Data processing terms

These terms apply when [Quantod Pty Ltd] (ABN [ABN]) (“Quantod”, “we”) processes personal information in an organization’s Cue-Queue workspace on that organization’s behalf (“you”). They form part of the terms of service. Where they conflict, these terms win for personal information. An Enterprise agreement may replace them.

1. Roles

You decide why and how personal information in your workspace is processed. We process it only to provide Cue-Queue to you. Under the GDPR and UK GDPR you are the controller and we are your processor. Under the Australian Privacy Act 1988 you remain responsible for the personal information you collect and put into Cue-Queue.

2. What is processed

• Subject matter: providing Cue-Queue, the hosted workspace for your people and their AI assistants.
• Duration: for as long as your organization uses Cue-Queue, then as in section 9.
• Nature and purpose: storing, organizing, searching, retrieving, transmitting and deleting data as you and your members instruct through the service.
• Types of personal information: whatever you and your members put into the workspace, plus members’ account details (name, email, role).
• People concerned: your members, and anyone whose personal information you put into the workspace, such as your customers, candidates or contacts.

You must not put special categories of personal information (such as health information) into Cue-Queue unless you have agreed this with us in writing.

3. Your instructions

We process personal information only on your documented instructions. Your use of the service, the settings you choose, and these terms are your instructions. If we believe an instruction breaks the law, we will tell you. If the law requires us to process data in any other way, we will tell you first, unless the law forbids it.

4. Confidentiality

Everyone at Quantod who can reach your data is bound to keep it confidential and reaches it only as section 3 allows. Cue-Queue has no console for browsing customer content. People who run the service reach the database only to answer your request, to keep the service secure and working, or when the law requires it.

5. Security

We maintain the measures in the annex, and may improve them but will not weaken them materially.

6. Subprocessors

You authorize the subprocessors listed on the subprocessors page. We will announce a new one there at least 30 days before it processes your data. If you object on reasonable data-protection grounds and we cannot resolve the objection, you may end the affected service and receive a refund of prepaid fees for the period after it ends. Each subprocessor is bound by data protection obligations no less protective than these. We remain responsible for them.

7. Helping you

Taking into account what the service is, we will help you answer requests from people exercising their rights, and with security, breach notifications, impact assessments and consultations with regulators. Most of this you can do yourself in the product: find, export, correct and delete content. If a person contacts us directly about data in your workspace, we will pass the request to you rather than answer it ourselves.

8. Breaches

If we become aware of a breach of security that leads to accidental or unlawful destruction, loss, alteration, disclosure of, or access to your personal information, we will tell you without undue delay, and in any case within 72 hours. We will give you what we know and keep you updated, so that you can meet your own obligations, including under the Notifiable Data Breaches scheme and the GDPR.

9. Return and deletion

You can export your content at any time, in ordinary files. When your organization is deleted, its content is kept for 30 days so the deletion can be undone, and then removed. Removed data can stay in our backups for up to 7 more days until they expire. The exception is where the law requires us to keep it.

10. Audits

We will give you the information reasonably needed to show that we meet these terms, including answers to security questionnaires, once a year or after a breach. Where the law gives you a right to audit beyond that, it is at your cost, on reasonable notice, and under confidentiality.

11. Transfers

Your workspace content is stored in Australia. Account details are also held by WorkOS in the United States. Where the GDPR or UK GDPR applies to a transfer, the European Commission’s standard contractual clauses (module 2, controller to processor) and the UK addendum to them apply, and are incorporated into these terms by reference. [Details of the SCC options to be completed on legal review.]

12. Liability

Liability under these terms is subject to the limits in the terms of service.

Annex: security measures

• Isolation. Each organization’s data is confined to it by the database’s row-level security, not only by application code. Every request is limited to one organization.
• Access control. Inside an organization, an ordered list of access rules that owners and admins manage decides what each member and assistant can reach. Assistants act as their person and never with more access.
• Authentication. Sign-in by a dedicated identity provider, with single sign-on available. We never store passwords. Connected assistants are listed on each person’s account and can be signed out.
• Temporary access. Access issued for a single job is limited to one folder and to named actions, lasts 12 hours at most, and can be revoked.
• Encryption. TLS in transit, and encryption at rest by the hosting provider.
• Resilience. Managed database with daily backups kept 7 days. Bounded resource limits on every request.
• Staff access. No administrator console or superuser account for browsing content. Database access is restricted to the people who run the service.