Qualflare Data Processing Addendum

Processor

Qualflare OÜ has not appointed a Data Protection Officer under GDPR Article 37. In our assessment, our current processing activities do not meet the threshold in Article 37(1). You may reach our privacy team at [email protected] for any matter covered by this DPA.

Controller

“Customer” is the legal entity identified in the Order Form, master subscription agreement, or click-wrap signup that incorporates this DPA by reference. Customer's identity and contact details for the purposes of this DPA are captured in Annex 1A (List of Parties) at the time of acceptance.

Capitalised terms used in this DPA have the meaning given to them in the GDPR unless defined below or elsewhere in the Agreement.

• “Customer Personal Data” means any Personal Data that Qualflare processes on Customer's behalf in connection with the Services, including Personal Data that Customer or its users upload to the Services and Personal Data that the Services generate on Customer's behalf.
• “Data Subject” has the meaning given in GDPR Article 4(1).
• “Personal Data” has the meaning given in GDPR Article 4(1).
• “Personal Data Breach” has the meaning given in GDPR Article 4(12).
• “Processing” (and its cognates) has the meaning given in GDPR Article 4(2).
• “SCCs” means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• “Services” has the meaning given in the Qualflare Terms of Service.
• “Sub-processor” means any third party engaged by Qualflare to process Customer Personal Data on Qualflare's behalf in connection with the Services, as listed in Annex 3.
• “TOMs” means the technical and organisational measures described in Annex 2.

References to articles are to the GDPR unless otherwise stated.

In relation to Customer Personal Data processed under the Agreement:

1. Customer is the Controller. Customer determines the purposes and means of the Processing, instructs Qualflare through the Agreement and through Customer's configuration and use of the Services, and is responsible for having a lawful basis under Article 6 (and, where applicable, Article 9) for the Processing.
2. Qualflare is the Processor. Qualflare processes Customer Personal Data only on Customer's behalf, only for the purposes described in this DPA and the Agreement, and only in accordance with Customer's documented instructions.

This DPA applies regardless of whether Customer is established inside or outside the European Economic Area. For customers established outside the EEA whose Processing is not subject to GDPR, the commitments in this DPA apply as contractual undertakings between the parties, and Section 9 (International Data Transfers) applies only to the extent required by applicable law.

Qualflare processes Customer Personal Data only on documented instructions from Customer, including with regard to transfers of Customer Personal Data to a third country or international organisation, unless required to do so by Union or Member State law to which Qualflare is subject; in such a case, Qualflare will inform Customer of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest.

Customer's documented instructions are set out in:

1. this DPA;
2. the Agreement (including the Terms of Service and any Order Form);
3. Customer's use of, and configuration of, the Services through the Qualflare application, API, CLI, and MCP server (for example, the retention period Customer sets for test artefacts, the sub-processors Customer authorises through Annex 3, and the in-product toggles Customer uses); and
4. any additional instructions Customer gives in writing to [email protected] that Qualflare has agreed to in writing.

If Qualflare believes that an instruction from Customer infringes the GDPR or other Union or Member State data protection provisions, Qualflare will promptly inform Customer. Qualflare is not obliged to follow, and will not follow, an instruction that in its reasonable opinion infringes the law.

The subject matter, nature, purpose, duration, categories of Personal Data, categories of Data Subjects, and other details of the Processing are set out in Annex 1B (Description of Processing and Transfer).

In summary: Qualflare processes Customer Personal Data to provide, operate, secure, support, and improve the Services — an AI-driven quality assurance test management and observability platform — for the duration of the Agreement and for the short tail periods described in Section 14.

Qualflare ensures that persons authorised to process Customer Personal Data on its behalf:

1. are bound by a written confidentiality obligation (or are under an appropriate statutory obligation of confidentiality);
2. access Customer Personal Data only on a strict need-to-know basis and only to the extent necessary to perform their duties under the Agreement; and
3. receive appropriate privacy and security training at onboarding and on a regular cadence thereafter.

Qualflare takes reasonable steps to ensure the reliability of any employee, contractor, or agent who may have access to Customer Personal Data.

Taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the Processing, and the risk to the rights and freedoms of Data Subjects, Qualflare implements appropriate technical and organisational measures to ensure a level of security of Customer Personal Data appropriate to the risk, as required by Article 32.

