1. What is a DPA?
A Data Processing Agreement is a contract between a data controller (you) and a data processor (us), as required by Article 28 of the GDPR and similar regulations.
2. Subject matter and duration
This DPA covers processing of personal data submitted through your collection forms and stored in your workspace, for as long as you maintain an active account.
3. Nature and purpose
We process personal data to collect testimonials, display them via widgets or Wall of Love once you approve them, store associated media, and provide moderation, analytics, and account features.
4. Categories
Data subjects: your customers who submit through your forms.
Data processed: name, title, company, email (where collected), headshot, written response or video, star rating, optional social link.
5. Our obligations as processor
- Process only on your documented instructions as expressed through the product
- Staff with access are bound by confidentiality
- Appropriate security measures — see Security
- Notify you without undue delay of a personal data breach affecting your workspace
- Assist with data subject requests
- Delete or return personal data at the end of the relationship except where law requires retention
6. Sub-processors
- Railway Corporation — hosting and database (United States)
- Cloudflare, Inc. — object storage and marketing CDN
- Resend — transactional email
- Stripe, Inc. — payment processing
We'll notify customers of material changes with reasonable advance notice.
7. Your rights as controller
Access, export, or delete testimonial data from the dashboard. Otherwise email privacy@qintr.com.
8. International transfers
Where required, we rely on Standard Contractual Clauses and other safeguards.
9. Contact
privacy@qintr.com. For a signed negotiated DPA, email hello@qintr.com.