Effective Date: The date of Customer's electronic acceptance via Order Form or execution of this Agreement
This Master Subscription Agreement ("Agreement") is entered into between QuestWorks Games, LLC, a Colorado limited liability company ("QuestWorks," "we," "us," or "our"), and the customer entity identified in the applicable Order Form ("Customer," "you," or "your").
IMPORTANT: In the event of any conflict between the terms of this Agreement and an executed Order Form, the Order Form shall control solely with respect to the specific matter in conflict.
"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of at least 50% of voting securities or beneficial interest.
"Agreement" means this Master Subscription Agreement, together with all Order Forms, exhibits, and amendments.
"Confidential Information" means all non-public information disclosed by one party to the other, whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and circumstances of disclosure.
"Customer Data" means all data, information, and content provided or generated by Customer or Participants in connection with use of the Services, excluding QuestWorks Data.
"Data Protection Laws" means all applicable laws and regulations relating to privacy and data protection, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), California Consumer Privacy Act ("CCPA"), Illinois Biometric Information Privacy Act ("BIPA"), and other applicable state, federal, and international privacy laws.
"Documentation" means QuestWorks' standard user guides, manuals, and other materials relating to the Services, as updated from time to time.
"Order Form" means the ordering document executed by both parties that specifies the Services purchased, pricing, subscription term, and other transaction-specific details.
"Participant" means any individual authorized by Customer to access and use the Services, including employees, contractors, and other personnel.
"Personal Data" means any information relating to an identified or identifiable natural person as defined under applicable Data Protection Laws.
"Platform" means QuestWorks' proprietary AI-powered gamified professional development platform, including all software, applications, tools, and services provided thereunder.
"QuestWorks Data" means data and information generated by QuestWorks relating to the Services, including aggregated and anonymized usage statistics, analytics, and insights that do not identify Customer or any individual.
"Services" means access to and use of the Platform as specified in the applicable Order Form, including related support services.
"Subscription Term" means the period during which Customer has purchased access to the Services, as specified in the Order Form.
Subject to the terms of this Agreement and payment of applicable Fees, QuestWorks will make the Services available to Customer during the Subscription Term in accordance with the Order Form and Documentation.
QuestWorks will use commercially reasonable efforts to make the Services available 24 hours a day, 7 days a week, except for:
a) Planned downtime (of which QuestWorks will give at least 24 hours advance notice via email or platform notification);
b) Any unavailability caused by circumstances beyond QuestWorks' reasonable control, including without limitation, acts of God, acts of government, floods, fires, earthquakes, civil unrest, acts of terror, strikes or other labor problems, or Internet service provider failures or delays.
QuestWorks may modify the Services from time to time, provided that such modifications do not materially diminish the functionality of the Services during the then-current Subscription Term. QuestWorks will provide reasonable notice of material changes.
QuestWorks will provide standard support services as described in the Documentation or Order Form. Additional support services may be available for additional fees.
If Customer purchases professional services (such as training, implementation, or customization), such services will be governed by the terms specified in the applicable Order Form or statement of work.
Customer is responsible for:
a) Maintaining the confidentiality of account credentials;
b) All activities that occur under Customer's account;
c) Ensuring that all Participants comply with this Agreement and applicable laws;
d) Promptly notifying QuestWorks of any unauthorized access or security breach.
Customer agrees that Participants will:
a) Use the Services only for lawful business purposes;
b) Comply with all applicable laws and regulations;
c) Not violate any third-party rights;
d) Not interfere with or disrupt the Services;
e) Not attempt to gain unauthorized access to the Services or related systems;
f) Not use the Services in any manner that could damage, disable, overburden, or impair the Services.
Customer is responsible for:
a) Ensuring all Participants have necessary permissions to participate;
b) Providing Participants with access credentials and onboarding materials;
c) Training Participants on appropriate use of the Services;
d) Managing Participant additions, removals, and permission changes.