The measures Qualflare applies are set out in Annex 2 (Technical and Organisational Measures). Qualflare may update the TOMs from time to time provided that any update does not materially reduce the overall level of security. Customer is entitled to review the current TOMs at any time by written request to [email protected].

8.1 General authorisation

Customer grants Qualflare general written authorisation to engage Sub-processors, subject to the notice and objection mechanics in this Section. This authorisation satisfies Clause 9 Option 2 of the SCCs for transfers governed by Module 2 and Module 3.

8.2 Current list

The Sub-processors Qualflare currently engages to process Customer Personal Data are listed in Annex 3 (Sub-Processors). Customer is deemed to authorise the Sub-processors listed in Annex 3 as at the effective date of this DPA.

8.3 Notice of changes

Before engaging a new Sub-processor, or before a material change in the role of an existing Sub-processor, Qualflare will give Customer at least 30 days' prior written notice through the sub-processor change record published in Section 8.7 of this DPA and, on Customer's request, by email to the addresses Customer designates. The notice will identify the Sub-processor, its location, and the Processing activities it will perform.

8.4 Objection

Customer may object to a new Sub-processor in writing within the 30-day notice period on reasonable data-protection grounds by emailing [email protected] with a description of the grounds. If Customer objects:

1. Qualflare will use reasonable efforts to make available a change in the Services that avoids Processing of Customer Personal Data by the objected-to Sub-processor without materially reducing the functionality of the Services; or
2. if Qualflare cannot make such a change within a reasonable period (not to exceed 30 days from the objection notice), Customer may terminate the specific part of the Services that cannot be provided without the objected-to Sub-processor, with a pro-rated refund of any fees prepaid for the terminated part.

Termination under this Section 8.4 is Customer's sole and exclusive remedy with respect to an objected-to Sub-processor.

8.5 Flow-down and liability

Qualflare imposes on each Sub-processor, by way of a written contract, data protection obligations no less protective of Customer Personal Data than those set out in this DPA. Qualflare remains fully liable to Customer for the performance of each Sub-processor's data protection obligations, in accordance with Article 28(4) GDPR.

8.6 Sub-processor list as part of the contract

The Sub-processor list in Annex 3 is incorporated into this DPA. Qualflare will keep it up to date and versioned.

8.7 Sub-processor change record

Every addition, removal or material role change affecting the Annex 3 list is recorded here, newest first, with the date it took effect. This is the notice channel referred to in Section 8.3.

9.1 General principle

Qualflare stores Customer Personal Data inside the European Union by default. The primary storage location is Google Cloud's europe-central2 region (Warsaw, Poland). However, some Sub-processors are based in the United States or operate global infrastructure — see Annex 3.

9.2 Incorporation of the SCCs

Where Qualflare transfers Customer Personal Data to a country outside the EEA that is not subject to an adequacy decision under Article 45 GDPR, the transfer is governed by the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the “SCCs”), which are incorporated into this DPA by reference and deemed to form part of it as if set out in full.

For the avoidance of doubt:

• Module 2 (Controller to Processor) applies to transfers from Customer (as controller) to Qualflare (as processor) in circumstances where Customer is established in the EEA and Qualflare processes the Customer Personal Data outside the EEA.
• Module 3 (Processor to Processor) applies to onward transfers from Qualflare to Sub-processors established outside the EEA in circumstances where Customer's Personal Data is subject to the GDPR.

9.3 Docking clause

The Clause 7 (docking clause) of the SCCs is incorporated and enabled. Any entity that is not a party to the SCCs may, with the written consent of the existing parties, accede to the SCCs at any time as a data exporter or data importer.

9.4 Annexes

The Annexes required by the SCCs are populated by:

• Annex I.A (List of Parties) — see Annex 1A of this DPA.
• Annex I.B (Description of Transfer) — see Annex 1B of this DPA.
• Annex I.C (Competent Supervisory Authority) — see Annex 1C of this DPA.
• Annex II (Technical and Organisational Measures) — see Annex 2 of this DPA.
• Annex III (List of Sub-processors) — see Annex 3 of this DPA.

