Data Processing Addendum

Effective date: September 30, 2026

Parties and incorporation

This Data Processing Addendum ("DPA") is between Robinson Innovations LLC, a Florida limited liability company doing business as QNAAPI ("QNAAPI"), and the customer that has agreed to the QNAAPI Terms of Service or another written agreement for the Services ("Customer"). That agreement is the "Agreement."

This DPA forms part of the Agreement. Customer accepts it by accepting the Agreement or by using the Services to process Customer Personal Data. It applies whenever QNAAPI processes Customer Personal Data on Customer's behalf.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement or in Data Protection Laws.

• "Customer Personal Data" means personal data that QNAAPI processes on Customer's behalf through the Services, including Respondent Data.
• "Respondent" means an individual who views or submits a response to a survey, poll, form, or quiz that Customer creates or delivers using the Services.
• "Respondent Data" means responses, identifiers, and related technical data about Respondents processed through the Services.
• "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under this DPA, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA"), and other U.S. state comprehensive privacy laws.
• "Subprocessor" means a third party QNAAPI engages to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• "controller," "processor," "data subject," "personal data," "processing," "business," "service provider," "sell," and "share" have the meanings given in the applicable Data Protection Laws.

2. Roles and scope

2.1 Roles. Customer is the controller (or business) of Customer Personal Data, and QNAAPI is its processor (or service provider). Where Customer is itself a processor for a third party, QNAAPI is Customer's subprocessor, and Customer confirms its instructions are authorized by that third party.

2.2 Scope. The subject matter, duration, nature and purpose of processing, and the categories of data and data subjects are described in Annex 1.

2.3 QNAAPI's own data. This DPA does not cover personal data QNAAPI processes as a controller, such as account, billing, and website visitor data. That data is covered by the QNAAPI Privacy Policy.

2.4 Aggregated data. QNAAPI may create aggregated or deidentified data from its operation of the Services, such as usage volumes and performance metrics, to maintain and improve the Services. Such data will not identify Customer, any Respondent, or any individual, and QNAAPI will not attempt to reidentify it.

3. Customer obligations

3.1 Lawful collection. Customer is responsible for having a lawful basis for collecting Respondent Data. This includes giving Respondents any required privacy notices and obtaining any required consents, including for cookies or similar technologies on Customer's properties.

3.2 Instructions. Customer's instructions must comply with Data Protection Laws. Customer's use of the Services and its configuration of surveys, polls, forms, and quizzes constitute its documented instructions.

3.3 Sensitive data. Customer will not use the Services to collect special categories of personal data, sensitive personal information, government identifiers, financial account numbers, or health information, unless QNAAPI has agreed in writing and Customer has obtained any consent required by law.

3.4 Children. Customer will not use the Services to knowingly collect personal information from children under 13, or under 16 where required by applicable law, unless Customer complies with COPPA and other applicable children's privacy laws, including obtaining verifiable parental consent.

3.5 Respondent requests. Customer is responsible for responding to requests from Respondents about their data, with QNAAPI's assistance under Section 8.

4. QNAAPI obligations

4.1 Instructions. QNAAPI will process Customer Personal Data only on Customer's documented instructions, including for transfers, unless required otherwise by law. In that case QNAAPI will inform Customer before processing unless the law prohibits it. QNAAPI will tell Customer promptly if it believes an instruction violates Data Protection Laws.

4.2 Confidentiality. QNAAPI will ensure that anyone it authorizes to process Customer Personal Data is bound by confidentiality obligations.

4.3 Customer separation. QNAAPI will keep each Customer's Customer Personal Data logically separate. It will not combine one Customer's Customer Personal Data with personal data from another Customer, and will not use it to build or enrich profiles, audience segments, or traits for anyone other than that Customer.

4.4 No other use. QNAAPI will not use Customer Personal Data for its own advertising or marketing, and will not use it to train machine learning models for use outside Customer's own account.

4.5 Compliance assistance. Taking into account the nature of processing, QNAAPI will give Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities.

5. U.S. state privacy laws

Where the CCPA or another U.S. state comprehensive privacy law applies, QNAAPI acts as Customer's service provider or processor and will not:

1. sell or share Customer Personal Data;
2. retain, use, or disclose Customer Personal Data for any purpose other than the business purposes in Annex 1, including any commercial purpose other than providing the Services;
3. retain, use, or disclose Customer Personal Data outside the direct business relationship between QNAAPI and Customer; or
4. combine Customer Personal Data with personal data it receives from or on behalf of anyone else, or collects from its own interactions with individuals, except as permitted by the CCPA and its regulations.

QNAAPI will comply with applicable obligations under those laws and provide the same level of privacy protection they require. QNAAPI will notify Customer if it determines it can no longer meet these obligations. Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including by suspending the Services or terminating the Agreement. QNAAPI certifies that it understands and will comply with this Section 5.

6. Security

QNAAPI will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including those in Annex 2. QNAAPI may update these measures over time, as long as the updates do not materially reduce the overall protection of Customer Personal Data.

