Data Processing Addendum (DPA)

1. Roles of the Parties

The Customer acts as the data controller and determines the purposes and means of processing personal data.

RFQForge acts as a data processor and processes personal data only on documented instructions from the Customer.

2. Scope of Processing

Processing may include:

• Storage of RFQs, quotes, and order data
• Handling customer contact information
• Displaying data on dashboards and public pages
• Sending transactional communications

The types of personal data processed depend on what the Customer submits to the platform.

3. Customer Responsibilities

• Ensure lawful basis for processing personal data
• Provide required notices to data subjects
• Ensure data accuracy and appropriateness
• Avoid submitting unnecessary sensitive data

4. RFQForge Obligations

• Process data only to provide the Service
• Maintain confidentiality of processed data
• Implement reasonable technical and organizational safeguards
• Assist Customer with data protection obligations where reasonably possible

5. Subprocessors

RFQForge uses third-party service providers (subprocessors) to deliver the Service, including infrastructure, storage, and email delivery providers.

These subprocessors process data only as necessary to provide their services.

6. Security Measures

• Encrypted HTTPS communication
• Secure authentication and access controls
• Password hashing and credential protection
• System monitoring and abuse prevention mechanisms

7. Data Breach Notification

In the event of a confirmed data breach affecting Customer data, RFQForge will notify the Customer without undue delay.

8. Data Retention and Deletion

Data is retained for the duration of the Customer’s use of the Service.

Upon termination, data may be deleted or retained for a limited period for legal, security, or backup purposes before permanent deletion.

9. International Transfers

Data may be processed in countries outside the Customer’s jurisdiction depending on infrastructure providers used.

RFQForge implements reasonable safeguards appropriate to such transfers.

10. Termination

This DPA remains in effect for as long as RFQForge processes personal data on behalf of the Customer.

11. Contact

Email: support@rfqforge.com