9.5 SCC optional clauses

• Clause 9 Option 2 (general written authorisation for Sub-processors with a 30-day notification period) is selected — see Section 8.
• Clause 11(a) (independent dispute resolution body) — Qualflare does not opt in.
• Clause 17 (governing law) — the governing law of the SCCs is the law of the Republic of Estonia, an EU Member State that allows for third-party beneficiary rights.
• Clause 18 (choice of forum and jurisdiction) — any dispute arising from the SCCs will be resolved by the courts of Estonia (non-exclusive), without prejudice to a Data Subject's right to bring proceedings in the courts of the Member State in which the Data Subject has his or her habitual residence (Clause 18(c)).

9.6 EU-US Data Privacy Framework

Several of the Sub-processors in Annex 3 are certified under the EU-US Data Privacy Framework pursuant to Commission Decision (EU) 2023/1795. Where a transfer from Qualflare (or from Customer through Qualflare) to a DPF-certified Sub-processor would otherwise require the SCCs, the DPF adequacy decision is the primary transfer mechanism for that transfer, and the SCCs apply as a backstop that remains in force in case the DPF is withdrawn, suspended, or invalidated. Annex 3 identifies each Sub-processor's DPF status as at the effective date of this DPA.

9.7 Transfer Impact Assessment

Qualflare is producing a Transfer Impact Assessment in line with EDPB Recommendations 01/2020 (adopted 10 November 2020) and the CJEU judgment in Case C-311/18 (Schrems II). The assessment considers the law and practice of the destination countries, the supplementary measures in place, and the categories of Customer Personal Data involved. Once the assessment is complete, Qualflare will make a summary of it available to Customer on request, together with the supplementary measures relied on.

9.8 UK and Swiss transfers

Qualflare is a globally available service and does not specifically target customers in the United Kingdom or Switzerland. However, any customer may choose to use the Services from those jurisdictions, and Customer Personal Data of UK or Swiss Data Subjects may therefore flow through the Services. Where that happens:

• For UK transfers, the parties will execute the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B1.0) issued by the UK Information Commissioner's Office in March 2022, which will be attached to this DPA as Schedule A.
• For Swiss transfers, the parties will apply the amendments approved by the Swiss Federal Data Protection and Information Commissioner to the 2021 SCCs: references to “GDPR” include the revised Swiss Federal Act on Data Protection (in force 1 September 2023); references to “Member State” include Switzerland; the competent supervisory authority is the Swiss FDPIC; and the Clauses apply to Personal Data of legal persons to the extent required by Swiss law.

Such execution or application takes effect without the need for a separate DPA amendment.

9.9 Copies of the SCCs

Customer may request a copy of the SCCs (and of any Sub-processor's executed back-to-back SCCs) by writing to [email protected].

Taking into account the nature of the Processing, Qualflare assists Customer by appropriate technical and organisational measures to fulfil Customer's obligations to respond to requests from Data Subjects exercising their rights under Chapter III GDPR, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of Processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right not to be subject to a decision based solely on automated Processing (Article 22)

Qualflare provides self-service tooling for the common cases in the Qualflare application and API. Where self-service is not sufficient, Customer may email [email protected] with a Data Subject request and Qualflare will respond within 10 business days with the information Customer needs to respond to the Data Subject within the one-month deadline set by Article 12(3).

Qualflare will not respond directly to a Data Subject in respect of Customer Personal Data unless (a) Customer authorises Qualflare to do so, or (b) Qualflare is required to do so by law. If Qualflare receives a Data Subject request concerning Customer Personal Data, Qualflare will promptly forward it to Customer and will not action it without Customer's instruction.

Reasonable assistance is provided at no additional charge. Qualflare may charge a reasonable fee for assistance that is unreasonable or excessive in light of the scale and complexity of the Processing, and will notify Customer of any such charge before incurring it.

11.1 Notification timeline

Qualflare notifies Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within 72 hours after Qualflare becomes aware of the Breach.

11.2 Awareness

“Awareness” for the purposes of this Section means the point at which Qualflare has a reasonable degree of certainty that a security incident has led to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

11.3 Content of the notification

The notification will, to the extent then known to Qualflare, include:

1. a description of the nature of the Breach, including where possible the categories and approximate number of Data Subjects concerned and the categories and approximate number of records concerned;
2. the name and contact details of Qualflare's privacy team ([email protected]);
3. the likely consequences of the Breach;
4. the measures taken or proposed to be taken to address the Breach, including, where appropriate, measures to mitigate its possible adverse effects; and
5. any other information reasonably necessary for Customer to comply with its obligations under Articles 33 and 34.

