Quoridea Data Processing Agreement
Draft for review. This document may change before paid plans open.
Version 0.1, 2026-10-27.
This Data Processing Agreement ("DPA") forms part of the agreement under which Mitikasha LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States ("Quoridea", "Processor") provides the Quoridea service to the customer ("Customer"). It applies when Quoridea processes Customer Personal Data on Customer's behalf. If this DPA and the agreement conflict on the processing of personal data, this DPA prevails.
1. Definitions
"Data Protection Law" means all laws on the processing of personal data that apply to a party's processing under the agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law ("UK GDPR"), the Swiss Federal Act on Data Protection and, where applicable, US state privacy laws. "Customer Personal Data" means personal data that Customer or its users submit to the service. "Controller", "Processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR. "Subprocessor" means a third party engaged by Quoridea that processes Customer Personal Data. "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.
2. Roles and scope
2.1 Customer is the Controller (or a Processor acting for its own Controller) and Quoridea is the Processor (or Subprocessor) of Customer Personal Data.
2.2 Annex I describes the subject matter, nature, purpose and duration of the processing, the categories of data subjects and the types of personal data.
2.3 Quoridea is an independent Controller of the limited account and billing contact data it needs to run its own business (for example, to bill Customer, to secure the service and to meet legal obligations). This DPA does not apply to that processing.
3. Instructions
3.1 Quoridea processes Customer Personal Data only on Customer's documented instructions. The agreement, this DPA and Customer's configuration and use of the service are Customer's complete instructions.
3.2 Quoridea will tell Customer if, in its opinion, an instruction infringes Data Protection Law, and is not required to follow that instruction.
3.3 Quoridea will not sell Customer Personal Data, share it for cross-context behavioral advertising, or use it for any purpose other than providing, securing and supporting the service.
4. Confidentiality
Quoridea ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide, secure or support the service.
5. Security
5.1 Quoridea implements the technical and organizational measures described in Annex II (the Quoridea Security Overview) and keeps them at least as protective as described there.
5.2 Quoridea may update those measures, provided the overall level of protection is not reduced.
6. Personal data breaches
6.1 Quoridea notifies Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
6.2 The notice describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Quoridea supplies further information as it becomes available and takes reasonable steps to contain and remedy the breach.
6.3 Notifying a breach is not an acknowledgment of fault or liability.
7. Subprocessors
7.1 Customer gives general authorization for Quoridea to engage Subprocessors. The current list is Annex III.
7.2 Quoridea gives Customer at least 30 days' notice before adding or replacing a Subprocessor. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the service and receive a refund of prepaid fees for the unused period.
7.3 Quoridea imposes on each Subprocessor data protection obligations no less protective than this DPA and remains responsible for its Subprocessors' performance.
8. Assistance
8.1 Data subject requests. Customer's administrators can see who belongs to its organization and remove people from it. Audit events identify people by internal identifier, not by email address. Quoridea forwards to Customer any request it receives from a data subject about Customer Personal Data and does not answer it except on Customer's instruction. Where Customer cannot fulfill a request through the service, Quoridea provides reasonable assistance.
8.2 Impact assessments and consultations. Quoridea provides reasonable information Customer needs for data protection impact assessments and prior consultations with supervisory authorities, to the extent it relates to Quoridea's processing.
9. Data location and international transfers
9.1 Customer chooses a hosting region (EU or US) for its organization when it signs up. Customer's organization database and files are stored in that region. Account directory data (names, email addresses, roles) is stored in the EU for all customers.
9.2 Quoridea is established in the United States, and its Subprocessors may process data outside the European Economic Area, the United Kingdom and Switzerland. Where such processing is a restricted transfer under Data Protection Law:
(a) EEA: the SCCs apply, Module Two (Controller to Processor) where Customer is a Controller and Module Three (Processor to Processor) where Customer is a Processor, with Customer as data exporter and Quoridea as data importer. Clause 7 (docking) applies; in Clause 9, Option 2 (general authorization) applies with the notice period in section 7.2; the optional language in Clause 11 does not apply; in Clauses 17 and 18 the law and courts of Ireland apply; Annexes I to III of this DPA complete the SCCs' annexes.
(b) UK: the SCCs apply as amended by the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0), with the tables completed from this DPA.
(c) Switzerland: the SCCs apply with references to the GDPR read as references to Swiss law and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
9.3 If the SCCs conflict with this DPA, the SCCs prevail.
10. Return and deletion
10.1 During the subscription, Customer can export its data through the service. Planned: full export of all organization data and files.
10.2 Within 30 days after the agreement ends, Quoridea deletes Customer Personal Data from the service, except where law requires it to keep data. Copies in point-in-time recovery storage expire within a further 30 days. Quoridea confirms deletion in writing on request.
11. Audits
11.1 Quoridea makes available the information reasonably necessary to demonstrate compliance with this DPA, including the Security Overview and completed security questionnaires, and, once obtained, third-party audit reports or certifications.
11.2 If that information is not sufficient, or a supervisory authority requires it, Customer may audit Quoridea's compliance once in any 12 months, on at least 30 days' written notice, during business hours, at Customer's cost, through an auditor bound by confidentiality who is not a Quoridea competitor. Audits do not extend to other customers' data or to Subprocessors' facilities (whose own audit reports Quoridea will share where permitted).
12. Liability and general terms
12.1 Each party's liability under this DPA is subject to the limitations of liability in the agreement, except where Data Protection Law does not allow such limitation.
12.2 This DPA remains in force while Quoridea processes Customer Personal Data. Sections that by their nature should survive (including sections 4, 10 and 11) survive termination.
12.3 Except where the SCCs require otherwise, this DPA is governed by the law that governs the agreement.
Annex I: Description of the processing
Data exporter: Customer, as identified in its account. Activities: use of the Quoridea service.
Data importer: Mitikasha LLC (Quoridea), address above; contact privacy@quoridea.com. Activities: provision of the Quoridea service.
Categories of data subjects: Customer's employees, contractors and other personnel invited to its organization; external partner advisors invited by Customer; individuals named in content Customer's users submit (for example, people named in an idea's write-up or an imported historic record).
Categories of personal data:
- Account data: name, work email address, password hash, roles and appointments with their terms, invitation and membership history, session records (IP address and browser user agent), notification preferences.
- Content data: ideas and their write-ups, supporting files, review scores and comments, decisions with their reasons, delivery plans and updates, benefit estimates and validated benefits, imported historic records.
- Audit data: who did what and when, kept in an append-only, hash-chained audit trail.
- Verified company domain names.
Special categories of data: none intended. Customer should instruct its users not to submit special category data; the service has no features designed for it.
Frequency of transfer: continuous, for the duration of the agreement.
Nature and purpose of processing: hosting, storing, displaying, scoring, reporting on and emailing about Customer's innovation governance records, as directed by Customer's use of the service; securing and supporting the service.
Retention: for the duration of the agreement, then as in section 10. The audit trail is append-only by design for its whole life; it is deleted with the organization.
Transfers to Subprocessors: as in Annex III, for the same nature and duration.
Competent supervisory authority (EEA transfers): as determined by Clause 13 of the SCCs; where Customer has no establishment in the EEA, the Irish Data Protection Commission.
Annex II: Technical and organizational measures
The Quoridea Security Overview (version 0.1), incorporated by reference.
Annex III: Subprocessors
The Quoridea Subprocessor list (version 0.1), incorporated by reference.