Data Processing Addendum

1. What this is and when it applies

This Addendum forms part of the Terms of Service between Quorum Technologies GmbH ("Quorum", "we") and the Customer ("you"). It governs our processing of personal data contained in Customer Content, and it applies automatically whenever we process such data on your behalf. You do not need to sign it separately; accepting the Terms of Service accepts this Addendum.

Where this Addendum conflicts with the Terms of Service, this Addendum wins on data protection. Where the Standard Contractual Clauses referred to in clause 11 conflict with either, the Clauses win.

2. Who is what

For Customer Content, you are the controller and we are your processor. You decide which meetings are created, whose data goes in, which storage locations are connected, and which documents are used. We act on your instructions.

You are responsible for having a lawful basis for the processing you ask us to perform, and for telling the people concerned what they need to be told. This matters more here than in many services, because the documents Quorum reads can contain personal data about employees, clients, and other third parties who have no relationship with us and did not choose to use the product.

For a narrower set of things we decide ourselves — account administration, billing, security and abuse prevention, support correspondence, and our own website — we are a controller in our own right. Those are described in our Privacy Policy and are outside this Addendum.

Two companies involved in the service are neither our processors nor our subprocessors: Microsoft, which you reach through your own tenancy under your own agreement with them, and Stripe, which is a controller in its own right for payment processing. Clause 5 does not apply to either.

3. Our instructions

We process Customer Content only on your documented instructions, unless a law we are subject to requires otherwise, in which case we will tell you before processing unless that law forbids it.

Your instructions are: the Terms of Service, this Addendum, the configuration choices you make in the product, and any further written instruction you give us. Using the product is an instruction to do what the product does.

We do not use Customer Content to train, fine-tune or evaluate any model, and we do not contribute it to any shared or public dataset. Our model and speech providers are engaged on terms that forbid them from training on data we send. This is an unqualified commitment, not a setting.

If we think an instruction breaches data protection law, we will tell you. We may pause the affected processing while we resolve it with you.

4. Confidentiality

Everyone we allow to process Customer Content is bound by a written duty of confidentiality that survives the end of their engagement, and is given access only where they need it for the purpose in hand.

5. Security

We implement and maintain the technical and organisational measures set out in Annex II, which is a description of what is actually in place rather than a list of aspirations. We may change those measures, but not in a way that materially reduces the protection of Customer Content.

6. Subprocessors

You give us general authorisation to engage subprocessors. The ones engaged at the date of this Addendum are listed in Annex III.

Before we add or replace a subprocessor that processes Customer Content, we will give you at least 30 days' notice. You may object within that period on reasonable data protection grounds. If we cannot resolve your objection, you may terminate the affected subscription and we will refund fees paid for the remainder of its term.

Every subprocessor is engaged under a written contract imposing obligations no less protective than those in this Addendum. We remain fully liable to you for their performance.

7. Helping you answer people

The product gives you the controls to find, correct, export and delete Customer Content yourself, and that is the fastest route.

Where someone exercises a data protection right and you cannot resolve it with those controls, we will help you, taking into account the nature of the processing and the information available to us. If a request reaches us directly, we will not respond to it ourselves except to say that it has been passed to you, and we will pass it on without undue delay.

We do not charge for reasonable assistance of this kind.

8. Helping you with security, breaches and assessments

We will give you reasonable assistance with your obligations on security of processing, breach notification, data protection impact assessments, and prior consultation with a supervisory authority, taking into account what we know and what we process.

Annex II, our Privacy Policy, and our status page are intended to give you most of what an assessment needs without having to ask us.

9. If there is a breach

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Content.

The notification will describe what happened, the categories and approximate number of people and records affected, the likely consequences, and what we are doing about it. Where we do not have all of that at first, we will send what we have and follow up rather than wait.

Notifying you is not an admission of fault. We would rather tell you early.

10. Deletion and return

You can export or delete Customer Content in the product at any time while your subscription is active.

On termination, we delete Customer Content within 30 days, unless you ask us in writing before then to return it or to keep it for longer, or a law requires us to retain it.

Deletion removes content from the live service immediately. It persists in encrypted backups for up to 30 days before those age out and are overwritten. We would rather state that than imply the deletion is instant everywhere. While it remains in backup it stays encrypted and subject to this Addendum.

For files, deletion is reinforced by cryptography: when a tenancy ends, that tenant's key is destroyed, and its stored files cannot be recovered even from media that still holds them.

11. International transfers

Storage, database and application compute are in the European Union. Three subprocessors process data in the United States, and Annex III says which and why.

For those transfers:

• ElevenLabs is certified under the EU–US, Swiss–US and UK–US Data Privacy Framework, and we rely on that.
• OpenAI and Groq are not certified, and we rely on the Standard Contractual Clauses (Module Two, controller to processor) approved by the European Commission, together with the UK Addendum issued by the Information Commissioner and the amendments recognised by the Swiss Federal Data Protection and Information Commissioner.

Where you require it, the Standard Contractual Clauses are incorporated into this Addendum between you and us on the same basis, with Annex I, II and III below serving as their annexes. In that case: the optional docking clause applies, the audit and subprocessor terms are as set out above, and the governing law and forum follow clause 13.

