Data Processing Agreement
This DPA has 2 parts: (1) the Key Terms on this page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1 ("DPA Standard Terms"), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, this page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on this page. However, if this page omits or does not define a highlighted word, the default meaning will be "none" or "not applicable" and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.
Key Terms
| Term | Details |
|---|---|
| Provider | Quickserve AI Inc DBA withQ |
| Customer | The entity that has entered into the Agreement with Provider |
| Agreement Reference | To sales contract will be set when sending agreement |
| Approved Subprocessors | The current list of Approved Subprocessors is published on the Provider's Trust Portal: https://security.qconcierge.io |
| Provider Security Contact | security@withq.ai |
| Security Policy | The Provider's security program is governed by its security policies (including the Access Management, Incident Response, Business Continuity and Disaster Recovery, and Data Management and Retention policies), all of which are available on request through the Provider's Trust Portal: https://security.qconcierge.io |
| DPA Covered Claim | The Agreement includes an additional Provider Covered Claims for any action, proceeding, or claim arising out of or relating to (1) Provider's breach or alleged breach of the DPA, or (2) Provider's gross negligence or willful misconduct, in each case, that results in a Security Incident. |
| Service Provider Relationship Restricted Transfers | To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq ("CCPA") applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA. |
| Governing Member State | EEA Transfers: Netherlands; UK Transfers: England and Wales |
Annex I(A) List of Parties
Data Exporter
- Name: The Customer
- Activities relevant to transfer: See Annex I(B)
- Role: Controller
Data Importer
- Name: Quickserve AI Inc DBA withQ
- Contact person: Alexander Ackerman, CTO & DPO
- Address: 1140 Harrison St Ste 434, San Francisco, California 94103, USA
- Activities relevant to transfer: See Annex I(B)
- Role: Processor
Annex I(B) Description of Transfer and Processing Activities
| Item | Details |
|---|---|
| Service | The withQ AI Platform, a hosted SaaS solution providing voice first AI-driven guest communication services |
| Categories of Data Subjects | Customer's end users or customers; Customer's employees |
| Categories of Personal Data | Name; Contact information such as email, phone number, or address; User activity and analysis such as device information or IP address; Reservation and Stay Details (including room numbers, stay dates, and confirmation codes); Guest Communications Content (including raw audio recordings and verbatim transcripts of voice or text interactions); Guest Preferences and Profile Data (including dietary restrictions, service requests, and interaction summaries) |
| Special Category Data | Is special category data (as defined in Article 9 of the GDPR) Processed? Yes |
| Special Category Data Restrictions or Safeguards | See Security Policy |
| Frequency of Transfer | Continuous |
| Nature and Purpose of Processing | Receiving data, including collection, accessing, retrieval, recording, and data entry; Holding data, including storage, organization, and structuring; Using data, including analysis, consultation, testing, automated decision making, and profiling; Updating data, including correcting, adaption, alteration, alignment, and combination; Protecting data, including restricting, encrypting, and security testing; Sharing data, including disclosure, dissemination, allowing access, or otherwise making available; Returning data to the data exporter or data subject; Erasing data, including destruction and deletion |
| Duration of Processing | Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws. Retention and deletion of Customer Personal Data follow Annex R (Retention Schedule). |
Annex I(C) Competent Supervisory Authority
The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II Technical and Organizational Security Measures
See Security Policy available at https://security.qconcierge.io
Annex R. Retention Schedule
Version 1.0. This version takes effect on the date Provider publishes it. Provider keeps every earlier version available.
Part 1. How the periods work
These rules apply to every period in Part 2 and to every setting Customer chooses.
1. Definitions.
- Guest: a Data Subject who calls, messages, books or stays at one of Customer's hotels.
- Booking: a Guest's reservation of a stay. Stay: the Guest's actual presence at the hotel.
- Anchor: for a conversation, the latest of the time the conversation ended and the check-out date of any Booking or Stay linked to it. A cancelled Booking counts. A linked date more than 3 years after the conversation is treated as an error and is not used.
- Last Contact: the latest of a Guest's conversations with, Bookings at, and Stays at any of Customer's hotels.
- Collected: the latest time Provider received a value from the Guest or from Customer's systems.
- Period: the time by which data is deleted from Provider's active systems.
- Limit: the longest Provider keeps data in its active systems, counted from the conversation, message, creation or collection. Copies in backups follow Part 1 item 7.
- GDPR mode: the settings that apply where Customer's processing of Guest data is subject to the EU or UK General Data Protection Regulation, and where Customer chooses them.
2. Calendar. A period of N days ends N × 24 hours after it starts. A period of N months or years ends on the same calendar day and time, in UTC, N months or years later, or on the last day of that month if it has no such day.
3. Two steps. Data will be hidden from every user of the service 7 days before its Period ends. It will be deleted from active systems by the end of its Period.
4. Limits. Data is deleted at the end of its Period or its Limit, whichever comes first. Only a legal hold, a period the law requires, or a test case under item 12 keeps data past its Limit.
5. Daily run. Provider will apply this schedule at least once a day.
6. Chat. Each chat message has its own clock.
7. Backups. Deleted data will leave Provider's backups within 30 days after its deletion from active systems. A restore from a backup will re-apply every deletion made since that backup was taken.
8. Changes to a period. A shorter period applies to data already held, from the next daily run. A longer period applies only to data collected after it takes effect.
9. Minimums. No period may be set shorter than the GDPR-mode default of its row. Call recordings are never kept less than 90 days. A minimum never stops Provider from deleting specific data on Customer's instruction.
10. Subprocessors. Our voice, AI and messaging providers process conversations to provide the service. How long each one keeps a copy depends on its own settings and terms.