Customer shall not, and shall ensure that Participants do not:
a) Employment Decisions: Use the Platform, including individual performance data displayed in leaderboards, for employment decisions, performance evaluations, disciplinary actions, hiring, firing, promotion decisions, or any assessment that could materially affect employment status, compensation, or career advancement. Customer acknowledges that:
b) Data Misuse: Extract, compile, or use Platform data for purposes outside the scope of this Agreement;
c) Reverse Engineering: Reverse engineer, decompile, or disassemble any aspect of the Services;
d) Competitive Use: Use the Services to develop competing products or services;
e) Harmful Content: Transmit malware, viruses, or other harmful code.
Violation of Section 3.4(a) constitutes a material breach of this Agreement and may result in immediate termination without refund.
Customer agrees to pay all fees specified in the Order Form ("Fees"). Unless otherwise stated, Fees are:
a) Due and payable in advance;
b) Non-refundable, except as expressly provided in this Agreement;
c) Exclusive of all taxes, duties, and similar charges.
Payment is due within thirty (30) days of the invoice date unless otherwise specified in the Order Form. Late payments will accrue interest at the rate of 1.5% per month or the maximum rate permitted by law, whichever is lower.
All Fees are exclusive of applicable sales, use, value-added, and other taxes or duties. Customer is responsible for all such taxes except those based on QuestWorks' net income.
QuestWorks may increase Fees for any renewal Subscription Term by providing at least sixty (60) days' written notice prior to the renewal date.
QuestWorks may suspend access to the Services if payment is more than thirty (30) days overdue, provided QuestWorks has given Customer at least ten (10) days' written notice of the delinquency.
Customer as Data Controller for Reports: Customer receives aggregated team analytics and individual performance reports (names, avatars, XP scores, achievements, rankings) but does not process or control the underlying personal data. Customer's role is limited to viewing reports for team engagement and professional development purposes only.
QuestWorks as Data Processor: QuestWorks processes Personal Data on behalf of Customer solely to provide the Services and only in accordance with Customer's documented instructions as set forth in this Agreement and applicable Order Forms.
Customer represents, warrants, and covenants that it has:
a) Obtained all necessary rights, permissions, and legally valid consents from each Participant required to provide their Personal Data to QuestWorks for processing in connection with the Services;
b) Provided all required privacy notices to Participants under applicable Data Protection Laws;
c) Established a lawful basis for the processing of Personal Data as required under GDPR and other applicable Data Protection Laws;
d) Obtained explicit consent from Participants for the recording and transcription of AI interactions as described in the Platform Terms of Service;
e) Implemented procedures to handle Participant requests to exercise their rights under applicable Data Protection Laws.
Note: Customer receives limited aggregated reports and leaderboard data showing individual performance metrics. Customer does not have access to underlying session recordings, transcripts, or raw biometric data. Customer's primary obligation is ensuring Participants have consented to Platform use, not ongoing personal data processing.
QuestWorks will:
a) Process Personal Data only as necessary to provide the Services and in accordance with Customer's documented instructions;
b) Implement appropriate technical and organizational measures to protect Personal Data;
c) Ensure that persons authorized to process Personal Data are subject to confidentiality obligations;
d) Assist Customer in responding to requests from data subjects exercising their rights under Data Protection Laws;
e) Notify Customer without undue delay upon becoming aware of a Personal Data breach;
f) Delete or return Personal Data to Customer upon termination, unless required by law to retain it;
g) Make available to Customer information necessary to demonstrate compliance with data protection obligations.
Customer acknowledges and agrees that QuestWorks may engage third-party subprocessors to process Personal Data in connection with the Services. QuestWorks maintains a current list of subprocessors, which includes:
QuestWorks will:a) Enter into written agreements with subprocessors imposing data protection obligations substantially similar to those in this Agreement;
b) Remain liable for subprocessors' compliance with data protection obligations;
c) Provide reasonable advance notice of any new subprocessor, giving Customer opportunity to object on reasonable data protection grounds.
Customer acknowledges that Personal Data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. QuestWorks implements appropriate safeguards for such transfers, including:
a) Standard Contractual Clauses (SCCs): QuestWorks has executed or is in the process of executing EU Standard Contractual Clauses with relevant subprocessors;
b) Additional Security Measures: Encryption in transit and at rest, access controls, and regular security assessments;
c) Documentation: QuestWorks maintains documentation of transfer mechanisms and will provide copies upon reasonable request.
