DATA PROCESSING AGREEMENT

1. DEFINITIONS

"Agreement" means this Data Processing Agreement.

"Controller" means the customer who determines the purposes and means of processing personal data.

"Processor" means QRTRAC LLC, a New Mexico limited liability company.

"Personal Data" means any information relating to an identified or identifiable natural person.

"Services" means QRTRAC's QR code generation, analytics, and related services.

"Sub-processor" means third parties engaged by QRTRAC to process Personal Data.

2. ROLES AND RESPONSIBILITIES

2.1 Controller Responsibilities

• Data Accuracy: Controller warrants that all Personal Data is accurate and lawfully obtained
• Legal Basis: Controller ensures lawful basis for processing under applicable laws
• Data Subject Rights: Controller handles data subject requests and rights
• Content Compliance: Controller responsible for all content, links, and QR code destinations
• Legal Compliance: Controller ensures compliance with all applicable laws and regulations

2.2 Processor Responsibilities

• Processing Instructions: Process Personal Data only as instructed by Controller
• Security Measures: Implement appropriate technical and organizational measures
• Confidentiality: Maintain confidentiality of Personal Data
• Assistance: Provide reasonable assistance to Controller for compliance

3. DATA PROCESSING DETAILS

3.1 Categories of Personal Data

• Account Information: Name, email address, billing information
• Usage Data: QR code scans, analytics, website interactions
• Technical Data: IP addresses, device information, location data
• Content Data: QR code content, destination URLs, metadata

3.2 Processing Purposes

• Service Delivery: QR code generation and management
• Analytics: Usage statistics and performance metrics
• Support: Customer service and technical assistance
• Billing: Payment processing and account management
• Security: Fraud prevention and system protection

3.3 Data Subjects

• End Users: Individuals who scan QR codes
• Controller Personnel: Controller's employees and authorized users
• Third Parties: Individuals whose data is included in QR code content

4. SECURITY MEASURES

4.1 Technical Safeguards

• Encryption: Data encrypted in transit and at rest
• Access Controls: Role-based access with authentication
• Monitoring: Security monitoring and incident detection
• Backups: Regular backups with encryption
• Updates: Regular security updates and patches

4.2 Organizational Measures

• Staff Training: Privacy and security training for personnel
• Confidentiality: Confidentiality agreements for all staff
• Access Logging: Audit logs for data access
• Incident Response: Data breach response procedures

5. SUB-PROCESSORS

5.1 Authorized Sub-processors

QRTRAC may engage the following Sub-processors:

• Firebase (Google): Cloud infrastructure and analytics
• Stripe: Payment processing
• SendGrid: Email services
• Cloudflare: CDN and security services

5.2 Sub-processor Requirements

• Data Protection: Sub-processors must provide adequate data protection
• Contractual Obligations: Written agreements with Sub-processors
• Notification: Controller notified of new Sub-processors 30 days in advance
• Objection Rights: Controller may object to new Sub-processors within 15 days
• DPA Requirements: Sub-processors bound by equivalent DPA terms
• Audit Rights: Controller may audit Sub-processors through QRTRAC
• Termination: QRTRAC may terminate Sub-processors for non-compliance

5.3 Sub-processor Management

• Current List: QRTRAC maintains current list of Sub-processors
• Updates: Controller notified of Sub-processor changes
• Geographic Restrictions: Sub-processors limited to adequate countries
• Data Minimization: Sub-processors receive only necessary data
• Security Standards: Sub-processors meet QRTRAC security standards
• Incident Reporting: Sub-processors report security incidents to QRTRAC

6. DATA SUBJECT RIGHTS

6.1 Controller Obligations

• Primary Responsibility: Controller handles all data subject requests
• Response Time: Controller responds within required timeframes
• Verification: Controller verifies data subject identity
• Documentation: Controller maintains records of requests

6.2 Processor Assistance

• Response Time: QRTRAC responds to data subject requests within 30 days
• Technical Support: QRTRAC provides technical assistance when requested
• Data Access: QRTRAC provides access to relevant data in standard format
• Deletion Support: QRTRAC assists with data deletion requests and confirms deletion
• Portability: QRTRAC assists with data portability requests in machine-readable format
• Verification: QRTRAC verifies Controller's identity before processing requests
• Documentation: QRTRAC maintains logs of all data subject requests

6.3 Data Subject Request Procedures

• Request Submission: All requests submitted through Controller's designated process
• Identity Verification: Controller verifies data subject identity before forwarding
• Processing Timeline: 30 days for standard requests, 60 days for complex requests
• Extension Notice: QRTRAC notifies Controller of any processing extensions
• Fee Structure: No fees for standard requests; reasonable fees for excessive requests
• Response Format: Responses provided in clear, plain language
• Appeal Process: Data subjects may appeal decisions through Controller

