DPA
Effective Date: June, 4th 2024
Last Updated: September 1st, 2024
This Data Processing Agreement (DPA) forms part of the Terms of Use and the Privacy Policy available on the website of Qdex Ai Ltd (”we,” “us,” “our”). It governs the processing of personal data carried out by Qdex Ai Ltd on behalf of its Users in compliance with the UK General Data Protection Regulation (GDPR), Data Protection Act 2018, and other applicable laws.
By using Qdex Ai Ltd’s platform, you (”User”) agree to the terms of this DPA.
1. Definitions
• Personal Data: Any information about an identified or identifiable natural person.
• Data Subject: The individual to whom the Personal Data relates.
• Processing: Any operation performed on Personal Data, such as collection, storage, use, and sharing.
• Controller: The party determining the purposes and means of processing Personal Data. In this DPA, Users are the Controllers.
• Processor: The party that processes Personal Data on behalf of the Controller. In this DPA, Qdex Ai Ltd is the Processor.
• Supervisory Authority: The independent public authority responsible for monitoring compliance with GDPR (e.g., the UK’s Information Commissioner’s Office (ICO)).
2. Roles and Responsibilities
1. User as Controller: The User acts as the Data Controller and determines the purposes and means of processing the Personal Data of their clients (Data Subjects). The User is responsible for ensuring that the processing of Personal Data complies with applicable laws, including obtaining necessary consents and conducting any required KYC processes.
2. Qdex Ai Ltd as Processor: Qdex Ai Ltd acts as the Data Processor, processing Personal Data on behalf of the User. Qdex Ai Ltd will only process Personal Data per the User’s instructions and this DPA.
3. Scope of Processing
1. Purpose: Qdex Ai Ltd processes Personal Data solely to provide its platform to Users, enabling them to service their clients (Data Subjects) and fulfil their obligations under applicable law, including KYC and other regulatory requirements.
2. Types of Data: Personal Data processed by Qdex Ai Ltd may include, but is not limited to, names, addresses, email addresses, financial details, and other relevant information collected by Users during their business.
3. Sensitive Data: Qdex Ai Ltd may process sensitive Personal Data passed by Users (such as mortgage brokers and financial advisors) to allow Qdex Ai Ltd to perform its duties. This includes data that may relate to financial status, identity, and other sensitive categories necessary for providing mortgage and financial services. However, Qdex Ai Ltd acts solely as a Data Processor, and the User retains complete control over the purpose and means of processing such data, acting on behalf of the clients.
4. Duration of Processing: Qdex Ai Ltd will process Personal Data for as long as the User maintains an account with Qdex Ai Ltd or as necessary to provide the services unless instructed otherwise by the User or required by law.
4. Data Subject Rights
Qdex Ai Ltd will assist the User, to the extent possible, in fulfilling Data Subject requests to exercise their rights under applicable data protection laws, including:
• Right of access
• Right to rectification
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to data portability
• Right to object to processing
The User is responsible for responding to these requests per GDPR and other applicable regulations.
5. Security Measures
Qdex Ai Ltd implements appropriate technical and organisational measures to ensure the security and confidentiality of Personal Data. These include, but are not limited to:
• Encryption of Personal Data in transit and at rest
• Access controls to limit access to Personal Data
• Regular security audits and monitoring
• Procedures to respond to and manage Personal Data breaches
Qdex Ai Ltd will notify the User without undue delay if it becomes aware of a breach of Personal Data.
6. Sub-processors
Qdex Ai Ltd may engage subprocessors to assist in providing its services. Qdex Ai Ltd will ensure that any subprocessor agrees to comply with the same data protection obligations set out in this DPA. A current list of subprocessors will be provided upon request.
The User may object to appointing a sub-processor on reasonable grounds relating to data protection by notifying Qdex Ai Ltd in writing.
7. Data Transfers
Qdex Ai Ltd processes Personal Data within the UK and may transfer It outside the UK, including to countries that do not provide an adequate level of data protection. In such cases, Qdex Ai Ltd will ensure that appropriate safeguards, such as standard contractual clauses, are in place to protect the Personal Data.
8. Audits and Inspections
Qdex Ai Ltd will provide the User with all information necessary to demonstrate compliance with this DPA. At its own expense, the User may conduct audits or inspections of Qdex Ai Ltd’s processing activities upon reasonable notice and during regular business hours.
9. Termination
Upon termination of the User’s account, Qdex Ai Ltd will, at the User’s request, delete or return all Personal Data held on behalf of the User unless otherwise required by law to retain it.
10. Entire Agreement
This DPA is linked to and should be read in conjunction with the Privacy Policy and the Terms of Use available on the Qdex Ai Ltd website. Together, these documents govern the use, collection, and processing of Personal Data.