DPA - Enterprise

1. Purpose and incorporation

This Data Processing Agreement ("DPA") applies to the extent ZeroEnd Technology AB (Sweden), doing business as QuantCAD ("Company", "we", "us", "our") processes Customer Personal Data (as defined below) on behalf of an enterprise customer ("Customer") in connection with the Services.

This DPA is incorporated by reference into the enterprise master services agreement, order form, or similar written agreement between Customer and Company governing the Services (the "Agreement"). This DPA is effective on the effective date of the Agreement (the "Effective Date"). Publication of this standard-form DPA on the Site does not by itself create an enterprise customer relationship or separate data-processing agreement unless it is incorporated into, or signed with, an Agreement.

If there is a conflict between this DPA and the Agreement relating to the processing of Customer Personal Data, this DPA controls. Any conflict between this DPA and the Standard Contractual Clauses (if applicable) is resolved according to the Standard Contractual Clauses.

1.1 Geographic availability of the Enterprise offering

Our Enterprise offering — including this DPA, signed enterprise master agreements, custom procurement, and named-account sales support — is currently offered only to customers established in the EEA or the UK. Enterprise sales and DPA execution are not currently available to customers in the United States or Canada. New self-serve account creation and self-serve purchases are also not currently available to users located in the United States or Canada; those visitors are redirected to our waitlist. This is a temporary launch-readiness decision and does not reflect any limitation on the security or privacy posture of the Service. US and Canadian public-site, cookie, waitlist, contact, and marketing interactions are governed by the Privacy Policy, US State Privacy Notice, and Canadian Privacy Notice.

If you are an EEA/UK enterprise prospect, please request a DPA via Support Ticket → Privacy & Compliance. This version is not intended to be a California CCPA/CPRA service-provider addendum, a US state processor addendum, or a Canadian PIPEDA / Quebec Law 25 service-provider agreement. We may, in a future release, extend Enterprise availability to US and Canadian customers; this DPA will be supplemented or replaced at that time with US-specific service-provider / processor language and Canadian service-provider language as appropriate.

2. Definitions

For purposes of this DPA:

• “Applicable Data Protection Law” means all laws and regulations applicable to the processing of personal data under the Agreement, including (as applicable) the EU GDPR, UK GDPR, Swiss FADP, and implementing laws.
• “Customer Personal Data” means personal data that Company processes as a processor on behalf of Customer in connection with the Services. Customer Personal Data does not include Business Relationship Data or other personal data Company processes as an independent controller.
• “Business Relationship Data” means business-contact, billing, contract-administration, security, account-management, support, and compliance data that Company processes as an independent controller for its own relationship with Customer and Customer's authorized users, as described in the Privacy Policy.
• “EU GDPR” means Regulation (EU) 2016/679.
• “UK GDPR” means the EU GDPR as incorporated into UK law (as amended).
• “Personal Data Breach” has the meaning set out in EU GDPR Article 4(12).
• “Processing” (and “process”) has the meaning set out in EU GDPR Article 4(2).
• “Subprocessor” means a third party engaged by Company to process Customer Personal Data.
• “Standard Contractual Clauses” or “SCCs” means the EU standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, as updated or replaced.

Other capitalized terms used but not defined in this DPA have the meanings given in the Agreement or Applicable Data Protection Law.

3. Roles and scope

3.1 Controller and processor

Between the parties:

• Customer is the controller (or “business”, where applicable) of Customer Personal Data.
• Company is the processor of Customer Personal Data.

Each party will comply with Applicable Data Protection Law as it applies to them.

3.2 Customer instructions

Company will process Customer Personal Data only:

• to provide, maintain, secure, and support the Services under the Agreement;
• on Customer’s documented instructions; and
• as required by applicable law (in which case Company will notify Customer of that legal requirement unless prohibited by law).

Customer's documented instructions include the Agreement, this DPA, Customer's configuration and use of the Services, and written instructions submitted through an authorized support or enterprise channel. Company will promptly inform Customer if, in Company's reasonable opinion, an instruction infringes Applicable Data Protection Law. Company is not required to follow an instruction that would violate applicable law or materially compromise the security or integrity of the Services.