7. DATA BREACH NOTIFICATION

7.1 Processor Obligations

• Immediate Notification: QRTRAC notifies Controller within 24 hours
• Detailed Information: Breach details, impact assessment, remediation steps
• Ongoing Updates: Regular updates on breach investigation
• Cooperation: Full cooperation with Controller's response

7.2 Controller Obligations

• Regulatory Notification: Controller handles regulatory notifications
• Data Subject Notification: Controller notifies affected individuals
• Documentation: Controller maintains breach documentation
• Remediation: Controller implements necessary remediation

8. INTERNATIONAL DATA TRANSFERS

8.1 Transfer Safeguards

• Standard Contractual Clauses: EU SCCs for international transfers
• Adequacy Decisions: Transfers to adequate countries
• Binding Corporate Rules: Internal transfer mechanisms
• Technical Safeguards: Encryption and access controls

8.2 Transfer Documentation

• SCC Records: Documentation of Standard Contractual Clauses
• Transfer Impact Assessments: Risk assessments for transfers
• Safeguard Implementation: Evidence of safeguard implementation
• Regular Reviews: Annual review of transfer mechanisms

9. DATA RETENTION AND DELETION

9.1 Retention Periods

• Account Data: Retained while account is active
• Analytics Data: Retained for 24 months
• Support Data: Retained for 3 years
• Billing Data: Retained for 7 years (tax requirements)

9.2 Deletion Procedures

• Automatic Deletion: Data deleted after retention periods
• Manual Deletion: Data deleted upon Controller request
• Secure Deletion: Data permanently deleted from all systems
• Deletion Confirmation: Written confirmation of deletion

10. LIABILITY AND INDEMNIFICATION

10.3 Indemnification

• Controller Indemnification: Controller indemnifies QRTRAC for Controller's violations
• QRTRAC Indemnification: QRTRAC indemnifies Controller for QRTRAC's violations
• Defense Costs: Indemnifying party covers reasonable defense costs
• Cooperation: Both parties cooperate in defense of claims
• Limitations: Indemnification limited to actual damages, not punitive

11. TERMINATION

11.1 Termination Rights

• Breach: Either party may terminate for material breach
• Convenience: Controller may terminate with 30 days notice
• Insolvency: Automatic termination upon insolvency
• Regulatory: Termination required by law or regulation

11.2 Post-Termination Obligations

• Data Return: QRTRAC returns all Personal Data to Controller
• Data Deletion: QRTRAC deletes all copies of Personal Data
• Confirmation: Written confirmation of data return/deletion
• Ongoing Obligations: Confidentiality obligations survive termination

12. GENERAL PROVISIONS

12.1 Governing Law

This Agreement is governed by New Mexico law, without regard to conflict of law principles.

12.2 Dispute Resolution

Any disputes shall be resolved through binding arbitration in New Mexico.

12.3 Severability

If any provision is invalid, the remaining provisions remain in effect.

12.4 Entire Agreement

This Agreement constitutes the entire agreement between the parties.

12.5 Amendments

Amendments must be in writing and signed by both parties.

13. AUDIT RIGHTS

13.1 Controller Audit Rights

• Annual Audits: Controller may conduct annual compliance audits with 30 days notice
• Documentation Access: Access to security documentation, logs, and compliance records
• Third-Party Audits: Right to engage independent auditors at Controller's expense
• Scope: Audits limited to data processing activities and security measures
• Confidentiality: Audit results remain confidential between parties

13.2 Audit Procedures

• Notice Period: 30 days advance notice for scheduled audits
• Duration: Audits limited to 5 business days
• Access: QRTRAC provides reasonable access to systems and personnel
• Documentation: QRTRAC maintains audit logs and compliance documentation
• Remediation: QRTRAC addresses identified issues within 60 days

14. DATA PROTECTION IMPACT ASSESSMENT

14.1 DPIA Requirements

• High-Risk Processing: Controller shall conduct DPIA for high-risk processing activities
• QRTRAC Assistance: QRTRAC provides technical information for DPIA
• DPIA Sharing: Controller shares DPIA results with QRTRAC when relevant
• Mitigation: Joint implementation of DPIA recommendations
• Review: Annual review of DPIA for ongoing high-risk processing

14.2 High-Risk Processing Indicators

• Large Scale: Processing of personal data on a large scale
• Sensitive Data: Processing of special categories of personal data
• Systematic Monitoring: Systematic monitoring of data subjects
• Automated Decision Making: Automated decision-making with legal effects

15. RECORD OF PROCESSING ACTIVITIES

15.1 QRTRAC Records

• Processing Records: QRTRAC maintains detailed records of processing activities
• Data Categories: Records include categories of personal data processed
• Recipients: Records of data recipients and transfers
• Retention Periods: Documentation of data retention periods and deletion
• Security Measures: Records of technical and organizational measures

15.2 Record Maintenance

• Updates: Records updated within 30 days of changes
• Retention: Records retained for 3 years after processing ends
• Access: Records available to supervisory authorities upon request
• Accuracy: QRTRAC ensures records are accurate and current

16. CONTACT INFORMATION