Where it is not possible to provide all of the above at the time of the first notification, Qualflare will provide it in phases without further undue delay as the information becomes available.

11.4 Assistance with onward notifications

Qualflare assists Customer in meeting Customer's own obligations under Articles 33 (notification to the supervisory authority) and 34 (communication to Data Subjects), including by providing the information described above and by cooperating in good faith with Customer's inquiries about the Breach.

11.5 Qualflare's direct obligations to a supervisory authority

This Section 11 does not affect Qualflare's own obligation (where applicable) to notify the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) of Personal Data Breaches affecting Qualflare's controllership-level Processing (for example, Personal Data of Qualflare's own employees and customers that Qualflare processes as a controller). Those obligations are governed by Qualflare's Privacy Notice, not by this DPA.

Taking into account the nature of the Processing and the information available to Qualflare, Qualflare assists Customer with:

1. Data Protection Impact Assessments under Article 35 — by providing information about Qualflare's Processing activities, the TOMs in Annex 2, the Sub-processor list in Annex 3, and the flow of Customer Personal Data through the Services, in a form that Customer can incorporate into its DPIA.
2. Prior consultation of a supervisory authority under Article 36 — by responding to reasonable requests for information from Customer and cooperating in good faith with any supervisory-authority inquiries.

Reasonable assistance is provided at no additional charge. Requests should be sent to [email protected].

13.1 Information and reports

Qualflare makes available to Customer, on written request and under an obligation of confidentiality, the information Customer reasonably requires to demonstrate compliance with Article 28 and this DPA, including:

1. the current version of the TOMs (Annex 2);
2. the current Sub-processor list (Annex 3);
3. the summary of the Transfer Impact Assessment (see Section 9.7);
4. any third-party audit reports, certifications, or attestations Qualflare has obtained (see Section 13.2).

13.2 Third-party audits and certifications

Qualflare currently does not hold a SOC 2 Type II or ISO 27001 certification. Qualflare intends to pursue third-party security attestation as the company grows and will make any resulting reports available to Customer under a confidentiality obligation when they exist.

13.3 On-site audits

Beyond the information and reports in Sections 13.1 and 13.2, Customer has the right to carry out an on-site audit of Qualflare's Processing operations, as required by Article 28(3)(h) and Clause 8.9 of the SCCs. An on-site audit is subject to the following reasonable limits:

1. Frequency. No more than once per twelve-month period, except where an audit is required by a supervisory authority or is reasonably required following a Personal Data Breach.
2. Notice. At least 30 days' written notice in advance.
3. Scope. Limited to Qualflare's Processing of Customer Personal Data and to systems and premises used for that Processing. Multi-tenant systems that process other customers' data are out of scope to the extent necessary to protect the confidentiality of those other customers.
4. Auditor. Customer may use its own personnel or a mutually agreed independent auditor. The auditor must execute a confidentiality agreement in Qualflare's standard form before accessing any Qualflare system or information.
5. Cost. Customer bears the cost of the audit. Qualflare will not charge for reasonable assistance during the audit, except where the audit is unreasonable in duration, intrusiveness, or scope given the nature of the Processing and the information already available under Sections 13.1 and 13.2.
6. Time and manner. During Qualflare's normal business hours, in a manner that does not unreasonably interfere with Qualflare's operations or with other customers' use of the Services.
7. Use of findings. Customer may use the audit findings only to demonstrate Customer's own compliance with the GDPR and must treat the findings as Qualflare's confidential information.

Qualflare and Customer will cooperate in good faith to resolve any material findings identified in an audit.

14.1 On termination of the Agreement

On termination of the Agreement, at Customer's choice, Qualflare will:

1. Return Customer Personal Data to Customer in a commonly used machine-readable format (JSON or CSV, as applicable to the data category), within 30 days of the termination date; and / or
2. Delete all Customer Personal Data from Qualflare's active production systems within 60 days of the later of (a) the termination date and (b) Customer's confirmation that it no longer needs a return.

If Customer does not make a choice within 30 days of termination, Qualflare will delete Customer Personal Data in accordance with sub-section (2) above.

14.2 Backups

Customer Personal Data may remain in encrypted back-ups for the 7-day back-up rotation window described in the Privacy Notice §10. During that window, the back-up data remains subject to the confidentiality and security obligations in this DPA and is not restored or accessed except in the course of routine back-up integrity verification or incident response.