The subject matter, nature, and purpose of processing, categories of personal data, and categories of data subjects are described in Annex 1.

3.3 Customer responsibilities

Customer is responsible for:

• ensuring that its instructions and use of the Services comply with Applicable Data Protection Law;
• providing any notices and obtaining any consents required for Customer’s collection and use of Customer Personal Data; and
• ensuring that Customer Personal Data it provides to Company is accurate and up to date to the extent required;
• determining whether the Services are appropriate for the sensitivity and regulatory status of the data Customer submits;
• not submitting special-category data, children's data, payment-card data, export-controlled technical data, or other regulated/high-risk data unless expressly agreed in writing with appropriate safeguards; and
• complying with any laws that apply to Customer's own use of AI systems, CAD outputs, product designs, or downstream deployment of the Services.

3.4 No training on enterprise Customer Personal Data (unless opt-in)

Company will not use Customer Personal Data to train, fine-tune, or improve generalized machine-learning or AI models, except where Customer explicitly opts in in writing (for example in an enterprise addendum or an opt-in program).

This restriction does not prevent Company from processing Customer Personal Data to provide the Services, including performing operations requested by Customer (such as generating outputs based on Customer inputs), and performing security, abuse prevention, debugging, and reliability activities consistent with Customer’s instructions and the Agreement.

3.5 No sale, sharing, or secondary use

Company will not sell Customer Personal Data, share Customer Personal Data for cross-context behavioral advertising, or process Customer Personal Data for Company's own unrelated marketing purposes. Company may process Business Relationship Data as an independent controller as described in the Privacy Policy.

4. Confidentiality

Company will ensure that any person authorized to process Customer Personal Data is bound by appropriate confidentiality obligations (whether contractual or statutory) and processes Customer Personal Data only as necessary to provide the Services.

5. Security measures

Company will implement and maintain appropriate technical and organizational measures (“TOMs”) designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

Company’s TOMs are described in Annex 2 (and may be updated over time consistent with industry standards, provided that updates do not materially decrease overall security).

Customer is responsible for configuring the Services securely, managing authorized-user access, protecting credentials, and promptly notifying Company of suspected unauthorized use of Customer accounts.

6. Subprocessing

6.1 Authorized subprocessors

Customer gives Company a general written authorization to engage Subprocessors to process Customer Personal Data, including those listed in Annex 3, subject to the notice and objection process in Section 6.3.

6.2 Subprocessor obligations

Company will:

• enter into a written agreement with each Subprocessor imposing data protection obligations that are materially no less protective than those in this DPA (including confidentiality and security);
• remain responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law; and
• restrict Subprocessor access to the minimum necessary to perform their services.

6.3 Changes to subprocessors; objection

Company may add or replace Subprocessors from time to time. Company will provide Customer with advance notice of material changes to Subprocessors where required by Applicable Data Protection Law. Unless a shorter period is required for security, continuity, legal compliance, or emergency reasons, Company will use commercially reasonable efforts to provide at least 15 days' advance notice before a new Subprocessor processes Customer Personal Data.

If Customer reasonably objects to a new Subprocessor on documented data-protection grounds, Customer will notify Company promptly and in any event before the end of the notice period. The parties will work in good faith to resolve the objection (for example by using an alternative provider where feasible). If the parties cannot resolve the objection, Customer may terminate the affected Services in accordance with the Agreement, and Company will refund any prepaid fees for the terminated portion to the extent required by the Agreement or Applicable Data Protection Law.

Company is not required to suspend or degrade the security, reliability, or legal compliance of the Services while an objection is pending.

7. Assistance to Customer

7.1 Data subject requests

Taking into account the nature of the processing, Company will provide reasonable assistance to Customer to respond to requests from data subjects to exercise their rights under Applicable Data Protection Law (such as access, deletion, or objection), to the extent Customer cannot do so through the Services.

If Company receives a data subject request relating to Customer Personal Data, Company will (where legally permitted) direct the request to Customer and will not respond to the request except on Customer’s documented instructions or as required by law.

7.2 DPIAs and prior consultation

Company will provide reasonable assistance to Customer with data protection impact assessments (“DPIAs”) and prior consultations with regulators where required under Applicable Data Protection Law, taking into account the information available to Company and the nature of the processing.

