Provider owns them and may use them under Section 4.4 of the Agreement. To the extent any Applicable Data Protection Law treats Provider's creation of Network Insights from Personal Data as Processing for Provider's own purposes, Provider acts as an independent Controller for that Processing, relies on its legitimate interests, honours Data Subjects' right to object under Section 6.3, and describes the Processing in its Privacy Policy.

10.4 Customer opt-out. If Customer opts out of Network Insights under the Agreement, Provider will stop de-identifying Customer's Personal Data for Network Insights from the date Provider confirms the opt-out in writing. Network Insights created before that date are not affected.

10.5 No other training uses. Except as described in Sections 10.1 to 10.4, Provider will not use Personal Data to train, fine-tune or improve any artificial intelligence or machine learning model, and will not use Personal Data, or Customer Data containing it, to provide services to any other customer.

10.6 No biometrics. Provider will not use call audio to create voiceprints or other biometric identifiers.

10.7 Automated decision-making. The Services are not designed to make decisions based solely on automated processing that produce legal or similarly significant effects on Data Subjects. If Provider introduces such a feature, it will tell Customer, provide meaningful information about the logic involved (without disclosing trade secrets), and reasonably cooperate with Customer so Data Subjects can exercise their rights.

11. Return and deletion

11.1 When the Services end (the "Cessation Date"), Provider will stop Processing Personal Data except as needed to return or delete it, or as required by law.

11.2 On Customer's written request made within thirty (30) days after the Cessation Date, Provider will, as Customer chooses, either return Personal Data through the Services' export features or another reasonably secure method and then delete it, or delete it. If Customer makes no request, Provider will delete Personal Data within a commercially reasonable period after that thirty (30) day period. Copies in backups will be deleted as the backups roll off on Provider's normal schedule and will remain protected under this DPA until then.

11.3 Provider may retain Personal Data to the extent and for as long as required by law, provided it keeps it confidential, protects it under the Security Measures, and Processes it only for the purpose requiring retention.

11.4 This Section 11 does not apply to De-identified Data or Network Insights.

12. General

12.1 Except as modified by this DPA, the Agreement remains in full force. Provider's access to Personal Data is not part of the consideration exchanged under the Agreement.

12.2 Provider may give notices under this DPA by any method permitted by the Agreement or by email to Customer's account administrator.

12.3 Provider may update this DPA on written notice to the extent needed to comply with Applicable Data Protection Laws or to adopt a new transfer mechanism, provided the update does not materially reduce the protection of Personal Data or materially increase Customer's obligations without Customer's agreement.

12.4 Each party's total liability under or in connection with this DPA and any SCCs is subject to the limitations and exclusions of liability in the Agreement, including the cap for Data Protection Claims, to the extent permitted by Applicable Data Protection Laws and the SCCs. Nothing in this Section limits a Data Subject's rights under the third-party beneficiary provisions of the SCCs.

12.5 If this DPA conflicts with the Agreement, this DPA controls. If the SCCs conflict with this DPA or the Agreement, the SCCs control for the Restricted Transfer to which they apply.

Annex 1: Details of Processing

Annex 2: European Annex

1. Processing. Customer's instructions on the Processing of Personal Data will comply with the GDPR and the FADP.
2. Impact assessments. Taking into account the nature of the Processing and information available to it, Provider will give Customer reasonable assistance, at Customer's cost, with data protection impact assessments and prior consultations with Supervisory Authorities that Articles 35 and 36 of the GDPR require of Customer, solely in relation to Provider's Processing.
3. Restricted Transfers.

3.1 Transfers to Provider in Canada. The European Commission has found that Canada provides adequate protection for personal data subject to PIPEDA, and the UK and Switzerland recognize Canada as adequate on the same basis. Transfers from the EEA, UK or Switzerland to Provider in Canada therefore rely on those adequacy decisions and are not Restricted Transfers while they remain in force.

3.2 EU Restricted Transfers. Where a Restricted Transfer from the EEA to Provider occurs (including if an adequacy decision ceases to apply), the SCCs are incorporated into this DPA, deemed signed, and populated as follows: Module Two applies where Customer is a Controller and Module Three where Customer is a Processor; Clause 7 (docking clause) is not used; Clause 9 Option 2 (general written authorization) applies with the notice period in Section 8.4; the optional language in Clause 11 is not used; Clause 17 Option 1 applies with the law of Ireland; Clause 18 disputes go to the courts of Ireland; Annex I is populated with Annex 1 of this DPA, with Customer as data exporter and Provider as data importer; Annex II is populated with Annex 4 of this DPA; and the competent supervisory authority is that of the Member State where Customer is established or, if not established in the EU, where its Article 27 representative is located or, failing that, the Member State Customer notifies to Provider in writing.

3.3 UK Restricted Transfers. For Restricted Transfers from the UK, the SCCs apply as varied by the UK Transfer Addendum. Tables 1 to 3 of the UK Transfer Addendum are populated with the details in Annex 1 and paragraph 3.2 above, in Table 4 the "Data Importer" box is ticked, and the parties agree to be bound by its Mandatory Clauses.

3.4 Swiss Restricted Transfers. For Restricted Transfers from Switzerland, the SCCs apply with references to the GDPR read as the FADP, references to the EU and Member States read as Switzerland, and the supervisory authority being the Swiss Federal Data Protection and Information Commissioner. Data Subjects habitually resident in Switzerland may bring proceedings before Swiss courts.