14.3 Legal-hold carve-out

Notwithstanding Sections 14.1 and 14.2, Qualflare may retain Customer Personal Data to the extent required by Union or Member State law (for example, Estonian tax and accounting law requires retention of billing records for up to 7 years). Any such retained data remains subject to the confidentiality, security, and Processing-limitation obligations in this DPA for the duration of the retention, and is not used for any purpose other than the purpose for which it is retained by law.

14.4 Certificate of deletion

On Customer's written request following deletion, Qualflare will provide a written certificate confirming the deletion of Customer Personal Data from active production systems.

Qualflare's AI Sub-processors do not train, fine-tune, or evaluate their foundation models on Customer Data. Customer Personal Data sent through Qualflare's AI features (see Terms of Service §8) is processed by three model providers, and the basis for this commitment differs for each:

• Google LLC (Annex 3 row 3) processes embeddings, failure clustering, launch analysis, query generation and the default conversational agent, through its Gemini API, subject to Google's enterprise terms, which exclude API inputs and outputs from being used to improve Google's models.
• OpenAI (row 12) processes the Quo conversational agent on workspaces Qualflare has enabled for it. OpenAI's API terms exclude inputs and outputs submitted through the API from being used to train its models, and Qualflare additionally sends these requests with retention disabled (store=false) from 28 September 2026. A Data Processing Agreement with OpenAI is in progress and not executed as of this disclosure.
• TypeSafe (row 13) provides the Jev typed-decision model, reached as a third-party model on Cloudflare's infrastructure. TypeSafe's published privacy policy states: “We will not train or fine tune any artificial intelligence or machine learning models on your prompts or other Input.” Qualflare relies on that published statement, not on an agreement: Qualflare holds no direct contract with TypeSafe, because the model is reached and billed through Cloudflare, so the assurance here is a unilateral public commitment the provider can change rather than a term Qualflare can enforce. Qualflare also redacts credentials, email addresses and identifiers it recognises from this content before it is sent.

Qualflare uses records of AI requests to improve its own features. So that Qualflare's defect clustering and analysis get better over time, Qualflare keeps a record of AI requests and their results — the prompt, the output, and the failure messages and test names involved. Before anything is stored, Qualflare removes credentials, API keys and email addresses. The record is held in Cloudflare D1 (Annex 3 row 2). The records carry no workspace, project, launch or cluster identifier and are anonymous. That was not true until 29 September 2026: records written before then retained identifiers that could resolve a row to its workspace, so they were pseudonymised and within the scope of data-protection law while this Section described them otherwise. Every record written before the fix was deleted on 2 October 2026 — 1,984 AI-request records and 51,895 text pairs — rather than merely stripped, because stripping could not reach an identifier quoted inside a stored failure message. See Privacy Notice §6. Any workspace admin can turn this off under workspace settings → privacy; turning it off stops future collection for that workspace, normally within five minutes, but cannot remove records already collected.

This Section 15 is a material commitment of this DPA as to: (a) Sub-processors not training on Customer Data, and (b) Qualflare honouring the anonymisation safeguards described above for any record it retains for its own model improvement. If Qualflare or any Sub-processor fails to honour either commitment, Customer has the right to terminate the Agreement for cause with a pro-rated refund of prepaid fees.

16.1 Cap

Each party's liability arising out of or related to this DPA, whether in contract, tort (including negligence), or under any other theory of liability, is subject to the same aggregate liability cap that applies to the Agreement as a whole, as set out in Terms of Service §13.

16.2 Super-cap for security and confidentiality

Notwithstanding Section 16.1, Qualflare's aggregate liability for (a) a material breach of the TOMs in Annex 2 resulting in a Personal Data Breach, or (b) a material breach of the confidentiality obligations in Section 6, is subject to a super-cap equal to two (2) times the aggregate liability cap in the Terms of Service.

16.3 Preserved liability

Nothing in this DPA limits or excludes:

1. liability that cannot be limited or excluded under applicable law, including liability for death or personal injury caused by negligence, fraud, intent, or gross negligence;
2. a Data Subject's rights to compensation and remedies under Article 82 GDPR — these rights run directly between the Data Subject and the controller (and, where applicable, the processor) and are not limited by the inter-party cap in this Section 16;
3. liability for either party's indemnity obligations in the Agreement;
4. liability for Qualflare's material breach of Section 15 (No Training of AI Models).