QuestWorks will, to the extent legally permitted, promptly notify Customer if QuestWorks receives a request from a data subject to exercise their rights under Data Protection Laws. QuestWorks will, taking into account the nature of the processing:
a) Provide reasonable assistance to Customer in responding to such requests;
b) Not respond to such requests directly without Customer's prior written authorization, except to acknowledge receipt and inform the data subject that their request will be forwarded to Customer.
Upon reasonable advance written notice and no more than once per year (unless required by Data Protection Laws), Customer may audit QuestWorks' compliance with its data protection obligations under this Agreement. Such audits:
a) Will be conducted during normal business hours;
b) Will not unreasonably interfere with QuestWorks' business operations;
c) Will be subject to confidentiality obligations;
d) Will be at Customer's expense, except where a material non-compliance is discovered.
QuestWorks may satisfy audit requirements by providing certifications, audit reports (e.g., SOC 2), or other documentation demonstrating compliance.
QuestWorks retains all right, title, and interest in and to the Services, Platform, Documentation, and all related intellectual property rights. No rights are granted to Customer except as expressly provided in this Agreement.
Customer retains all right, title, and interest in and to Customer Data. By providing Customer Data to QuestWorks, Customer grants QuestWorks a non-exclusive, worldwide, royalty-free license to use, process, store, and transmit Customer Data solely to provide the Services.
QuestWorks may collect, use, and retain QuestWorks Data (aggregated, anonymized usage data and analytics) for purposes of:
a) Operating, maintaining, and improving the Services;
b) Developing new features and services;
c) Industry benchmarking and research;
d) Training and improving AI models.
Customer acknowledges that QuestWorks Data does not identify Customer or any individual and may be used by QuestWorks without restriction.
Customer may provide feedback, suggestions, or ideas regarding the Services. QuestWorks may use such feedback without any obligation to Customer, including incorporating it into the Services or other QuestWorks offerings.
Each party agrees to:
a) Maintain the confidentiality of the other party's Confidential Information;
b) Use Confidential Information only for purposes of performing obligations under this Agreement;
c) Limit disclosure to employees, contractors, and advisors who need to know and who are bound by confidentiality obligations;
d) Protect Confidential Information using at least the same degree of care used for its own confidential information, but no less than reasonable care.
Confidential Information does not include information that:
a) Is or becomes publicly available through no breach of this Agreement;
b) Was rightfully known prior to disclosure;
c) Is rightfully obtained from a third party without breach of confidentiality obligations;
d) Is independently developed without use of or reference to the Confidential Information.
A party may disclose Confidential Information to the extent required by law or court order, provided the disclosing party:
a) Gives prompt written notice to the other party (unless prohibited by law);
b) Cooperates in any effort to seek a protective order;
c) Discloses only the minimum information required.
Confidentiality obligations survive termination of this Agreement for five (5) years, except for trade secrets, which remain confidential indefinitely.
Each party represents and warrants that:
a) It has the legal power and authority to enter into this Agreement;
b) This Agreement constitutes a legal, valid, and binding obligation;
c) Its performance will not violate any other agreement or obligation.
QuestWorks warrants that:
a) The Services will perform substantially in accordance with the Documentation;
b) QuestWorks will use commercially reasonable efforts to prevent introduction of viruses or malicious code;
c) QuestWorks will comply with applicable laws in providing the Services.
If the Services fail to conform to the warranty in Section 8.2(a), and Customer notifies QuestWorks within thirty (30) days of discovery, QuestWorks will, at its option and as Customer's sole remedy:
a) Repair or replace the non-conforming Services; or
b) Terminate the affected Services and refund prepaid Fees for the remainder of the Subscription Term.
EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION 8, THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." QUESTWORKS DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND QUIET ENJOYMENT.
