Data Processing Agreement

Template · Version 1.0.0 · Published and effective as a template: September 24, 2026

This is a template. It becomes binding only when SwiftQuantum and a customer sign it, or accept it in an order form or other written agreement that refers to this version. To execute it, contact legal@swiftquantum.tech with your organization's legal name, address, and the products you use. We will return a counterpart with Annex I completed for your use.

This Data Processing Agreement ("DPA") forms part of the agreement under which SwiftQuantum Technologies, LLC ("SwiftQuantum") provides its services to the Customer (the "Main Agreement"), such as the Terms of Service together with an order form, invoice, or enterprise agreement. It is written to meet Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, and Article 26 of the Korean Personal Information Protection Act ("PIPA").

1. Definitions

Terms such as "controller", "processor", "personal data", "processing", "data subject", "personal data breach", and "supervisory authority" have the meanings given in the GDPR. "Data Protection Law" means the GDPR, the UK GDPR and the UK Data Protection Act 2018, PIPA, and any other data protection law that applies to the processing under this DPA. "Customer Personal Data" means personal data that SwiftQuantum processes on the Customer's behalf in providing the Services. "Subprocessor" means a third party that SwiftQuantum engages to process Customer Personal Data. "Services" means the SwiftQuantum products the Customer uses under the Main Agreement.

2. Roles and Scope

2.1 For Customer Personal Data, the Customer is the controller (or, where the Customer itself processes the data for another controller, a processor), and SwiftQuantum is the Customer's processor (or subprocessor). Under PIPA, the Customer is the entrusting party (위탁자) and SwiftQuantum the entrusted party (수탁자), and this DPA is the written entrustment document required by PIPA Article 26.

2.2 This DPA does not cover personal data that SwiftQuantum processes as a controller for its own purposes, such as account administration, billing, tax records, fraud prevention, and security of the Services. Our Privacy Policy describes that processing.

2.3 The subject matter, duration, nature and purpose of processing, and the types of personal data and categories of data subjects, are set out in Annex I.

3. Customer Obligations

The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis and giving any notices required to data subjects. The Customer will not submit special categories of personal data (GDPR Article 9), data relating to criminal convictions, or Korean resident registration numbers to the Services unless the parties have agreed this in writing.

4. SwiftQuantum's Obligations

4.1 Instructions

SwiftQuantum processes Customer Personal Data only on the Customer's documented instructions. The Main Agreement, this DPA, and the Customer's use and configuration of the Services are the Customer's complete instructions at the time of signing; further instructions must be in writing and consistent with the Services. If SwiftQuantum is required by law to process Customer Personal Data otherwise, it will tell the Customer before processing unless the law prohibits this. SwiftQuantum will tell the Customer if, in its opinion, an instruction infringes Data Protection Law.

4.2 Confidentiality

SwiftQuantum ensures that every person authorized to process Customer Personal Data is bound by an appropriate duty of confidentiality. At the date of this version, the only person with administrative access to production systems is SwiftQuantum's founder.

4.3 Security

SwiftQuantum implements the technical and organizational measures described in Annex II. SwiftQuantum may change those measures over time, provided the overall level of protection is not reduced. Annex II also lists measures that are not in place, so the Customer can assess whether the Services are suitable for its data.

4.4 Subprocessors

(a) The Customer gives SwiftQuantum general authorization to engage Subprocessors. The Subprocessors in use at the date of signature are those listed on the Subprocessors page (Annex III).

(b) SwiftQuantum will impose on each Subprocessor, by written contract, data protection obligations that give at least the same level of protection as this DPA, to the extent applicable to the service the Subprocessor provides. Where a Subprocessor is a large provider that offers only standard terms, the contract is that provider's standard data processing terms. SwiftQuantum remains responsible to the Customer for the performance of its Subprocessors' obligations.

(c) SwiftQuantum will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data, by updating the Subprocessors page and by email to the notice address the Customer has provided for this DPA.

(d) The Customer may object to a new Subprocessor on reasonable data protection grounds by writing to legal@swiftquantum.tech within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Service by written notice, without penalty, and SwiftQuantum will refund any prepaid fees for the period after termination.

4.5 Data Subject Requests

Taking into account the nature of the processing, SwiftQuantum will assist the Customer by appropriate technical and organizational measures in responding to requests from data subjects to exercise their rights. If SwiftQuantum receives such a request directly, it will refer the data subject to the Customer and will not respond itself, except to confirm the referral, unless the Customer authorizes it or the law requires it.

4.6 Impact Assessments and Consultations

SwiftQuantum will give the Customer reasonable assistance, using information available to it, with data protection impact assessments and prior consultations with supervisory authorities that relate to the Services.

4.7 Personal Data Breaches

(a) SwiftQuantum will notify the Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, and aims to do so within 72 hours.

(b) The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not available at first will be provided in phases as it becomes available.

(c) SwiftQuantum will take reasonable steps to contain and remedy the breach and will cooperate with the Customer in meeting its notification obligations. Notice of a breach is not an admission of fault or liability.

4.8 Deletion or Return

At the end of the Services, SwiftQuantum will, at the Customer's choice, return Customer Personal Data using the export functions of the Services or delete it. The Customer should export any data it needs before the end of the Services. SwiftQuantum will delete Customer Personal Data from production systems within 30 days after the end of the Services; copies in automated database backups are overwritten as those backups expire (currently within 7 days). SwiftQuantum may keep data where the law requires it to, and will keep it confidential and process it only for that purpose.