16.4 Allocation between controller and processor under Article 82

Where both Customer and Qualflare are held liable to a Data Subject under Article 82, each party is entitled to claim back from the other the part of the compensation corresponding to the other party's part of responsibility for the damage. Each party will cooperate in good faith in the allocation.

This DPA takes effect on the date Customer accepts the Agreement and continues in force for as long as Qualflare processes Customer Personal Data on Customer's behalf. The obligations in Sections 6 (Confidentiality), 11 (Breach notification, in respect of Breaches that occurred during the term), 14 (Return and Deletion), 15 (No Training), and 16 (Liability) survive termination.

Termination of this DPA does not terminate the Agreement; termination of the Agreement terminates this DPA in accordance with the Agreement's termination clauses.

This DPA is governed by the laws of the Republic of Estonia, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

Any dispute arising out of or in connection with this DPA is subject to the non-exclusive jurisdiction of the Harju County Court (Harju Maakohus) in Tallinn, Estonia, as described in Terms of Service §17.

For Customer consumers (if any) resident in the EU, EEA, United Kingdom, or Switzerland, nothing in this clause deprives the Customer of the mandatory-law protections in the country of habitual residence (Article 6 of Rome I Regulation (EC) 593/2008). See Terms of Service §15 for the Consumer Provisions that apply.

Nothing in this Section 18 affects the jurisdiction choices required by the SCCs themselves — in particular, a Data Subject's right under Clause 18(c) of the SCCs to bring proceedings in the courts of the Member State where the Data Subject has his or her habitual residence.

For any matter arising under this DPA — including a Data Subject request, a Sub-processor objection, a Personal Data Breach notification received by Customer, a request to exercise audit rights under Section 13, or a request for the SCCs — contact:

This DPA is incorporated into the Agreement by reference. Customer accepts this DPA by any of the following means, each of which has equal force:

1. Click-wrap at signup. By creating a Qualflare account and accepting the Terms of Service, Customer also accepts this DPA, which is incorporated into the Terms of Service by reference.
2. Stand-alone acceptance at qualflare.com/dpa. Customer may, at any time, accept this DPA as a stand-alone instrument by visiting https://qualflare.com/dpa, completing the Annex 1A form with Customer's identification, and confirming acceptance. The stand-alone acceptance replaces any earlier acceptance through the Terms of Service.
3. Counter-signed PDF. For enterprise customers that require a counter-signed document, Qualflare will, on request, make a PDF version of this DPA available for signature. A counter-signed PDF prevails over earlier click-wrap acceptance only to the extent the counter-signed version materially deviates from this text, which Qualflare must expressly acknowledge in writing.

The person who accepts this DPA on Customer's behalf warrants that they are authorised to bind Customer.

Complete this form to accept this DPA as a stand-alone instrument (option 2 above). It captures the same information as the Annex 1A List of Parties below and records your acceptance with a timestamp.

Data Exporter (Controller — Customer)

Data Importer (Processor — Qualflare)

Where Customer's Customer Personal Data includes Personal Data processed by a Sub-processor listed in Annex 3, that Sub-processor is the data importer for the purposes of the onward transfer, and Qualflare is the data exporter. The docking clause (Clause 7 of the SCCs) allows the Sub-processor to accede to the SCCs as if it were an original data importer.

Categories of Data Subjects

Customer Personal Data processed under this DPA may relate to:

1. Customer's users of the Qualflare application — the individuals to whom Customer issues Qualflare accounts, typically Customer's employees, contractors, and agents working on software quality assurance.
2. End users of Customer's applications whose personal data appears in test artefacts — individuals whose information (for example, email addresses, user IDs, IP addresses, or other identifiers) is incidentally present in test cases, logs, stack traces, screenshots, attachments, or defect descriptions that Customer uploads to the Services through the Qualflare application, CLI, or API.
3. Individuals identified in support communications sent to Qualflare by Customer's users.

