Data Processing Agreement (GDPR/CCPA)

This Data Processing Agreement applies when QASyn processes personal data on behalf of a customer in connection with the Service. It supplements the Terms of Service and the Privacy Policy.

Roles. The customer is the data controller (or business under CCPA) and determines the purposes and means of processing. QASyn acts as the processor (or service provider) and processes personal data only on documented instructions, including those in the applicable order and this agreement.

Processing scope. Processing is limited to hosting and operating the customer workspace, running tests and analyses, generating reports, providing support, and maintaining security. The categories of data subjects and personal data are those the customer chooses to submit to the Service.

Confidentiality and security. Personnel with access to personal data are bound by confidentiality obligations. QASyn maintains technical and organisational measures including encryption in transit, AES-256-GCM encryption of secrets at rest, hashed API tokens, tenant-scoped access control, audit logging, and regular vulnerability management.

Sub-processors. QASyn may engage sub-processors for hosting, email delivery, monitoring, and support. Sub-processors are bound by written data-protection terms no less protective than this agreement. Customers may request the current list and object to new sub-processors on reasonable grounds.

Data subject rights. QASyn assists customers in responding to access, correction, deletion, restriction, portability, and objection requests. The workspace provides export and deletion controls, and the QASyn team supports verified requests within the required timelines.

Breach notification. QASyn notifies the customer without undue delay after confirming a personal-data breach and within 72 hours where required by law, with the information reasonably available to help the customer meet its own notification obligations.

Return and deletion. On termination, QASyn returns or deletes personal data at the customer's choice, subject to legal retention requirements. Backups are purged on the normal backup cycle after the retention window.

CCPA. QASyn does not sell personal information, does not retain, use, or disclose it outside the business purpose of providing the Service, and will notify the customer if it determines it can no longer meet these obligations.

Contact. Data-processing and DPA requests: info@qasyn.io or contact us.