Effective date: October 13, 2026 · Last updated: October 13, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Quiriz Systems Inc., a corporation incorporated in British Columbia, Canada ("Quiriz"), and the company that holds a Quiriz account ("Customer"). It applies whenever Quiriz processes personal data on Customer's behalf, including data Customer uploads and data Customer imports through a connector such as Shopify, HubSpot, Google or Meta. It takes effect when Customer accepts the Terms of Service; no signature is needed. A countersigned copy is available on request at privacy@quiriz.co.
Customer is the controller of that personal data, or a processor acting for its own clients (for example, an agency serving a merchant). Quiriz is Customer's processor, or sub-processor, and a "service provider" under the California Consumer Privacy Act.
"Personal Data", "Processing", "Controller", "Processor" and "Data Subject" have the meanings given in the applicable Data Protection Laws. "Data Protection Laws" means the laws that apply to the processing: the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Canada's PIPEDA, and US state privacy laws including the CCPA. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data. "Sub-processor" means a third party Quiriz engages to process Customer Personal Data.
| Item | Description |
|---|---|
| Subject matter | Providing the Quiriz service: storing Customer's datasets, answering questions about them, and producing reports, charts and documents. |
| Duration | The term of Customer's account, then until deletion under Section 9. |
| Nature and purpose | Storage, import, transformation, analysis and AI-assisted reporting, only to provide the service to Customer. |
| Data subjects | Customer's own customers, prospects, contacts and website visitors, and Customer's users of Quiriz. |
| Categories of data | Whatever Customer uploads or connects. For connectors, the categories listed in Section 7 of the Privacy Policy. For Shopify: order amounts, line items, refunds, products, and each customer's id, order count and total spent; never names, email addresses, phone numbers or postal addresses. |
| Special categories | Not permitted. The Terms of Service prohibit uploading sensitive personal data. |
Customer authorizes Quiriz to use the sub-processors listed in Section 6 of the Privacy Policy. Quiriz binds each one by written terms that protect Customer Personal Data at least as well as this DPA, and remains responsible for their performance. Quiriz will notify Customer's account administrators by email at least 14 days before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may close its account and receive a pro-rata refund of prepaid fees for the unused period.
Quiriz will promptly forward to Customer any request it receives from a Data Subject about Customer Personal Data, and will help Customer respond to access, correction, deletion, portability and objection requests. Customers can delete or export their datasets at any time. When a Shopify store owner asks Shopify to erase a customer, Quiriz removes that customer's id from the store's datasets automatically.
Quiriz will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe the incident, the data and Data Subjects affected, the likely consequences, and the measures taken or proposed. Quiriz will take reasonable steps to contain the incident and help Customer meet its own notification duties.
Quiriz will give Customer reasonable help with data protection impact assessments and with consultations with supervisory authorities, to the extent they concern Quiriz's processing.
Customer can export its data at any time. Disconnecting a connector deletes the datasets imported through it unless Customer chooses to keep them. When a Shopify store uninstalls Quiriz, Quiriz deletes that store's datasets once Shopify notifies it. When Customer's account ends, Quiriz deletes Customer Personal Data within 30 days, except where the law requires it to be kept.
On written request, no more than once a year (or after a Security Incident), Quiriz will give Customer the information reasonably needed to show compliance with this DPA, including written answers to a reasonable security questionnaire. Audits beyond that are at Customer's cost, on reasonable notice, and under confidentiality.
Quiriz and its sub-processors store and process Customer Personal Data in the United States (see Section 4 of the Privacy Policy). For personal data transferred from the European Economic Area, the parties agree to the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, which are incorporated into this DPA by reference: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor. For those Clauses: the optional docking clause (Clause 7) does not apply; Clause 9 uses Option 2 (general authorization, with the notice period in Section 5); the optional language in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and Annexes I and II are completed by Sections 3 and 11 of this DPA. For personal data from the United Kingdom, the UK International Data Transfer Addendum to those Clauses applies, and for personal data from Switzerland, the Clauses apply with references read as references to the Swiss Federal Act on Data Protection.
Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.
Questions about this DPA, or a request for a countersigned copy: privacy@quiriz.co