Data processing agreement

Version: 2026-10-draft

The French version of this agreement is the reference version. This English version is a translation provided for convenience.

Processing agreement within the meaning of article 28 of the General Data Protection Regulation (GDPR).

1. Purpose and parties

1. This agreement applies when a professional customer (the "Customer") puts personal data of other people into Quorumind Cloud, for example in a project description, interview answers or documents added to a debate.
2. For that data, the Customer is the controller and QUORUMIND, 23 rue des Frères Bonie, 33000 Bordeaux, France, SIRET 821 041 431 00023 ("Quorumind"), is the processor.
3. This agreement is part of the terms of service and sale. It is accepted with them. A signed version can be provided on request at hello@quorumind.com.
4. It does not cover the data Quorumind processes on its own behalf (user accounts, billing, security): that data falls under the privacy policy, with Quorumind as controller.
5. "Personal data", "processing", "personal data breach" and the other GDPR terms have the meaning given to them by that regulation.

2. Description of the processing

3. Customer's obligations

The Customer:

1. has a legal basis for each processing it entrusts to Quorumind and informs the data subjects;
2. limits the personal data put into the service to what is necessary, and uses the personal data masking option where useful, knowing that it masks neither names nor postal addresses;
3. chooses, for each debate, the AI models and therefore the providers that receive the content;
4. answers data subjects' requests, with Quorumind's help where needed (section 10).

4. Instructions

1. Quorumind processes the data only on the Customer's documented instructions. These instructions are: the terms, this agreement, and the Customer's actions in the service (starting a debate, choosing the models, sharing, exporting, deleting).
2. Quorumind informs the Customer immediately if an instruction seems to infringe the GDPR.
3. Quorumind does not use this data for its own purposes, and does not use it to train AI models. It may compile cost and usage statistics that do not contain debate content.
4. If the law requires Quorumind to carry out processing not covered by the instructions, it informs the Customer before doing so, unless the law forbids it.

5. Confidentiality

1. Only the publisher has access to Quorumind's systems. Any other person authorised to access them will be bound to confidentiality by contract.
2. The back-office does not show the content of debates, except those their author shared with a link. Quorumind accesses the content of a debate only with the Customer's consent, for example to look into a reported error, or if the law requires it.

6. Security

Quorumind applies the following measures (article 32 GDPR):

1. hosting in France, at OVH; access to the service over HTTPS only;
2. session cookie unreadable by scripts, HTTPS-only, protected against cross-site requests, and renewed every 15 minutes of activity;
3. sign-in links and session identifiers stored as a hash; single-use links valid for 15 minutes;
4. sign-in with Google or GitHub through OAuth 2, PKCE and "state";
5. protection against cross-site requests, rate limits, strict content security policy;
6. API keys and secrets stored separately, outside the code and the databases;
7. separation: a debate is visible only to its author; other members of the workspace only see its cost;
8. back-office access restricted to the publisher, with an audit log of actions and their reason;
9. error monitoring hosted by the publisher, without IP addresses or request bodies.

Quorumind may change these measures without lowering the level of protection.

7. Sub-processors

1. The Customer authorises Quorumind to use the following sub-processors:

2. A model provider receives the content of a debate only if one of its models is chosen for a role in that debate.
3. Stripe (payments), Google and GitHub (sign-in) do not receive debate content.
4. Umami (audience measure) and Sentry (error monitoring) are run by the publisher itself, on its servers at OVH in France; they are not third-party sub-processors.
5. Changes: Quorumind informs workspace owners by e-mail at least 30 days before adding or replacing a sub-processor. The Customer may object on data protection grounds. If no solution is found, it may terminate and get a refund of unused credits and of the unused part of the current subscription period.
6. Quorumind imposes on each sub-processor data protection obligations equivalent to those of this agreement, and remains liable to the Customer for their compliance.

8. Transfers outside the European Union

Debate content is sent to the model providers listed above, in the United States. These transfers rely on the Data Privacy Framework for certified companies, and otherwise on the European Commission's Standard Contractual Clauses (decision 2021/914). [To be confirmed for each provider.] Quorumind gives the Customer, on request, the relevant information about these safeguards.

9. Data subjects

If a data subject contacts Quorumind about the Customer's data, Quorumind forwards the request to the Customer without undue delay and does not answer it itself, unless the Customer instructs it to.

10. Assistance

Quorumind helps the Customer, as far as possible:

1. to answer data subjects' requests: the Customer can itself export its data ("Export my data" button) and delete a debate or its account;
2. to ensure the security of the processing;
3. to carry out a data protection impact assessment and, where needed, to consult the CNIL, by providing the information it has.

This assistance is free within reasonable limits.

11. Personal data breach

1. Quorumind notifies the Customer of any personal data breach affecting it without undue delay, and at the latest 72 hours after becoming aware of it, by e-mail to the owners of the workspaces concerned.
2. The notification states, as far as possible: the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, the measures taken or proposed, and a contact. Information not yet known is provided as soon as possible.
3. Quorumind takes measures without delay to limit the consequences of the breach.

12. End of the processing

1. At any time, the Customer can export its data and delete a debate or its account.
2. When a debate or the account is deleted, the debate content is deleted at once from the service's databases. Backups are erased as they rotate, within 2 years at most.
3. Data is returned through the JSON export. Quorumind keeps no copy, unless the law requires it.

13. Audits

1. Quorumind makes available to the Customer the information needed to demonstrate compliance with this agreement, and answers its security questionnaires within a reasonable time.
2. The Customer may have an audit carried out at most once a year, with 30 days' written notice, at its own cost, by an auditor bound to confidentiality who is not a competitor of Quorumind. The audit must not give access to other customers' data or disrupt the service. An additional audit is possible after a personal data breach.

14. Record

Quorumind keeps a record of the processing carried out on behalf of its customers (article 30(2) GDPR).

15. Liability and precedence

1. Each party's liability follows the terms and article 82 GDPR.
2. In case of conflict on data protection, this agreement prevails over the terms.
3. The French version is the reference version.

16. Contacts

• Quorumind: hello@quorumind.com
• Customer: the e-mail address of the workspace owners