4.9 Demonstrating Compliance and Audits

(a) SwiftQuantum will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. SwiftQuantum will do this primarily by providing written documentation and answering a written security or privacy questionnaire, up to once every 12 months, or more often where a supervisory authority requires it or after a personal data breach.

(b) SwiftQuantum does not hold third-party certifications (see Annex II). If the Customer reasonably shows that the documentation is insufficient to demonstrate compliance, SwiftQuantum will allow an audit by the Customer or an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours in Korea, limited to what is necessary, and at the Customer's expense. Audits must not give access to other customers' data.

5. International Transfers

5.1 Location. SwiftQuantum stores Customer Personal Data in Amazon Web Services' Asia Pacific (Seoul) region, ap-northeast-2. Content delivery through Amazon CloudFront and some Subprocessors (see Annex III) involve processing in other countries, including the United States.

5.2 Transfers from the EEA. SwiftQuantum is established in the United States and stores Customer Personal Data in the Republic of Korea. For transfers of Customer Personal Data from the EEA to SwiftQuantum, the parties incorporate by reference the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 ("SCCs"), Module 2 (controller to processor) where the Customer is a controller and Module 3 (processor to processor) where the Customer is a processor, with these choices: Clause 7 (docking clause) applies; in Clause 9(a), Option 2 (general written authorization) applies, with the notice period in Section 4.4(c); the optional wording in Clause 11 does not apply; in Clause 13, the competent supervisory authority is determined by the Customer's establishment or representative in the EU; Clauses 17 and 18 are governed by the law, and subject to the courts, of Ireland, unless the Customer is established in another EU Member State that allows third-party beneficiary rights, in which case that Member State's law and courts apply. Annexes I, II and III of this DPA complete the Annexes to the SCCs.

5.3 Transfers from the United Kingdom. For personal data subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (the "UK Addendum") applies to the SCCs referred to in Section 5.2. Table 1 is completed with the parties' details in Annex I, Tables 2 and 3 with the choices in Section 5.2 and the Annexes of this DPA, and in Table 4 either party may end the UK Addendum as set out in its Section 19.

5.4 Switzerland. For personal data subject to the Swiss Federal Act on Data Protection, the SCCs apply with references to the GDPR read as references to that Act and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.

5.5 Onward transfers. Where a Subprocessor processes Customer Personal Data outside the country from which it was transferred, SwiftQuantum relies on the transfer mechanism that the Subprocessor provides in its data processing terms, such as SCCs.

5.6 Korea (PIPA). Where the Customer entrusts personal data of data subjects in Korea, SwiftQuantum discloses the items required by PIPA for overseas transfers (recipient, country, the timing and method of transfer, the data items, the purpose, and the retention period) on the Subprocessors page and in our Privacy Policy, so the Customer can include them in its own privacy notice.

6. Liability

Each party's liability arising out of or in connection with this DPA, including under the SCCs to the extent permitted by them, is subject to the limitations and exclusions of liability in the Main Agreement. Nothing in this DPA limits either party's liability to data subjects under the SCCs or Data Protection Law where such limitation is not permitted.

7. Term, Precedence, and Governing Law

7.1 This DPA applies for as long as SwiftQuantum processes Customer Personal Data under the Main Agreement.

7.2 If there is a conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Main Agreement as regards the processing of Customer Personal Data.

7.3 This DPA is governed by the law and dispute resolution provisions of the Main Agreement, except that the SCCs, where they apply, are governed by the law and courts chosen in Section 5.2 as their Clauses 17 and 18 require, and except where Data Protection Law requires otherwise.

7.4 SwiftQuantum may publish new versions of this template. A signed DPA is not changed by a later template unless both parties agree in writing.

Annex I: Details of Processing

A. Parties

B. Description of Processing

C. Competent Supervisory Authority

For the SCCs: the supervisory authority determined under Clause 13 by reference to the Customer. For PIPA: the Personal Information Protection Commission of the Republic of Korea.

Annex II: Technical and Organizational Measures

This Annex describes the measures in place at the date of this version. It lists only measures that are actually implemented, followed by the measures that are not in place.

Measures in place

Measures not in place

The Customer should take the following into account when deciding whether the Services are suitable for its data:

• No certifications. SwiftQuantum does not hold SOC 2, ISO/IEC 27001, or ISMS-P certification, and no independent audit report is available.
• No single sign-on. Sign-in with a customer's own identity provider (SAML or OIDC) is not offered as a supported feature.
• Single region. Data is hosted in one AWS region (Seoul) with no cross-region replica or failover. The production database runs in a single Availability Zone.
• Session tokens. Session tokens are JSON Web Tokens signed with HS256 (a shared secret), not with an asymmetric algorithm.
• Single administrator. There is no separate security team or 24/7 on-call rotation; security operations depend on one person.

Annex III: Subprocessors

The list of Subprocessors, with their purpose, the data they receive, their location, and the products that use them, is maintained on the Subprocessors page. The version of that page in effect on the date of signature forms Annex III, and changes follow Section 4.4.

Signatures

This DPA is published in English and Korean. Other language pages summarize it and point to these versions. If the English and Korean versions differ, the English version controls unless the signed counterpart states otherwise.