7. Subprocessors

7.1 Authorization. Customer gives QNAAPI general authorization to engage Subprocessors. The Subprocessors in use on the date of this DPA are listed in Annex 3 and at qnaapi.com/subprocessors.

7.2 Subprocessor terms. QNAAPI will bind each Subprocessor to written data protection terms at least as protective as this DPA. QNAAPI remains responsible to Customer for each Subprocessor's performance.

7.3 Changes. QNAAPI will give at least 30 days' notice before adding or replacing a Subprocessor, by updating qnaapi.com/subprocessors and emailing Customers who have subscribed to updates there.

7.4 Objection. Customer may object on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Services and receive a prorated refund of prepaid fees for the remaining term.

8. Data subject requests

8.1 Self-service tools. QNAAPI will provide API functionality or a documented process that lets Customer access, export, correct, and delete Respondent Data, including for an individual Respondent.

8.2 Requests received by QNAAPI. If QNAAPI receives a request from a data subject about Customer Personal Data, it will direct the individual to Customer and, where it can identify Customer, forward the request to Customer without undue delay. QNAAPI will not respond to the request itself except as Customer instructs or the law requires.

8.3 Assistance. Where Customer cannot fulfill a request with the self-service tools, QNAAPI will provide reasonable assistance on request.

9. Security incidents

9.1 Notice. QNAAPI will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Security Incident. Notice goes to the account owner's email address.

9.2 Content. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. QNAAPI will provide further information as it becomes available.

9.3 Response. QNAAPI will take reasonable steps to contain, investigate, and mitigate the incident, and will reasonably help Customer meet its own notification obligations.

9.4 No admission. Notice of a Security Incident is not an admission of fault or liability. Unsuccessful attempts that do not compromise Customer Personal Data, such as pings, port scans, or blocked login attempts, are not Security Incidents.

10. Audits

10.1 Information. On written request, no more than once every 12 months, QNAAPI will provide information reasonably necessary to demonstrate compliance with this DPA. This may include answers to a reasonable security questionnaire, a summary of its security practices, and any third-party audit reports it holds.

10.2 Audits. If that information is not sufficient, or a supervisory authority requires it, Customer may conduct an audit at its own cost with at least 30 days' notice. The audit will be scoped by mutual agreement, conducted during business hours, and subject to confidentiality obligations. Remote review is the default.

10.3 SCC audits. Where the SCCs apply, this Section 10 is how the parties carry out the audit clauses of the SCCs.

11. International transfers

11.1 Location. QNAAPI processes Customer Personal Data in the United States. It will not transfer Customer Personal Data to another country except in compliance with Data Protection Laws.

11.2 EEA transfers. For transfers from the European Economic Area, the parties incorporate Module Two (controller to processor) of the SCCs, and Module Three (processor to processor) where Customer is a processor. For those SCCs:

• Clause 7 (docking clause) does not apply;
• under Clause 9, Option 2 (general authorization) applies, with the notice period in Section 7.3;
• the optional language in Clause 11 does not apply;
• Clauses 17 and 18 are governed by and resolved in the courts of Ireland; and
• Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and the competent supervisory authority is determined under Clause 13.

11.3 UK transfers. For transfers from the United Kingdom, the SCCs apply as amended by the UK International Data Transfer Addendum issued by the Information Commissioner. Table 4 is completed so that either party may end the Addendum as set out in Section 19 of the UK Addendum.

11.4 Swiss transfers. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

11.5 Conflict. If the SCCs conflict with this DPA, the SCCs control.

12. Return and deletion

12.1 During the term. Customer can export or delete Customer Personal Data at any time using the Services.

12.2 After termination. For 30 days after the Agreement ends, Customer may export Customer Personal Data. QNAAPI will then delete Customer Personal Data from active systems, and from backups within a further 60 days, unless the law requires it to be kept.

12.3 Retained data. Any Customer Personal Data kept because the law requires it remains protected by this DPA and will be processed only for the purpose that requires its retention.

13. General terms

13.1 Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws or the SCCs do not permit such a limitation.

13.2 Term. This DPA stays in effect as long as QNAAPI processes Customer Personal Data, including after the Agreement ends.

13.3 Order of precedence. If there is a conflict, the following order applies: (a) the SCCs, (b) this DPA, and (c) the rest of the Agreement.

13.4 Changes. QNAAPI may update this DPA to reflect changes in Data Protection Laws or the Services by posting the updated version at qnaapi.com/dpa and giving Customer at least 30 days' notice. An update will not materially reduce the protection given to Customer Personal Data without Customer's agreement.

13.5 Governing law. Except as required by the SCCs, this DPA is governed by the law that governs the Agreement.

13.6 Signed copies. Customers that need a countersigned copy may request one at privacy@qnaapi.com.

Robinson Innovations LLC (d/b/a QNAAPI)
880 NW 33rd Way
Fort Lauderdale, FL 33311
privacy@qnaapi.com

Annex 1: Description of processing

Annex 2: Technical and organizational measures

Annex 3: Subprocessors