You can ask us for a copy of the safeguards used for any particular transfer.

12. Audits and information

We will make available the information reasonably necessary to demonstrate our compliance with this Addendum, and will contribute to audits.

In practice we would rather answer with documents than with visits, so we will first offer our security documentation, Annex II, our status page record, and written answers to your questions. Where that genuinely does not answer what you need, you may audit us, or appoint an independent auditor who is not our competitor and who signs a confidentiality undertaking.

Audits are limited to once in any twelve months unless a supervisory authority requires more or we have had a personal data breach affecting your Customer Content. You will give us at least 30 days' notice, conduct the audit during business hours, and avoid disrupting the service or the confidentiality of other customers. You bear the cost, unless the audit finds a material breach of this Addendum, in which case we do.

13. Liability, term and law

Our liability under this Addendum is subject to the limits in the Terms of Service, except where those limits cannot be applied as a matter of law.

This Addendum lasts as long as we process Customer Content, and the obligations that by their nature should survive termination do so.

It is governed by the law and subject to the courts stated in the Terms of Service, except where the Standard Contractual Clauses require otherwise, in which case they prevail for the processing they cover.

Annex I — What we process

A. The parties

Controller (data exporter): the Customer, as identified in its Quorum account and its subscription.

Processor (data importer): Quorum Technologies GmbH, Heumattstrasse 18, 8906 Bonstetten, Switzerland, CHE-196.262.518. Contact: privacy@quorumtech.ch.

B. The processing

Subject matter. Preparing spoken briefings for meeting attendees from documents the Customer holds and calendar information the Customer connects.

Duration. For as long as the subscription lasts, plus the deletion period in clause 10.

Nature and purpose. Collection, retrieval, organisation, analysis, generation of derived text and audio, storage, transmission for playback, and deletion — all to produce and deliver briefings to the Customer's attendees.

Frequency. Continuous, for as long as meetings are scheduled.

Categories of data subject

• The Customer's own users and administrators
• Attendees of meetings, including people outside the Customer's organisation
• People named or described in the documents the Customer connects, including employees, clients and other third parties

Categories of personal data

• Identity and contact data: name, work email address, workspace and role
• Calendar data: meeting title, time, duration, attendee list, taken under the Calendars.ReadBasic.All permission only. We do not read mailboxes or message bodies.
• Document content from the storage the Customer connects, which may contain any personal data the Customer's own documents contain
• Generated material: briefing scripts, show notes and audio, one per attendee
• Technical data: IP address, device and browser information, access and event logs

Special category data. Not requested and not required. The Services are not designed for it. Documents the Customer connects may nonetheless contain it, which is why the Customer chooses what to connect and approves what is used.

Competent supervisory authority. The Swiss Federal Data Protection and Information Commissioner. Where the Standard Contractual Clauses apply, the authority determined under clause 13 of those Clauses.

Annex II — Security measures

These are the measures in place, not a wish list. Where something is not yet implemented it is not listed.

Encryption. Data is encrypted in transit using TLS. Stored files are encrypted at rest with a per-file key, wrapped by a per-tenant key, wrapped in turn by a root key held in our secret management. Ending a tenancy destroys the tenant key and renders that tenant's files unrecoverable.

Tenant isolation. Files are addressed under per-tenant prefixes and every content request is authorised against the requesting tenancy. Access to storage is gated on the tenant being active.

Authentication. Passwords are hashed with Argon2id at the memory and time costs recommended by OWASP. Access tokens are short-lived and verified against a public key rather than a shared secret. Revoked sessions are propagated to every service and rejected there, so signing out or revoking a session takes effect across the platform rather than only where it was issued. Sign-in attempts are rate limited.

Authorisation. Roles separate tenant owners, administrators, members and machine principals, and machine principals reading customer content are subject to a separate grant check. Download links are pre-signed and expire in fifteen minutes, because a signed link bypasses authorisation once issued.

Logging. Authentication and session events are retained for 365 days and file access events for 180 days, both enforced by database expiry rather than by a manual process.

Monitoring. Automated checks run continuously against liveness, dependencies, third-party integrations, and a complete sign-in to playback journey, at intervals matched to how quickly each would matter. Results are retained for 90 days and published on our status page.

Data location. Files are held in a storage bucket created under EU jurisdiction, which places the objects in the European Union rather than wherever is nearest. The database is in the Netherlands. Application compute is in the European Union.

Supplier management. Subprocessors are engaged under written contracts imposing equivalent obligations, and model and speech providers are engaged on terms that forbid training on the data we send.

Deletion. Deletion is immediate in the live service, with encrypted backups ageing out within 30 days, and is reinforced for files by destruction of the tenant key.

Annex III — Subprocessors

The three United States entries are the subprocessors that receive text: document extracts for embedding, the generated briefing text, and the finished script for narration. Clause 11 sets out the transfer safeguard for each.

The current list is Annex III above, published at quorumtech.ch/legal/dpa.

Quorum Technologies GmbH · Heumattstrasse 18, 8906 Bonstetten, Switzerland · CHE-196.262.518 · legal@quorumtech.ch