Data Processing Addendum

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person that you upload to or collect through the platform.
• "Processing" means any operation performed on Personal Data, including collection, storage, analysis, classification and deletion.
• "Sub-processor" means a third-party service provider we engage to process Personal Data on your behalf.
• "Data Subject" means the individual whose Personal Data is processed.

2. Scope of Processing

We process Personal Data only as necessary to provide the StatQuestions platform services you have contracted for. This includes:

• Ingesting and storing customer feedback data you upload (emails, tickets, survey responses, call recordings)
• Classifying, tagging and analyzing feedback using natural-language processing and statistical methods
• Generating aggregated reports, dashboards and trend analysis
• Transcribing and analyzing voice recordings when you use the voice analysis feature
• Sending notifications and scheduled reports to addresses you configure

We do not sell Personal Data. We do not use the contents of your feedback data for advertising, and we do not train AI models on your data.

3. Controller Responsibilities

As the data controller, you are responsible for:

• Obtaining any necessary consents or legal bases for collecting and sharing Personal Data with us
• Ensuring the data you upload does not include data you are not authorized to process
• Responding to Data Subject requests (access, correction, deletion) where they relate to your customer relationships
• Notifying your Data Subjects about your use of StatQuestions as a processor, as required by applicable law

4. Security Measures

We maintain appropriate technical and organizational measures to protect Personal Data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security on our database, scoping every query to your organization
• Role-based access controls and audit logging
• Automated PCI and SSN pattern redaction before data is stored
• Infrastructure hosted by Supabase (AWS us-east-1) with SOC 2 Type II certification
• Regular security reviews and dependency updates

For full details, see our Security page.

5. Sub-processors

We use the following sub-processors to deliver the platform. Each processes data only as needed for its stated purpose:

We will notify you before adding a new sub-processor that handles Personal Data. If you object, you may terminate the affected service within 30 days.

6. Data Subject Rights

We will assist you in responding to Data Subject requests to the extent our platform allows. This includes:

• Access: exporting the data associated with a specific individual on your request
• Correction: updating records you identify as inaccurate
• Deletion: removing specific records or an entire account's data on your instruction
• Portability: providing your data in a standard machine-readable format (CSV, JSON)

If a Data Subject contacts us directly, we will refer them to you unless legally required to respond.

7. Breach Notification

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, we will:

• Notify you without undue delay and in any event within 72 hours of becoming aware
• Provide a description of the nature of the breach, the categories and approximate number of records affected, and the measures taken or proposed to address it
• Cooperate with you and any supervisory authority in investigating and remediating the breach

8. Data Retention and Deletion

We retain your data for the duration of your subscription. Upon termination or cancellation:

• You have 30 days to export your data through the platform's export features
• After the 30-day window, we delete all Personal Data from our active systems
• Backup copies are purged within 90 days of deletion from active systems
• You may request immediate deletion at any time by emailing privacy@statquestions.com

9. International Transfers

All data is processed and stored in the United States. Where your Data Subjects are located in the European Economic Area, the United Kingdom or Canada, we rely on the Standard Contractual Clauses (EU 2021/914) as the transfer mechanism. If you need a signed copy of the SCCs, email privacy@statquestions.com.

10. Term and Governing Law

This DPA remains in effect for as long as we process Personal Data on your behalf. It is governed by the laws of the State of Florida, USA, consistent with the main service agreement. In the event of a conflict between this DPA and the main agreement, this DPA prevails with respect to data protection matters.