Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Supplier Terms, the Data Licensing Terms and any other agreement with Quarry that refers to it (the "Agreement"). It applies where Quarry processes personal data in providing the services.

• At-source pipeline: where Quarry operates de-identification inside a data owner's environment, the owner is the data fiduciary (controller) and Quarry is its data processor, acting only on the owner's documented instructions.
• Account and contact data: each party is an independent data fiduciary (controller) for the business contact details it exchanges with the other.
• Licensed datasets: these are de-identified before export and are not intended to contain personal data. If a buyer finds personal data in a dataset, the Data Licensing Terms require it to stop, report and delete.

Quarry processes personal data only on the controller's documented instructions, including those in the Agreement and the Listing Schedule, unless the law requires otherwise (in which case Quarry will tell the controller first, where lawful). The subject matter is de-identification of the owner's recordings, studies and records; the duration is the term of the Listing Schedule; the categories of data subjects and data are those described in the Listing Schedule.

Quarry ensures that anyone it authorises to process personal data is bound by confidentiality and only has the access their task needs.

Quarry maintains appropriate technical and organisational measures, including:

• de-identification inside the owner's environment, so raw personal data is not transferred to Quarry;
• encryption in transit (TLS 1.2 or later) and at rest for data Quarry stores;
• least-privilege access, SSO and multi-factor authentication for staff, and access reviews;
• audit logging of access to datasets and pipelines;
• incident detection and response procedures.

The current measures are described on the security page.

The controller authorises Quarry to use the subprocessors listed on the subprocessors page. Quarry will give at least 30 days' notice of a new subprocessor through that page's change notices. The controller may object on reasonable data protection grounds within that period; the parties will discuss in good faith, and if they cannot resolve the objection the controller may terminate the affected service. Quarry remains responsible for its subprocessors and binds them to terms at least as protective as this DPA.

Quarry will notify the controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data it processes, with the information the controller reasonably needs to meet its own obligations (including notifying the Data Protection Board of India or another regulator, and affected individuals). Quarry will take reasonable steps to contain and remedy the breach.

Quarry will help the controller, taking into account the nature of the processing, to respond to requests from individuals exercising their rights, and with security, impact assessments and consultations with regulators. Quarry will pass on promptly any request it receives directly.

When the service ends, Quarry will, at the controller's choice, delete or return the personal data it processed for the controller and delete remaining copies, unless the law requires it to keep them. Because the pipeline runs in the controller's environment, this includes removing Quarry's agent and credentials from that environment.

Quarry will make available the information reasonably needed to show compliance with this DPA, and allow audits by the controller or its independent auditor once a year on 30 days' notice, under confidentiality, or more often if a regulator requires it or after a breach. Where available, Quarry may meet this obligation with independent audit reports.

Personal data will be transferred outside India only as permitted under the Digital Personal Data Protection Act, 2023 and its Rules. Where the GDPR or UK GDPR applies to a transfer, the parties agree to the relevant standard contractual clauses, which are incorporated by reference with the parties' details from the Agreement.

If this DPA conflicts with the Agreement on the processing of personal data, this DPA wins. Liability under this DPA is subject to the limits in the Agreement.