Data Processing Addendum

The Merchant is controller for personal data of its own customers, consignees, payers and other end users that the Merchant uploads, imports or otherwise supplies to QrX so that QrX can provide Payment on Delivery, shipping, returns, PIN delivery and related Services. QrX is processor for that data. QrX is controller for Merchant account data, billing, platform security, website analytics (where applicable) and support communications with the Merchant's staff, as described in the Privacy Policy. Licensed payment service providers may act as independent controllers for payment data under their own terms.

The subject matter is the processing of personal data needed to provide the QrX Services the Merchant has enabled, including creating transactions, generating QR payment links, collecting Payment on Delivery through PSPs, shipping labels and tracking, PIN and transactional messaging, and returns. Processing lasts for the term of the Merchant's agreement with QrX and any period required to delete or return the data afterwards, including statutory retention that QrX must observe as a Dutch company.

• •Consignees, payers and other consumers of the Merchant whose details are used for delivery, payment at the door, PIN codes or returns.
• •Contacts at the Merchant's organisation who operate the QrX account (for processor activities that concern those contacts only where they appear in a shipment or payment record).
• •Any other natural persons whose data the Merchant chooses to submit to the Services.

• •Identity and contact data: name, address, email, phone number, language preference.
• •Order and logistics data: order reference, parcel identifiers, tracking status, delivery time window, return reason.
• •Payment-flow data processed to complete Payment on Delivery (amount, currency, payment status, method). Card numbers and authentication secrets are handled by the PSP, not stored by QrX as processor.

QrX processes the data only to perform the Services, including hosting, displaying the consumer payment page, confirming payment, notifying the Merchant and carriers, delivering PIN codes, producing labels and reports, and providing support on the Merchant's request. QrX does not sell consignee data and does not use it for QrX's own marketing.

QrX processes personal data only on documented instructions from the Merchant, including the configuration the Merchant sets in the QrX portal, API calls the Merchant or its systems send, and this DPA, unless EU or Dutch law requires otherwise. In that case QrX informs the Merchant of that legal requirement before processing, unless the law prohibits that information. The Merchant warrants that its instructions are lawful and that it has a valid legal basis (and any required consumer notices) for the processing.

QrX ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

QrX implements appropriate technical and organisational measures under Article 32 GDPR, including TLS 1.2 or higher in transit, encryption at rest for primary datastores, HMAC-signed API requests, role-based access, multi-factor authentication for portal users, tenant scoping of Merchant data, PCI DSS handling of card data by licensed PSPs (QrX does not store raw card numbers), logging and vulnerability monitoring, and encrypted backups. The Merchant is responsible for the security of its own passwords, API keys and the devices it uses.

The Merchant gives QrX a general written authorisation to engage sub-processors in the categories below. QrX will impose data-protection obligations on each sub-processor that are no less protective than this DPA. QrX remains fully liable to the Merchant for the sub-processor's performance of those obligations. QrX will inform the Merchant of intended additions or replacements of sub-processors by updating this page. The Merchant may object on reasonable data-protection grounds within 14 days. If the parties cannot resolve the objection, the Merchant may terminate the affected Service.

• •Google Cloud and Firebase (hosting, runtime, storage, push), typically in the EEA.
• •Mollie, Stripe and MultiSafepay (payment collection and settlement). These PSPs often act as independent controllers for payment data.
• •Bird / MessageBird (SMS, WhatsApp and related messaging, including PIN delivery).
• •SendGrid (transactional email).
• •UPS and other carriers the Merchant selects for a shipment (transport of the parcel).
• •Sentry (application error monitoring).
• •Intercom (Merchant support conversations).

Carrier and PSP processing also follows the Merchant's own contracts with those parties where the Merchant has a direct relationship.

QrX hosts primary production data in the EEA. If a sub-processor transfers personal data outside the EEA, QrX ensures a valid transfer mechanism is in place, in particular the European Commission's Standard Contractual Clauses, an adequacy decision, or another mechanism permitted by Chapter V GDPR, plus supplementary measures where required.

Taking into account the nature of the processing, QrX assists the Merchant by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Merchant's obligation to respond to requests to exercise data-subject rights under Chapter III GDPR. QrX also assists the Merchant with Articles 32 to 36 GDPR (security, personal-data-breach notification to the authority and to data subjects, data protection impact assessments and prior consultation), taking into account the information available to QrX.

QrX will notify the Merchant without undue delay after becoming aware of a personal data breach affecting data processed under this DPA, and in any event in a timeframe that allows the Merchant to meet the 72-hour notification duty under Article 33 GDPR where applicable. The notice will describe, as far as reasonably known: the nature of the breach, likely consequences, measures taken or proposed, and a contact point. QrX will not notify data subjects or the AP on the Merchant's behalf unless the Merchant instructs QrX to do so or the law requires QrX to notify.

After the end of the provision of processing services, QrX will, at the choice of the Merchant, delete or return all personal data processed as processor, and delete existing copies, unless EU or Dutch law (including tax and anti-money-laundering record-keeping, typically up to seven years) requires storage. Backups expire on the backup rotation cycle. Merchant account, invoice and legally required transaction records that QrX holds as controller are retained under the Privacy Policy, not this deletion choice.

QrX makes available to the Merchant information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Merchant or another auditor mandated by the Merchant. Audits take place on reasonable written notice, during business hours, no more than once per 12 months unless a competent authority or a documented breach requires more, and in a way that does not disrupt QrX operations or other customers. QrX may satisfy an audit request by providing up-to-date security summaries, certificates or third-party audit reports where these reasonably address the request.

Liability under this DPA follows the liability and indemnification clauses of the QrX Terms and Conditions, except where mandatory GDPR liability (including Article 82) cannot be limited. Each party remains responsible for its own GDPR role: the Merchant as controller, QrX as processor.

This DPA is governed by Dutch law. The courts of Gelderland, the Netherlands, have exclusive jurisdiction, unless mandatory law provides otherwise. If a translation of this DPA conflicts with the Dutch text, the Dutch text prevails.