Effective Date: Same as the Effective Date of your Order Form under the Terms & Conditions (“T&C”).

This Data Processing Agreement (“DPA”) is incorporated by reference into, and forms part of, the Terms & Conditions available at: https://www.qualiatrading.ai/legal/termsandconditions (“Agreement”).

Together, the Agreement and this DPA govern how Qualia Technologies LTD (“Company”, “we”, “us”) processes Client Personal Data on behalf of the Client (“you”, “your”). If there is any conflict between this DPA and the main body of the Agreement regarding data processing, this DPA will take precedence.

1. Purpose and scope

This DPA sets out how we process personal data you upload or generate in the Software, in line with applicable data protection laws (including UK GDPR / EU GDPR).

2. Roles

You: Data Controller (decides what data to upload and why).

Us: Data Processor (processes data only on your documented instructions, unless otherwise required by law).

3. Our processing

We will:

• Only process data to provide and support the Software, as described in the Agreement.
• Follow your lawful instructions.
• Notify you if we think any instruction infringes applicable data protection laws.
• Help you meet your data protection obligations (e.g., data subject requests, impact assessments, breach notifications), where reasonable.

4. Subprocessors

We may use subprocessors (third-party service providers) to help provide the Software:

• Typical examples: IT hosting and system administration services; optional analytics or product communications.
• Subprocessors may be inside or outside the UK/EEA.
• We ensure subprocessors are under written obligations to protect your data to a similar standard.
• We will notify you of new or replacement subprocessors (e.g., by email or online update).

If you object on reasonable data protection grounds within 14 days, we will work together in good faith to resolve it.

5. Security

We apply technical and organisational measures appropriate to the risk, including encryption, access controls, and use of secure cloud infrastructure.

6. International transfers

If we transfer personal data outside the UK/EEA, we will ensure it’s protected by approved safeguards (e.g., UK IDTA, EU SCCs).

7. Data subject rights

We will help you respond to data subject access, correction, or deletion requests if we receive them directly.

8. Audit

On reasonable notice, you may audit our compliance (e.g., by requesting summaries of security assessments or certifications), provided it doesn’t compromise other clients’ data or our security.

9. Data deletion & return

At the end of your subscription or on termination:

• You may export your data using the Software tools or API.
• Within 60 days after termination, we may permanently delete personal data still on our systems.

10. Liability and law

Liability limits are set out in the Agreement. This DPA and any disputes under it follow the same governing law and jurisdiction as set out in the Agreement.

11. Entire agreement

This DPA and the T&C together form the entire agreement on data processing between you and us.