AI Systems Disclaimer: QuestWorks specifically disclaims all warranties regarding third-party AI systems integrated into the Platform. QuestWorks does not warrant that AI-generated content will be accurate, appropriate, unbiased, or suitable for any particular purpose. Customer acknowledges that:
a) Platform Purpose: The Platform is designed and marketed as a gamified professional development tool, not as a performance evaluation or employment decision system;
b) Voluntary Participation: The Services are intended for voluntary professional development activities;
c) No Employment Tool Warranty: QuestWorks makes no representations that the Platform is suitable for, or should be used for, any employment-related decisions, performance reviews, or personnel assessments;
d) Customer Misuse: QuestWorks shall have no liability for Customer's misuse of Platform data for employment purposes, which constitutes a material breach of this Agreement.
The Services may include third-party software or services. QuestWorks makes no warranties regarding such third-party components beyond those provided by the third party.
QuestWorks will defend, indemnify, and hold harmless Customer from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from third-party claims that the Services infringe or misappropriate such third party's intellectual property rights, provided that Customer:
a) Promptly notifies QuestWorks in writing of the claim;
b) Grants QuestWorks sole control of the defense and settlement;
c) Provides reasonable assistance in the defense.
QuestWorks' Remedies: If the Services are, or in QuestWorks' opinion are likely to become, subject to an infringement claim, QuestWorks may, at its option:
i) Obtain the right for Customer to continue using the Services;
ii) Replace or modify the Services to be non-infringing while maintaining substantially equivalent functionality;
iii) If options (i) and (ii) are not commercially reasonable, terminate the affected Services and refund prepaid Fees for the remainder of the Subscription Term.
Exceptions: QuestWorks has no obligation under this Section 9.1 for claims arising from:
a) Modification of the Services by anyone other than QuestWorks;
b) Use of the Services in combination with products, services, or data not provided by QuestWorks;
c) Customer's failure to use updates or corrections provided by QuestWorks;
d) Customer Data or Customer's instructions;
e) Use of the Services in violation of this Agreement.
Customer will defend, indemnify, and hold harmless QuestWorks from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from:
a) Customer Data or Customer's instructions;
b) Customer's or Participants' use of the Services in violation of this Agreement;
c) Customer's violation of applicable laws or regulations;
d) Customer's violation of third-party rights;
e) Employment Law Claims: Any claims by Participants or third parties arising from Customer's use of Platform data (including leaderboard information, XP scores, achievements, or any other data) for employment decisions, performance evaluations, disciplinary actions, or any other employment-related purpose in violation of Section 3.4(a).
Customer specifically agrees to indemnify QuestWorks against all claims alleging that Customer's use of individual performance data displayed in the Platform violated employment discrimination laws, privacy laws, or other employment-related regulations.
The indemnified party will:
a) Promptly notify the indemnifying party in writing of any claim;
b) Cooperate reasonably in the defense;
c) Grant the indemnifying party sole control of defense and settlement, provided settlement does not impose obligations on or admit liability by the indemnified party without its consent.
THIS SECTION 9 STATES THE INDEMNIFYING PARTY'S SOLE LIABILITY AND THE INDEMNIFIED PARTY'S EXCLUSIVE REMEDY FOR THIRD-PARTY CLAIMS COVERED BY THIS SECTION.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY SHALL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR USE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
EXCEPT FOR OBLIGATIONS UNDER SECTION 9 (INDEMNIFICATION), VIOLATIONS OF SECTION 7 (CONFIDENTIALITY), OR WILLFUL MISCONDUCT, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO QUESTWORKS IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY.
The limitations in Sections 10.1 and 10.2 do NOT apply to:
a) Either party's indemnification obligations under Section 9;
b) Either party's breach of confidentiality obligations under Section 7;
c) Either party's gross negligence or willful misconduct;
d) Customer's payment obligations;
e) Violations of intellectual property rights;
f) Statutory Damages: Claims for statutory damages under laws that explicitly prohibit limitation of such damages, including but not limited to the Illinois Biometric Information Privacy Act (BIPA), to the extent a court of competent jurisdiction determines such limitation is prohibited by law.
QUESTWORKS' LIABILITY FOR ISSUES ARISING FROM THIRD-PARTY AI SYSTEMS IS LIMITED TO GROSS NEGLIGENCE IN THE SELECTION OR IMPLEMENTATION OF SUCH SYSTEMS. QuestWorks is not liable for:
a) Inaccuracies, biases, or errors in AI-generated content;
b) AI recommendations or outputs that Customer relies upon;
c) Actions or decisions made by AI vendors;
d) Any employment-related claims arising from Customer's use of AI-generated insights.