7.3 Security information

Upon reasonable request, Company will make available information reasonably necessary to demonstrate compliance with this DPA (for example security summaries, policies, or third-party audit materials, if available), subject to confidentiality restrictions.

7.4 Security, breach, and regulatory assistance

Taking into account the nature of processing and the information available to Company, Company will provide reasonable assistance to Customer with Customer's obligations under Articles 32 to 36 GDPR / UK GDPR (security of processing, Personal Data Breach notification, DPIAs, and prior consultation), to the extent Customer cannot reasonably meet those obligations without Company's assistance.

8. Personal Data Breaches

Company will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data and will use commercially reasonable efforts to provide initial notice within 48 hours where feasible. In any event, Company will provide notice within 72 hours of becoming aware unless a shorter period is required by the Agreement or Applicable Data Protection Law.

Company’s notification will include, to the extent known and reasonably available:

• the nature of the Personal Data Breach (including categories and approximate number of affected data subjects and records);
• likely consequences of the Personal Data Breach; and
• measures taken or proposed to address the Personal Data Breach, including measures to mitigate possible adverse effects.

Company will take reasonable steps to contain, investigate, and remediate the Personal Data Breach and will provide reasonable cooperation to Customer to enable Customer to meet its breach notification obligations.

Company's notification or response to a Personal Data Breach is not an admission of fault, liability, or violation of law. Customer is responsible for determining whether and how to notify data subjects, supervisory authorities, customers, or other third parties, except to the extent Applicable Data Protection Law imposes a direct notification obligation on Company.

9. International transfers

Customer acknowledges that Company and its Subprocessors may process Customer Personal Data in countries outside the EEA/UK/Switzerland, including the United States.

Where a transfer of Customer Personal Data to a country lacking an adequacy decision requires appropriate safeguards under Applicable Data Protection Law, the parties agree that such transfers will be governed by:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (Controller to Processor) where Customer exports Customer Personal Data to Company as processor, and Module Three (Processor to Processor) where Company exports Customer Personal Data to a Subprocessor; and/or
• the UK Addendum to the EU Standard Contractual Clauses (where applicable); and/or
• the Swiss amendments required for transfers subject to the Swiss FADP (where applicable); and/or
• other valid transfer mechanisms recognized under Applicable Data Protection Law.

For the SCCs, the parties select Clause 9(a), Option 2 (general written authorization for subprocessors); the notice period is the period stated in Section 6.3. The competent supervisory authority for EU transfers involving Company is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten / IMY) unless the SCCs require another authority. For Clause 17 and Clause 18, the governing law and forum are Sweden unless the SCCs require otherwise for a particular transfer.

The information in Annexes 1, 2, and 3 is intended to populate the SCC Annexes. For UK transfers, the information in this DPA is intended to populate the UK Addendum tables, with the EU SCCs incorporated as the Approved EU SCCs and neither party selecting optional docking unless expressly agreed. For Swiss transfers, references to the GDPR in the SCCs are interpreted to include the Swiss FADP, and the Swiss Federal Data Protection and Information Commissioner is the competent authority where required.

Company will implement supplementary measures where required following transfer-impact assessment, such as encryption in transit and at rest where supported, access controls, data minimization, vendor due diligence, and contractual restrictions on onward transfers and government-access requests.

For convenience and to keep this web version concise, the SCCs and any addenda are incorporated by reference and will be provided as executed documents as part of the enterprise contracting process where required. Provider certifications, Data Privacy Framework status, and transfer mechanisms must be verified during contracting because they can change.

10. Deletion or return of Customer Personal Data

Upon termination or expiry of the Agreement, Company will, at Customer’s choice (as specified in the Agreement or upon written request), delete or return Customer Personal Data.

Unless otherwise agreed in writing, Company will delete Customer Personal Data from active systems within 30 days after termination/expiry, subject to:

• retention required by applicable law; and
• residual copies in backups, which will be deleted according to Company’s backup rotation schedule (typically within up to 30 days), and will not be restored except as part of disaster recovery, security, or legal-compliance needs.

