Draft pending legal review. This text describes how Qwise actually handles data, but it has not yet been reviewed by a lawyer and bracketed items still need filling in.
Data Processing Addendum
Last updated 2026-11-10
This addendum forms part of the Terms of Service between [Company legal name and registered address] ("Qwise", the processor) and the business or organisation using Qwise (the "Customer", the controller). It applies to personal data Qwise processes on the Customer's behalf.
1. Scope and roles
Subject matter: operating digital queues. Duration: while the Customer uses Qwise, plus the deletion periods below. Data subjects: people who join the Customer's queues, and the Customer's staff and volunteers. Data: names, email addresses, phone numbers (with SMS consent), service chosen, party size, queue position and timestamps, and delivery records of messages sent. Purpose: to run the queue and notify participants.
2. Instructions
Qwise processes the data only on the Customer's documented instructions, which are these terms and the Customer's configuration and use of the service, unless law requires otherwise (in which case Qwise will tell the Customer where permitted). Qwise will tell the Customer if it believes an instruction infringes data protection law.
3. Confidentiality and security
Personnel with access are bound by confidentiality. Qwise maintains appropriate technical and organisational measures, including: encryption in transit; tenant isolation enforced on every request; role-based access control; single sign-on with multi-factor authentication for Qwise administrators; time-boxed, reasoned and logged support access to personal data; automatic deletion of participant details within 24 hours after a ticket ends; rate limiting and bot protection on public endpoints; and regular backups with tested restores.
4. Sub-processors
The Customer gives general authorisation for the sub-processors below. Qwise binds each to equivalent obligations, remains responsible for them, and will give notice of changes so the Customer can object on reasonable grounds.
- Cloudflare, Inc.: Hosting, database, queues, file storage, DNS and security. Data: All service data, including queue participants' names and contact details while a queue is live.
- Stripe, Inc.: Payment processing for subscriptions, Event Passes and SMS packs. Data: Billing contact, plan and payment details (card data goes to Stripe directly and never reaches Qwise).
- Resend, Inc.: Sending transactional email (verification, queue alerts, reports). Data: Recipient email address, message content.
- Twilio Inc.: Sending SMS queue alerts. Data: Recipient phone number, message content.
5. Assisting the Customer
Taking into account the nature of the processing, Qwise provides tools and reasonable assistance for access, correction, export and erasure requests (including erasing a single person from all of the Customer's queues), for security obligations, data protection impact assessments and consultations with authorities.
6. Personal data breaches
Qwise will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information it then has, and will assist with the Customer's notification duties.
7. Deletion and return
Participant details are deleted automatically as described in the Privacy Policy. On termination Qwise will, at the Customer's choice, export and then delete the Customer's remaining data. Backups are overwritten on their normal cycle (up to 35 days).
8. Audits
Qwise will make available the information reasonably necessary to demonstrate compliance and allow for audits by the Customer or its auditor on reasonable notice, not more than once a year unless required by a regulator or after a breach.
9. International transfers
Where processing involves a restricted transfer, the parties rely on the European Commission's standard contractual clauses (Module 2, controller to processor) and, for the UK, the UK addendum, which are incorporated by reference. [Counsel to confirm and attach.]