THE PARTIES ACKNOWLEDGE THAT THE LIMITATIONS OF LIABILITY IN THIS SECTION 10 ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES, AND THAT QUESTWORKS WOULD NOT PROVIDE THE SERVICES WITHOUT SUCH LIMITATIONS.
This Agreement commences on the Effective Date and continues for the initial Subscription Term specified in the Order Form. Unless either party provides written notice of non-renewal at least thirty (30) days before the end of the then-current Subscription Term, the Agreement will automatically renew for successive renewal periods equal to the initial Subscription Term or one (1) year, whichever is shorter.
Either party may terminate this Agreement immediately upon written notice if the other party:
a) Materially breaches this Agreement and fails to cure within thirty (30) days of written notice (or ten (10) days for payment breaches);
b) Becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to bankruptcy or similar proceedings.
Material Breach Examples:
Customer may terminate this Agreement for convenience upon thirty (30) days' written notice, but will remain obligated to pay all Fees for the remainder of the then-current Subscription Term.
Upon termination or expiration:
a) Access Termination: Customer's and all Participants' access to the Services will immediately cease;
b) Payment Obligations: Customer remains obligated to pay all outstanding Fees;
c) Data Deletion: QuestWorks will delete or anonymize Customer Data in accordance with the Privacy Policy and applicable Data Protection Laws, subject to:
Except as expressly provided in this Agreement, all Fees paid are non-refundable, including in the event of early termination by Customer.
This Agreement, together with all Order Forms and incorporated documents, constitutes the entire agreement between the parties regarding the subject matter and supersedes all prior or contemporaneous agreements, representations, and understandings.
Conflict Resolution: In the event of any conflict:
This Agreement may only be amended by a written document signed by authorized representatives of both parties. QuestWorks may update the Terms of Service, Privacy Policy, or Documentation from time to time with reasonable notice to Customer.
Electronic Acceptance: Customer's electronic acceptance of an Order Form (including via email confirmation, electronic signature, or online order submission) constitutes a binding signature and agreement to the terms contained therein.
Neither party may assign this Agreement without the other party's prior written consent, except:
a) To an Affiliate;
b) In connection with a merger, acquisition, or sale of all or substantially all assets.
Any attempted assignment in violation of this section is void. This Agreement binds and benefits the parties' permitted successors and assigns.
Neither party will be liable for any failure or delay in performance due to circumstances beyond its reasonable control, including acts of God, natural disasters, war, terrorism, riots, civil unrest, pandemics, government actions, or Internet/telecommunications failures. The affected party will promptly notify the other party and use reasonable efforts to minimize the impact.
The parties are independent contractors. This Agreement does not create a partnership, joint venture, agency, or employment relationship.
All notices must be in writing and will be deemed given when:
a) Delivered personally;
b) Sent by confirmed email;
c) Received if sent by certified mail, return receipt requested;
d) Delivered by a nationally recognized courier service.
Notice Addresses:
To QuestWorks:
QuestWorks Games, LLC
Attn: Legal Department
3745 Canfield St, Unit 304
Boulder, CO 80301
Email: legal@questworks.games
To Customer:
The address and email specified in the Order Form.
Either party may update its notice address by providing written notice to the other party.
No waiver of any provision of this Agreement will be effective unless in writing and signed by the waiving party. No waiver of any breach will constitute a waiver of any other breach.
If any provision of this Agreement is held invalid, illegal, or unenforceable, the remaining provisions will continue in full force and effect, and the invalid provision will be modified to the minimum extent necessary to make it valid and enforceable.
This Agreement is governed by the laws of the State of Colorado, without regard to its conflict of laws principles. Any litigation arising out of or relating to this Agreement will be brought exclusively in the state or federal courts located in Boulder County, Colorado, and each party consents to the personal jurisdiction of such courts.
Arbitration Carve-Out: Notwithstanding the forum selection above, disputes subject to arbitration under Customer's or Participants' agreements with QuestWorks will be resolved in accordance with those arbitration provisions.