11. End of the Agreement. Customer may export its data for 30 days after the Agreement ends. Provider deletes Customer Personal Data from active systems by day 60 and from backups by day 90. This covers every category in Part 2, service logs that hold Guest content, and Customer's staff data. Provider deletes earlier on Customer's written request.
12. Test cases. A test case is a copy of a conversation that Customer selects to test and tune its own assistant. It follows the Test cases row of Part 2 instead of the row of its source category, so its transcript or messages may be kept past their own Limit until Customer removes the case or the Agreement ends. A call recording keeps its own Limit inside a test case. A test case is never used to train a model or for another customer.
Part 2. Defaults and ranges
"After the Anchor" and "after Last Contact" use the definitions in Part 1. Each Limit holds under every setting.
| Category | US default | GDPR-mode default | Customer may set | Limit |
|---|---|---|---|---|
| Call recordings, in every stored version | 1 year after the Anchor | 90 days after the Anchor | 90 days to 1 year after the Anchor | 2 years after the call |
| Transcripts of calls, including copies in search indexes | 3 years after the Anchor | 6 months after the Anchor | 6 months to 3 years after the Anchor | 4 years after the call |
| Summaries and extracted details (conversation summaries, analysis, notes, special requests, the conversation summary on a Booking, support tickets raised from a conversation) | 3 years after Last Contact | 6 months after the Anchor | From 6 months after the Anchor to 5 years after Last Contact | 5 years after creation |
| Chat messages (web chat, text message, messaging apps) and the assistant's memory of them | 3 years after each message | 6 months after each message | 6 months to 3 years after each message | 3 years after the message |
| Guest profile and contact details, including identifying fields on conversation records. After the Period, identifying and contact fields are deleted and Booking reference numbers remain | 3 years after Last Contact | 3 years after Last Contact | 3 to 5 years after Last Contact | 5 years after each value was Collected |
| Enrichment (attributes added to a profile from Customer's systems or other sources on Customer's instruction) | As the Guest profile | Created only on Customer's instruction; as the Guest profile | On or off | As the Guest profile |
| Booking and Stay records. Identifying fields follow the Guest profile | Term of the Agreement | Term of the Agreement | Not configurable | 5 years after check-out |
| Payment tokens and masked card details | 90 days after check-out or cancellation | 90 days after check-out or cancellation | 90 days to 13 months after check-out or cancellation | 13 months after check-out or cancellation |
| Derived data (embeddings and other representations of Guest data) | De-identified form only; otherwise deleted with its source | De-identified form only; otherwise deleted with its source | Not permitted: deleted with its source | Never outlives its source in identifiable form; at the end of the Agreement, deleted unless it is aggregated, permanently de-identified Usage Data, never Customer Content |
| Test cases (conversations kept to test and tune Customer's own assistant; Customer Content, stored separately per customer, used only to tune Customer's own prompts, never to train a model) | Term of the Agreement | Term of the Agreement, with Guest identifiers removed | Off; or removal of any case at any time | End of the Agreement, under Part 1 items 11 and 12 |
| Exports and support attachments | Exports 30 days; support attachments 1 year after the ticket closes | Same | Not configurable | As the default |
| Service logs and agent working data | Logs 1 year, with names, addresses, email addresses and phone numbers masked; agent working data 30 days | Same | Not configurable | 1 year |
Other Changes to Standard Terms
Modification to Section 7.2 (Deletion at DPA Expiration)
Notwithstanding anything to the contrary in Section 7.2(a), the parties agree that Provider's obligation to return or delete Customer Personal Data upon expiration or termination of the Agreement shall not apply to aggregated, permanently de-identified "Usage Data" (as defined in the Agreement), never Customer Content.
Additional Processing Instructions (Section 2.2) and Status of De-identified Data
Pursuant to Section 2.2(d), Customer instructs Provider that only aggregated, permanently de-identified Usage Data, never Customer Content, may be used to develop, train or improve the artificial intelligence or machine learning models that are part of Provider's products and services. Once Usage Data has been aggregated and permanently de-identified, it does not constitute "Customer Personal Data" or "Personal Data" under this DPA, provided Provider implements technical controls to prevent re-identification.
Additional Security Measure (Data Lifecycle and Retention)
(a) Provider keeps Customer Personal Data for the periods in Annex R (Retention Schedule) and then deletes it. Provider de-identifies data only where this DPA permits it and Provider can show that the result is de-identified.
(b) Customer may set periods within the ranges in Annex R Part 2, by Order Form or by a written instruction signed by an authorised contact. Each setting is Customer's documented instruction. Provider will carry out each such instruction and will not change a period on its own initiative.
(c) Annex R Part 1 applies to every period, whatever Customer sets.
(d) A shorter period applies to data Provider already holds, from Provider's next daily run. A longer period applies only to data collected after it takes effect.
(e) Provider may publish new versions of Annex R. A new version applies to Customer without Customer's written agreement only where it shortens Customer's periods or makes Part 1 more protective of Data Subjects.
(f) Provider informs Customer promptly if, in Provider's opinion, a retention instruction infringes Applicable Data Protection Law.
(g) A legal hold suspends deletion of the data it names. Each hold records its reason and a review date, and lasts until it is released.
(h) Provider deletes specific Customer Personal Data on Customer's instruction at any time, including to answer a Data Subject's request. No minimum in Annex R prevents it.
(i) Customer is responsible for informing Data Subjects of the retention periods that apply to them. Provider makes an optional notice template available. Customer decides whether and how to use it.
(j) Where Customer and Provider have signed a separate data processing agreement that sets retention periods, those periods govern. Otherwise, for retention, the following apply in this order: (1) Annex R Part 1; (2) the Order Form; (3) Annex R Part 2 and the rest of this DPA; (4) the Agreement.
Provider and Customer have not changed the Standard Terms, except for the details on this page above.