Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the TQMU Terms of Service between TQMU.com — The Quality Marketing Unit, 2102, Sunny Enclave, Sector 125, Mohali, Punjab, India ("Processor", "TQMU"), and the agency customer named in the signature block ("Controller", "Agency").

1. Definitions

"Data Protection Laws" means the EU GDPR, UK GDPR, the California Consumer Privacy Act as amended by the CPRA, other applicable US state privacy laws, India's Digital Personal Data Protection Act 2023, and any similar law that applies. "Personal Data", "Processing", "Controller", "Processor", "Sub-processor" and "Personal Data Breach" have the meanings given in those laws. "Client Data" means Personal Data the Agency adds to the TQMU dashboard about its own clients, such as client names, contact emails, website details, brand names and shared report recipients.

2. Roles and scope

The Agency is the Controller of Client Data and TQMU is its Processor. TQMU processes Client Data only to provide the service: running GEO audits, citation checks, fix verification, white-label reports, report sharing and team access. Under the CCPA, TQMU acts as a "service provider" and will not sell or share Client Data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as the law permits.

3. Details of processing

• Subject matter: hosting and processing Client Data in the TQMU dashboard.
• Duration: the term of the Agency's account plus the deletion period in section 10.
• Data subjects: the Agency's clients and their staff, and the Agency's team members.
• Data categories: names, business emails, company names, website URLs, brand terms, report content and usage logs. No special-category or sensitive data is required, and the Agency must not upload it.

4. Processor obligations

• Process Client Data only on the Agency's documented instructions, including these terms and the Agency's use of the dashboard.
• Tell the Agency if an instruction appears to break Data Protection Laws.
• Ensure everyone with access is bound by confidentiality.
• Help the Agency respond to data subject requests (access, deletion, correction, opt-out), mainly through the dashboard's export and delete tools.
• Help the Agency with security, breach notifications and data protection impact assessments where reasonably needed.

5. Security

TQMU maintains appropriate technical and organisational measures, including encryption in transit, row-level access controls so each agency only sees its own data, mandatory two-factor authentication for administrative access, least-privilege staff access, and regular review of security findings.

6. Sub-processors

The Agency authorises TQMU to use the following sub-processors: cloud hosting and database provider; AI model gateway providers used for citation checks; Paddle (payments, as Merchant of Record); and transactional email delivery. TQMU will give at least 30 days' notice of new sub-processors by email; the Agency may object on reasonable data protection grounds and, if unresolved, terminate the affected service. TQMU imposes equivalent data protection terms on each sub-processor and remains responsible for them.

7. International transfers

Client Data may be processed in India, the United States and other countries where sub-processors operate. Where EU or UK law requires, transfers rely on the European Commission's Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference.

8. Personal Data Breaches

TQMU will notify the Agency without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Client Data, with the information reasonably available to help the Agency meet its own reporting duties.

9. Audits

TQMU will make available information reasonably needed to show compliance with this DPA and will answer written security questionnaires once a year. On-site audits require 30 days' notice, are at the Agency's cost, and are limited to once every 12 months unless a breach has occurred or a regulator requires it.

10. Return and deletion

The Agency can export or delete Client Data at any time from the dashboard. Within 30 days of account closure TQMU deletes remaining Client Data, except where law requires retention, in which case it stays protected and is used for no other purpose.

11. Liability and precedence

Liability under this DPA is subject to the limitation in the Terms of Service, except where Data Protection Laws do not allow it. If this DPA conflicts with the Terms, this DPA wins for matters of data protection; the Standard Contractual Clauses win over both where they apply.

12. Governing law

This DPA follows the governing law of the Terms of Service, except that the Standard Contractual Clauses are governed by the law they specify.

Signatures