Customer is responsible for exporting Customer Personal Data before termination where the Services provide export functionality. Upon request, Company will provide reasonable confirmation of deletion once deletion is complete. This Section does not require Company to delete anonymized data that no longer identifies or relates to an identifiable person, or Business Relationship Data that Company must retain as an independent controller.

11. Audits

Company will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, as required by Applicable Data Protection Law, subject to reasonable safeguards to protect security, confidentiality, trade secrets, and the rights of other customers.

Where possible and consistent with best practice, audits will be conducted:

• no more than once per 12-month period (unless required by a regulator or following a confirmed Personal Data Breach);
• with reasonable advance notice;
• during normal business hours; and
• in a manner that minimizes disruption.

Company may satisfy audit requests by providing third-party certifications or audit reports (if available), security summaries, penetration-test summaries, and/or responding to reasonable security questionnaires, except where an on-site audit is required by Applicable Data Protection Law or a competent regulator.

Auditors must be independent, qualified, bound by confidentiality, and not direct competitors of Company unless required by a competent regulator. Audits may not include access to other customers' data, production systems, source code, non-public security tooling, employee personal data, or information that would materially weaken Company security. Customer is responsible for its audit costs unless the Agreement states otherwise.

12. Miscellaneous

12.1 Limitation of liability

Liability (including limitations and exclusions) is governed by the Agreement, except to the extent Applicable Data Protection Law requires otherwise.

12.2 No change to commercial allocation

This DPA addresses processing of Customer Personal Data. It does not grant additional rights in the Services or outputs, change intellectual-property ownership, create warranties, expand service commitments, or modify disclaimers, indemnities, governing law, dispute-resolution terms, or liability limits in the Agreement, except where Applicable Data Protection Law requires otherwise.

12.3 Order of precedence

This DPA forms part of the Agreement. If there is a conflict between this DPA and other documents forming part of the Agreement regarding processing of Customer Personal Data, the following order of precedence applies:

1. the Standard Contractual Clauses (if applicable);
2. this DPA; and
3. the rest of the Agreement.

Annex 1 — Details of processing

A. Subject matter and duration

Company processes Customer Personal Data to provide the Services under the Agreement. Processing continues for the term of the Agreement and any period thereafter as necessary for deletion/return described in Section 10.

B. Nature and purpose of processing

Processing activities may include:

• account provisioning and authentication;
• storing, organizing, and retrieving project records and messages;
• generating outputs based on customer inputs;
• providing exports and downloads;
• providing support and responding to requests;
• security controls (rate limiting, abuse prevention, and fraud detection);
• operational monitoring and incident response; and
• maintaining and improving reliability and performance (excluding AI training as restricted in Section 3.4 unless Customer opts in).

C. Categories of data subjects

Customer Personal Data may relate to:

• Customer’s employees, contractors, and other authorized users;
• Customer’s end users (if Customer provides end-user data to the Services); and
• other individuals whose data Customer submits to the Services.

D. Categories of personal data

Customer Personal Data may include:

• identifiers (names, usernames, user IDs);
• contact details (email address, company name);
• authentication/session metadata;
• content Customer submits to the Services (such as messages, prompts, attachments, project metadata, and other customer-provided information); and
• usage and technical data necessary to operate and secure the Services (such as timestamps, device/browser information, and IP address where required for security).

Customer Personal Data excludes Business Relationship Data that Company processes as an independent controller.

E. Special categories of personal data

The Services are not designed for processing special categories of personal data. Customer will not submit special categories of personal data or highly sensitive data (such as health data, biometric identifiers, information about children, payment-card data, government identifiers, export-controlled technical data, or regulated safety-critical data) unless expressly agreed in writing with appropriate safeguards.