Categories of Personal Data

1. Account data — name, email address, profession, optional avatar image, and authentication credentials stored only as salted cryptographic hashes.
2. Workspace and project metadata — workspace names, project names, team membership, roles, and invitation emails.
3. Test artefacts — test case definitions, test runs, results, defect descriptions, stack traces, logs, screenshots, file attachments, environment names, Git branch and commit hashes, and framework metadata.
4. Device and connection data — IP address, browser type and version, operating system, device type, language, time zone, and referrer URL.
5. Approximate location — country and approximate city derived from IP address. Qualflare does not collect GPS or precise device geolocation.
6. Application usage data — pages visited, features used, buttons clicked, forms submitted, scroll depth, time on page, page-load metrics.
7. Session recordings — video-style replays of interactions with the Qualflare application (app.qualflare.com). These are sampled at 100% per the disclosure in Privacy Notice §7 and are sent to Amplitude's EU server zone (see Annex 3).
8. Network capture events — a subset of HTTP requests and responses observed by the Amplitude SDK in Customer's browser.
9. Application and audit logs — server-side request logs, error stack traces, application performance metrics, and audit records of security-sensitive actions.
10. Payment metadata — billing email, billing address, plan, transaction IDs, last four digits of card. Full card numbers and security codes are handled directly by Stripe and never reach Qualflare's servers.
11. Support communications — messages sent to Qualflare's support channels and the email addresses from which they are sent.

Sensitive Personal Data

Qualflare does not knowingly process special categories of Personal Data within the meaning of Article 9 GDPR. Test artefacts uploaded by Customer may incidentally contain Personal Data of end users, and Customer is responsible for scrubbing any such data that falls within Article 9 before uploading.

Frequency of the Transfer

Continuous, for the duration of the Agreement.

Nature and Purpose of the Processing

Qualflare processes Customer Personal Data to:

1. create and maintain user accounts, authenticate users, and manage workspace membership;
2. deliver the core Services — storing and displaying test artefacts, running AI features, and routing notifications;
3. process payments (via Stripe) and meet accounting obligations;
4. send transactional emails (sign-in, billing receipts, security alerts, service announcements);
5. provide customer support;
6. monitor, debug, and improve the Services;
7. detect and respond to security incidents, abuse, and fraud;
8. maintain audit trails for security-sensitive actions;
9. comply with applicable law and respond to lawful requests from public authorities.

Retention Period

Customer Personal Data is retained for the periods set out in Privacy Notice §10, summarised here:

Sub-processor Transfers — Subject Matter, Nature, and Duration

Each Sub-processor in Annex 3 processes Customer Personal Data solely for the activities and purposes set out in Annex 3, and for the duration of Qualflare's engagement with that Sub-processor, which is typically co-terminous with the Agreement.

The competent supervisory authority for Qualflare OÜ, as a processor established in the Republic of Estonia, is:

Where Customer acts as a controller established in another EU/EEA Member State, the supervisory authority of Customer's Member State may also be competent to hear claims under Clause 13 of the SCCs (Module 2).

This Annex describes the technical and organisational measures that Qualflare applies under Article 32 GDPR and Annex II of the 2021 SCCs. Qualflare may update these measures from time to time provided that any update does not materially reduce the overall level of security.

Encryption

1. In transit. All connections to the Qualflare Services use TLS 1.2 or higher. HTTP Strict Transport Security is enabled on all public-facing domains. Internal service-to-service traffic is encrypted within the Google Cloud VPC.
2. At rest. Customer Personal Data stored in PostgreSQL on Google Compute Engine (europe-central2) is encrypted using AES-256 or equivalent, on a persistent disk encrypted with a customer-managed key held in Google Cloud KMS. Object storage (Cloudflare R2) is encrypted at rest. Database back-ups are encrypted client-side with AES-256 under a passphrase held separately from the storage provider, and are retained in Google Cloud Storage within the European Union.
3. Key management. Encryption keys are managed through Google Cloud KMS (for data at rest in GCP services) and through Cloudflare's managed key infrastructure (for data in R2). Key rotation follows each provider's default rotation cadence.

Access control

4. Role-based access control (RBAC) inside the Qualflare application, scoped by workspace, project, and feature.
5. Least-privilege principle for Qualflare personnel accessing production systems. Engineers do not have standing production access by default; elevation is time-bound and logged.
6. Single sign-on (SSO) with multi-factor authentication is mandatory for every Qualflare employee account that can access production systems or Customer Personal Data.
7. Production-access audit — every access to Customer Personal Data by a Qualflare employee is logged in an immutable audit log retained for at least 365 days.
8. Service account scoping — machine identities used by the Services have the minimum permissions necessary and are reviewed on a periodic cadence.
9. Customer-side authentication uses email and password managed by Ory Kratos (self-hosted), with password hashing and rate-limited login attempts. Qualflare never stores or sees Customer users' cleartext passwords.