Each party acknowledges that a breach of Sections 6 (Intellectual Property) or 7 (Confidentiality) may cause irreparable harm for which monetary damages would be inadequate. Accordingly, either party may seek injunctive or other equitable relief for such breaches without posting a bond and without proving actual damages.
Neither party may use the other party's name, logo, or trademarks in marketing materials, press releases, or customer lists without prior written consent, except that:
a) QuestWorks may identify Customer as a user of the Services in its customer list;
b) Either party may make factual statements required by law or regulation.
Customer agrees to comply with all applicable export and import laws and regulations. Customer represents that it is not located in, under the control of, or a national or resident of any country to which the United States has embargoed goods or services, and is not listed on any U.S. government list of prohibited or restricted parties.
If Customer is a U.S. government entity, the Services constitute "commercial computer software" and "commercial computer software documentation" and are provided with only those rights as are granted to all other customers pursuant to this Agreement.
This Agreement does not confer any rights upon any person or entity other than the parties and their respective permitted successors and assigns.
This Agreement may be executed in counterparts, each of which will be deemed an original and all of which together will constitute one agreement. Electronic signatures will have the same force and effect as original signatures.
In the event of any inconsistency between documents comprising this Agreement, the following order of precedence applies:
This Agreement is executed in English. Any translation is for convenience only, and the English version will control in the event of any discrepancy.
Each party will comply with all applicable laws, regulations, and ordinances in performing its obligations under this Agreement. Customer is solely responsible for determining whether the Services are appropriate for Customer's regulatory environment and use case.
Employment Law Compliance: Customer acknowledges its obligation to comply with all applicable employment laws, anti-discrimination statutes, and labor regulations. Customer agrees that using Platform data for employment purposes violates both this Agreement and may violate various employment laws. QuestWorks provides no guidance or warranty regarding employment law compliance related to Platform data use.
"Team Analytics" means aggregated metrics and insights provided to Customer regarding Participant engagement, skill development, and Platform usage patterns at the team or organizational level.
"Individual Performance Display" means the Platform's leaderboard feature showing individual Participant names, avatars, XP scores, achievements, and comparative rankings. Customer acknowledges this feature is designed for gamification and engagement purposes only.
"Report-Level Access" means Customer's ability to view Team Analytics and Individual Performance Display data through the Platform's dashboard interface, without access to underlying Personal Data such as session recordings, transcripts, or biometric data.
By accepting an Order Form or clicking "I Accept" when first accessing the Services, Customer agrees to be bound by the terms of this Master Subscription Agreement.
Customer agrees that electronic acceptance via Order Form submission, email confirmation, or online acceptance constitutes a legally binding signature.
This Data Processing Addendum ("DPA") supplements the Master Subscription Agreement and governs QuestWorks' processing of Personal Data on behalf of Customer.
This DPA applies to Personal Data processed by QuestWorks in connection with providing the Services. Terms used in this DPA have the meanings set forth in the Agreement or applicable Data Protection Laws.
Categories of Data Subjects:
Types of Personal Data:
NOT Collected:
Processing Purposes:
Processing Duration:
For transfers of Personal Data from the EEA to the United States, the parties agree to be bound by the EU Standard Contractual Clauses for the transfer of personal data to processors established in third countries (as approved by the European Commission), which are incorporated herein by reference. To the extent there is any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses will control.
Module and Clauses Selection:
QuestWorks implements and maintains appropriate technical and organizational measures, including:
Upon reasonable written notice, Customer may:
a) Request copies of QuestWorks' security certifications or audit reports (e.g., SOC 2 Type II);
b) Require QuestWorks to complete a security questionnaire (no more than once annually);
c) Conduct or commission an audit of QuestWorks' data processing activities (at Customer's expense), subject to reasonable confidentiality terms.
Upon termination and Customer's written request within thirty (30) days, QuestWorks will:
a) Export and provide Customer Data in a commonly used format; and
b) Delete all copies of Customer Data and Personal Data from QuestWorks systems within sixty (60) days, except as required by law.
QuestWorks may retain Personal Data in backup systems for an additional thirty (30) days before permanent deletion.
END OF MASTER SUBSCRIPTION AGREEMENT