Annex 2 — Technical and organizational measures (TOMs)

Company maintains a security program designed to protect Customer Personal Data. Measures may include:

• Access controls: least privilege, role-based access where applicable, and multi-factor authentication for administrative access.
• Authentication and account controls: session controls, credential-management practices, and administrative access review where applicable.
• Encryption: encryption in transit (TLS) and encryption at rest where supported by underlying storage systems.
• Segregation and tenant protection: logical controls designed to separate customer data and restrict access to authorized users and systems.
• Logging and monitoring: monitoring for availability and security events, and alerting for suspected incidents.
• Vulnerability management: patching practices and dependency/security review processes.
• Secure development: code review, dependency updates, and security-aware development practices proportionate to the stage and risk of the Services.
• Backups and recovery: routine backups and disaster recovery practices designed to restore availability.
• Data minimization: limiting internal access and retention to what is needed for the documented purposes.
• Personnel security: confidentiality obligations and security awareness for personnel with access.
• Vendor management: due diligence and contractual controls for Subprocessors.
• Incident response: procedures to assess, contain, investigate, and remediate suspected security incidents.

Company may update these measures over time to reflect evolving threats and industry standards.

Annex 3 — Subprocessors (as of the Last Updated date)

Subprocessors may vary depending on configuration and Customer usage. Current Subprocessor categories used to process Customer Personal Data are:

Category	Subprocessor	Role	Processing location	Transfer mechanism (where applicable)
Authentication	Clerk	Identity and user management	United States	EU SCCs (Module 2 / 3) and EU-US DPF (where certified)
Application hosting / CDN / edge platform	Vercel	Hosting, deployment, CDN/edge routing, serverless/edge request processing, and related platform logs	United States, EU, and global edge locations depending on deployment/routing	EU SCCs / UK Addendum where applicable; other valid transfer mechanisms where available
Database	Managed PostgreSQL provider	Primary application database	EU	N/A (intra-EEA)
Object storage	Object-storage provider	Storage of generated artifacts (STL/STEP, recipes)	EU (Frankfurt)	N/A (intra-EEA)
Workflow orchestration	Workflow-orchestration provider	Background jobs and event orchestration	United States	EU SCCs
Sandbox compute	Sandbox-compute provider	Sandbox execution for builds	United States	EU SCCs
Rate limiting / cache	Managed Redis / rate-limit provider	Abuse prevention and gating	EU	N/A (intra-EEA)
Email delivery (transactional)	Resend / transactional email provider	Sends service emails and support replies	United States	EU SCCs
Error monitoring	Sentry / error-monitoring provider (where configured)	Error and performance monitoring	EU or United States, depending on account region/configuration	EU SCCs where applicable
AI processing	OpenAI, Anthropic (as configured)	Inference for generation, evaluation, and safety; no training/fine-tuning on Customer Personal Data unless Customer explicitly opts in in writing	United States	EU SCCs and EU-US DPF where applicable/certified

Note on AI providers. Although OpenAI and Anthropic state by default that data sent through their APIs is not used to train their general models, fine-tuning models we deploy through their platforms may incorporate user-derived data into fine-tuned weights used to serve users. Customer Personal Data is not used for fine-tuning under this DPA except where Customer explicitly opts in in writing (see Section 3.4 of this DPA).

Independent controllers and out-of-scope providers. Payment processing by Stripe, bank/payment rails, professional advisers, insurers, and government authorities are not Subprocessors for Customer Personal Data under this DPA when they act as independent controllers. Business Relationship Data processed for billing, contract administration, legal compliance, and account management is handled under the Privacy Policy rather than this DPA.

Note on marketing-site providers. Components used solely on QuantCAD's public marketing pages — for example cookie-consent management, Vercel Web Analytics, other marketing-site analytics, and marketing-email delivery — do not process Customer Personal Data within the scope of this DPA unless the Customer intentionally routes Customer Personal Data through those public-site surfaces. Those providers are described separately in our Privacy Policy and Cookie Policy.

Named provider list. The named identity, version, and processing region of each provider used in the categories above is available to enterprise Customers and prospects on request (typically as part of the contracting or vendor due-diligence process). Contact us via Support Ticket and select Privacy & Compliance.

Changes to this DPA

We may update this DPA from time to time. The current version published on this page applies, except where Customer has signed a specific version or addendum, which controls for that Customer. For signed enterprise customers, material changes that materially reduce the level of protection for Customer Personal Data will apply only as permitted by the Agreement, the signed DPA/addendum, or Applicable Data Protection Law.

Past versions of this DPA are retained internally and are available on request via Support Ticket — select Privacy & Compliance.