3.5 Onward transfers. Where Provider transfers Personal Data originating from Europe to a Subprocessor in a country without an adequacy decision, Provider will put in place the SCCs (Module Three), the UK Transfer Addendum, the EU-U.S. Data Privacy Framework (where the Subprocessor is certified) or another valid transfer mechanism.

3.6 New mechanisms. Provider may, on notice, replace the SCCs with any updated version or other valid transfer mechanism that does not materially reduce the protection of Personal Data.

3.7 Operational clarifications. When meeting its transparency obligations under Clause 8.3 of the SCCs, Customer will protect Provider's trade secrets and confidential information. Certification of deletion under Clauses 8.5 and 16(d) will be provided on Customer's written request. Audits under Clause 8.9 are subject to Section 9 of this DPA. Customer's authorization of Subprocessors under Section 8 is its instruction to make onward transfers to them under Clause 8.8.

Annex 3: State Privacy Laws Annex

1. Terms such as "business", "controller", "processor", "service provider", "contractor", "sell", "share", "commercial purpose" and "deidentified" have the meanings given in the State Privacy Laws.
2. Provider is a service provider, contractor or processor, as applicable, for Personal Data. Provider: (a) acknowledges that Customer discloses personal information only for the limited and specified purposes in the Agreement and this DPA; (b) will comply with the State Privacy Laws and provide the level of privacy protection they require; (c) agrees that Customer may take reasonable steps to ensure Provider's Processing is consistent with Customer's obligations, and to stop and remediate unauthorized use; and (d) will notify Customer if it can no longer meet its obligations.
3. Provider will not: (a) sell or share personal information; (b) retain, use or disclose personal information for any purpose other than the business purposes specified in the Agreement and this DPA, or as otherwise permitted by the State Privacy Laws; (c) retain, use or disclose personal information outside the direct business relationship with Customer; or (d) combine it with personal information received from another person or collected from Provider's own interactions with the consumer, except as permitted by the State Privacy Laws.
4. The specified business purposes include using personal information to build or improve the quality of the Services, as permitted by the CCPA regulations, provided Provider does not use it to build or modify profiles for use in providing services to another business. Provider certifies that it understands and will comply with these restrictions.
5. Deidentified information derived under Section 10 of this DPA is not personal information. Provider will take reasonable measures to ensure it cannot be associated with a consumer or household, publicly commit to maintaining it in deidentified form, and contractually require any recipient to do the same.
6. Notice of Subprocessors under Section 8 satisfies any obligation under the State Privacy Laws to notify Customer of, and allow it to object to, subcontractors.

Annex 4: Security Measures

1. Governance: named personnel responsible for the information security program, and periodic risk assessment.
2. Encryption: industry-standard encryption of Personal Data in transit over public networks and at rest.
3. Logical segregation: logical separation of each customer's data within the Services.
4. Access control: role-based access on a need-to-know and least-privilege basis, unique user IDs, multi-factor authentication for Provider staff accessing production systems, and prompt removal of access when roles change.
5. Authentication: passwords for the Services stored using industry-standard hashing, with support for single sign-on through supported identity providers.
6. Logging and monitoring: logging of administrative access and system activity, with monitoring for anomalies.
7. Hosting: use of reputable cloud infrastructure providers that maintain physical and environmental security controls for their data centres, such as SOC 2 or ISO 27001 certified facilities.
8. Secure development and change management: code review, testing and approval of changes to production systems.
9. Vulnerability management: dependency and vulnerability scanning, and timely patching of identified vulnerabilities.
10. Incident response: documented procedures to investigate, contain, mitigate and notify Information Security Incidents.
11. Backup and recovery: regular backups and recovery procedures designed to restore availability after an incident.
12. Personnel: confidentiality obligations and security awareness for staff and contractors with access to Personal Data.
13. Data minimization in AI processing: de-identification before Network Insights, no training by AI Subprocessors, and limited retention of prompts and outputs by AI Subprocessors.

Annex 5: Subprocessors

The current list of Subprocessors, with their functions and locations, is published on the Subprocessor Site at heyqmo.com/subprocessors.

Annex 6: Canada Annex

1. Where Provider Processes Personal Data subject to PIPEDA or substantially similar provincial laws, Customer remains accountable for that Personal Data, and Provider Processes it only for the purposes in this DPA, as an organization to which personal information is transferred for processing.
2. For Personal Data subject to Quebec's Act respecting the protection of personal information in the private sector, Provider will: (a) take the Security Measures to protect the confidentiality of the Personal Data; (b) use the Personal Data only to carry out the Agreement and as described in Section 10; (c) not keep it after the Agreement ends, except as described in Section 11; (d) notify Customer's Privacy Officer without delay of any violation or attempted violation of the confidentiality obligations in this DPA; and (e) allow Customer to carry out verifications under Section 9.
3. Provider will notify Customer under Section 4.3 of any Information Security Incident that may constitute a "breach of security safeguards" or "confidentiality incident" under Canadian law, so Customer can assess whether it poses a real risk of significant harm or a risk of serious injury and make any required reports.

Adapted from the Data Processing Addendum (Global) template published by General Legal, PC under CC0 1.0. General Legal has not reviewed these modifications.