Data Processing Agreement

The Controller is the QTicket business customer identified in the applicable order, subscription, pilot agreement or other written agreement. The Processor is QTICKET LTD, registered in England and Wales under company number 17503881.

This DPA applies only to processing carried out by QTICKET LTD on behalf of the Controller. It does not govern processing for which QTICKET LTD acts as an independent controller.

Subject matter: operation of the QTicket walk-in queue service, including customer check-in, live queue management, staff workflow, notifications, displays, support, security and related administration.

Duration: for the term of the QTicket service or pilot and for the limited period afterwards required to securely return, delete or otherwise lawfully retain data.

Nature and purpose: collection, storage, organisation, retrieval, use, transmission, updating, support, security logging and deletion of personal data as needed to provide and protect QTicket.

Data subjects may include walk-in customers, the Controller's staff, authorised business users and business contacts.

Personal data may include customer first name, telephone number, communication channel, service and staff preference, queue and ticket status, timestamps, staff identity and availability, business account details, device and security information, notification status and provider references.

QTicket is not designed for the routine processing of special category data. The Controller must not intentionally submit special category data unless separately agreed and lawfully supported.

QTICKET LTD will process personal data only on documented instructions from the Controller, including instructions contained in the service configuration, the applicable agreement and support requests, unless UK law requires otherwise.

If QTICKET LTD believes an instruction infringes applicable data protection law, it will inform the Controller unless prohibited by law.

QTICKET LTD will ensure that people authorised to process Controller personal data are subject to appropriate confidentiality obligations.

QTICKET LTD will maintain appropriate technical and organisational measures having regard to the nature of the processing and the risks involved. Measures may include access controls, authentication, tenant separation, row-level database controls, restricted administrative access, audit records, secure secret handling and measures intended to protect confidentiality, integrity and availability.

The Controller gives QTICKET LTD general written authorisation to use sub-processors necessary to provide QTicket, subject to applicable UK data protection law.

QTICKET LTD will require sub-processors handling Controller personal data to provide data-protection obligations offering an equivalent level of protection required by applicable law. QTICKET LTD remains responsible to the Controller for its sub-processors' compliance with those obligations.

QTICKET LTD will maintain a current sub-processor record and provide appropriate notice of material changes so that the Controller can raise a reasonable data-protection objection.

QTICKET LTD will not make a restricted international transfer of Controller personal data without an appropriate lawful transfer mechanism or other permitted safeguard where one is required.

Taking into account the nature of the processing, QTICKET LTD will provide reasonable assistance to help the Controller respond to requests by data subjects exercising their rights under applicable data protection law.

Taking into account the nature of processing and the information available to it, QTICKET LTD will reasonably assist the Controller with security obligations, personal data breach obligations, data protection impact assessments and regulator consultation where required.

QTICKET LTD will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller personal data where notification is required by applicable law.

At the end of the relevant service, QTICKET LTD will, at the Controller's choice and subject to applicable law and technical feasibility, delete or return Controller personal data and delete remaining copies unless UK law requires continued storage.

Data in protected backups may remain unavailable for ordinary use until the applicable backup cycle expires, provided it remains appropriately protected and is not restored for normal processing except where necessary for recovery.

QTICKET LTD will make available information reasonably necessary to demonstrate compliance with its processor obligations and will allow and contribute to reasonable audits or inspections required under applicable data protection law.

Audits must, where lawful, be coordinated to minimise unnecessary security, confidentiality and service disruption risks.

The Controller is responsible for determining the purposes and lawful basis of its processing, providing required privacy information to data subjects, obtaining any consent that is legally required, configuring QTicket lawfully and ensuring that its instructions to QTICKET LTD comply with applicable law.

If this DPA conflicts with another agreement between the parties on the processing of personal data, this DPA prevails to the extent of that conflict unless the parties expressly agree a lawful replacement in writing.

This DPA is governed by the laws of England and Wales, subject to mandatory applicable data protection law.