Confidentiality and personnel

10. Confidentiality obligations. All Qualflare personnel are bound by written confidentiality obligations that survive the end of their engagement.
11. Privacy and security training at onboarding and on a recurring cadence.
12. Background checks on Qualflare personnel where lawful under Estonian law.
13. Acceptable-use policy governing Qualflare personnel's use of Customer Personal Data.

Integrity, availability, and resilience

14. Automated monitoring of application and infrastructure health, with alerting on anomalies in availability, latency, error rate, and security events.
15. Redundant infrastructure inside the europe-central2 region with Google Cloud's default zonal redundancy.
16. Back-ups — encrypted automated back-ups of the primary PostgreSQL database with a 7-day retention window and tested restoration procedures.
17. Distributed denial-of-service protection via Cloudflare at the edge.
18. Web application firewall via Cloudflare, configured with managed rule sets for the OWASP Top 10.
19. Private networking — application services communicate with the database over a private VPC; the database is not exposed to the public internet.

Restoration after incident

20. Documented incident response procedures including detection, triage, containment, eradication, recovery, and post-mortem stages.
21. Defined RTO and RPO targets for the core Services — Recovery Time Objective (RTO) of no more than 2 hours and Recovery Point Objective (RPO) of no more than 2 hours for the primary PostgreSQL database.
22. Post-incident review after every material incident, with findings fed back into the TOMs and the engineering backlog.

Secure development

23. Mandatory code review on every change to production code.
24. Automated dependency scanning for known vulnerabilities (CVEs) with an SLA for patching critical vulnerabilities.
25. Static application security testing integrated into the CI pipeline.
26. Secrets management — secrets are stored in a managed secrets service, not in code or configuration files.
27. Separation of environments — development, staging, and production environments are logically and practically separated. Customer Personal Data is never used in development or staging environments without irreversible anonymisation.

Event logging and monitoring

28. Immutable audit log of security-sensitive actions inside the application, retained for at least 365 days.
29. Security audit log — separate immutable log of administrative and access events, retained for at least 365 days.
30. Continuous log aggregation and alerting on suspicious patterns.

Data minimisation and retention

31. Data minimisation — the Services collect only the Personal Data necessary to deliver them.
32. Automated retention enforcement per the schedule in Annex 1B / Privacy Notice §10.
33. Deletion on request through in-product tooling and through [email protected].

Sub-processor management

34. Sub-processor due diligence before engagement, covering the sub-processor's security posture, certifications, and data protection commitments.
35. Written data protection terms in every Sub-processor contract, no less protective than those in this DPA.
36. Periodic re-assessment of each Sub-processor's security posture.

Physical and environmental security

37. Data-centre physical security is provided by Qualflare's infrastructure Sub-processors (Google Cloud Platform and Cloudflare), which operate ISO 27001-certified facilities with biometric access controls, 24/7 on-site security, fire suppression, and environmental monitoring. Qualflare does not operate its own data-centre.

Organisational

38. Record of Processing Activities (Article 30) — Qualflare maintains and keeps current its Article 30 record of processing activities.
39. Vendor risk management — structured review of every new Sub-processor before engagement.
40. Accountability — security roles and responsibilities are documented and assigned to specific individuals inside Qualflare.

Certifications and attestations

41. SOC 2 Type II / ISO 27001 — Qualflare does not currently hold a SOC 2 Type II or ISO 27001 certification. Pursuing independent third-party attestation is on the roadmap and this Annex will be updated when a certification is obtained.

The following Sub-processors process Customer Personal Data on Qualflare's behalf in connection with the Services. Customer authorises each of them as at the effective date of this DPA.

Changes are recorded in the sub-processor change record at Section 8.7 at least 30 days before a new Sub-processor begins Processing, in accordance with Section 8.

Notes:

• Ory Kratos (the authentication component) is self-hosted by Qualflare inside Google Cloud's europe-central2 region and is therefore not a Sub-processor; it forms part of Qualflare's own Processing.
• Qualflare does not itself contract with Amazon Web Services or any other US-based hyperscaler besides Google Cloud and Cloudflare as described above. Some Sub-processors run on infrastructure Qualflare does not select: LangWatch (row 10) hosts in EU data centers on AWS, and the model providers in rows 3, 12 and 13 operate their own.