1.1 This Data Processing Addendum (“DPA”) forms part of the agreement between you and Quantafin Lab LLC for the use of BlokDuck and our services, and applies where we process personal data on your behalf as a processor.
1.2 Because the BlokDuck software runs entirely on your own device, we do not process the personal data in the documents you redact — we never receive them. This DPA therefore covers the limited personal data we do process for you when you engage us, for example when you send us a sample document for a service or contact support.
2.1 For the personal data described in section 1.2, you are the controller and we are the processor.
2.2 For personal data we collect to run the Website, issue licence keys, take payment and provide support, we are the controller, as described in our Privacy Policy.
| Item | Detail | |
|---|---|---|
| Subject matter | Provision of services and support relating to BlokDuck. | |
| Duration | For the term of the relevant service or engagement, then as set out in section 6. | |
| Nature and purpose | Receiving and answering correspondence; performing a service you request; managing your account, plan and licence keys. | |
| Categories of data | Business contact details; the content of messages and any documents you choose to send us; account, plan and billing references. | |
| Categories of data subjects | Your personnel and other individuals whose data appears in information you send us. |
4.1 We will process personal data only on your documented instructions, including as set out in this DPA, unless the law requires otherwise (in which case we will tell you unless the law forbids it).
4.2 We will ensure that people authorised to process the data are bound by confidentiality.
4.3 We will implement appropriate technical and organisational measures to protect the data, as described in our Security page.
4.4 We will assist you, taking into account the nature of the processing, in responding to data-subject rights requests and in meeting your obligations regarding security, breach notification and impact assessments.
4.5 We will notify you without undue delay after becoming aware of a personal-data breach affecting data we process for you.
5.1 You authorise us to engage the subprocessors below. We impose data-protection obligations on them at least as protective as this DPA. The categories currently used are:
| Category | Purpose | Location | |
|---|---|---|---|
| Payment processor | Process payments and billing (Stripe). | United States / global | |
| Website host | Serve the Website and its logs. | United States | |
| Email provider | Send and receive support and transactional email. | United States / Canada | |
| Analytics provider | Aggregate, de-identified Website usage measurement. | United States |
5.2 A current list of named subprocessors is available on request at [email protected]. We will give you at least 30 days’ notice before adding a new subprocessor so you can object; if you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected service.
On termination of the relevant service, or on your request, we will delete or return the personal data we process for you, except where the law requires us to keep it (for example, tax and accounting records, as described in our Privacy Policy).
Where we transfer personal data from the EU, the UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or a provider’s certification under the applicable Data Privacy Framework.
We will make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits or inspections you reasonably request, subject to confidentiality and not more than once a year unless required by a regulator or following a breach.
Each party’s liability under this DPA is subject to the limitations and exclusions in the agreement it forms part of, including the EULA.
This DPA applies to the services we provide for you. Enterprise customers who need a countersigned copy can email [email protected] with the subject “DPA” and we will arrange execution.
Quantafin Lab LLC
2025 Briarcliff Road, Lewisville, Texas 75067, U.S.A.
Email: [email protected]