Data Processing Addendum

Last Updated: August 20, 2026

This Data Processing Addendum ("DPA") supplements the QDrop Master Services Agreement ("MSA") entered into by and between QDrop ("Processor" or "QDrop") and the customer entity executing the MSA or Order Form ("Controller" or "Customer"). This DPA governs the processing of Personal Data in connection with the Service.

1. SCOPE, ROLES & INSTRUCTIONS

  • 1.1 Roles of the Parties. The parties acknowledge and agree that Customer is the Data Controller (or Processor acting under instructions of a third-party Controller) and QDrop is the Data Processor with respect to Customer Personal Data.
  • 1.2 Scope of Processing. QDrop shall process Customer Personal Data solely for the purpose of providing, securing, and maintaining the Service, and strictly in accordance with Customer’s documented lawful instructions, the MSA, this DPA, and applicable Privacy Laws.
  • 1.3 Compliance with Laws. Customer warrants that its instructions comply with applicable Privacy Laws, including the UK GDPR, Data Protection Act 2018, Canadian PIPEDA, provincial privacy legislation (including Quebec Law 25), and US federal and state privacy statutes (including FERPA and COPPA).

2. CONFIDENTIALITY & PERSONNEL

QDrop ensures that all personnel authorized to process Customer Personal Data are subject to strict contractual or statutory confidentiality obligations and receive appropriate privacy and security training.

3. TECHNICAL & ORGANIZATIONAL MEASURES (TOMs)

QDrop implements and maintains appropriate technical, administrative, and physical security safeguards to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are detailed in Schedule B of this DPA and include:

  • Encryption of Personal Data in transit (TLS 1.3) and at rest (AES-256).
  • Strict Role-Based Access Controls (RBAC) and Multi-Factor Authentication (MFA) for internal systems.
  • Vulnerability management, continuous security logging, and business continuity/disaster recovery (BC/DR) protocols.

4. SUB-PROCESSOR MANAGEMENT

  • 4.1 Authorized Sub-Processors. Customer provides general authorization for QDrop to engage third-party sub-processors to assist in delivering the Service. A current list of sub-processors is maintained at [trust.qdrop.com/subprocessors](https://trust.qdrop.com/subprocessors).
  • 4.2 Advance Notice & Objection. QDrop shall notify Customer of any intended additions or replacements to its sub-processors at least fourteen (14) days in advance by updating its public Sub-Processor Directory and sending email alerts to subscribed customers. Customer may object to a new sub-processor on reasonable privacy or security grounds within fourteen (14) days of notice. If the parties cannot resolve the objection, Customer may terminate the affected Service without penalty.
  • 4.3 Pass-Through Obligations. QDrop shall enter into written agreements with each sub-processor imposing data protection terms no less protective than those set forth in this DPA.

5. DATA SUBJECT REQUESTS & ASSISTANCE

Taking into account the nature of the processing, QDrop shall provide reasonable assistance to Customer, via appropriate technical and organizational measures, to enable Customer to fulfill end-user Data Subject Access Requests (DSARs) under applicable Privacy Laws. If QDrop receives a request directly from a Data Subject, QDrop shall promptly notify Customer and direct the Data Subject to the Customer.

6. SECURITY INCIDENT & BREACH NOTIFICATION

In the event of a confirmed Personal Data Breach affecting Customer Personal Data, QDrop shall notify Customer without undue delay (and no later than 48 hours after becoming aware of the incident). The notification shall describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the remedial measures taken or planned.

7. PRIVACY IMPACT ASSESSMENTS & AUDIT RIGHTS

  • 7.1 Privacy Impact Assessments (PIAs). QDrop shall provide reasonable cooperation and information to assist Customer in conducting Privacy Impact Assessments (PIAs) or consulting with data protection authorities (including under Quebec Law 25).
  • 7.2 Audits. Upon written request, QDrop shall make available to Customer security documentation, such as SOC 2 audit reports or third-party penetration test executive summaries, to verify compliance with this DPA.

8. DELETION OR RETURN OF PERSONAL DATA

Upon termination or expiration of the MSA, QDrop shall, within thirty (30) days and at Customer’s election, securely return or delete all Customer Personal Data in its possession, except where retention is required by applicable law or retained in automated, encrypted backup systems (which shall be overwritten in accordance with standard backup retention schedules).

SCHEDULE A: DETAILS OF PROCESSING

  • A. Categories of Data Subjects:
    • Parents, legal guardians, school administrators, teachers, and staff members.
    • Note: Students do not directly access or log into the platform.
  • B. Categories of Personal Data:
    • Names, work/personal email addresses, phone numbers, communication preferences, account credentials, support tickets, and workspace messaging content.
  • C. Nature & Purpose of Processing:
    • Delivering software-as-a-service communication tools, administrative AI processing, user authentication, platform maintenance, and customer support.
  • D. Duration of Processing:
    • For the term of the MSA plus thirty (30) days for post-termination data export/deletion.

SCHEDULE B: TECHNICAL & ORGANIZATIONAL MEASURES (TOMs)

QDrop enforces the following security controls:

  1. Access Controls: Multi-Factor Authentication (MFA) and least-privilege Role-Based Access Controls (RBAC) enforced for all employees.
  2. Encryption Standards: Data encrypted in transit using TLS 1.3 protocols and data at rest encrypted using AES-256.
  3. Infrastructure Isolation: Multi-tenant database segmentation preventing cross-customer data exposure.
  4. Vulnerability Management: Regular third-party penetration testing and continuous vulnerability scanning.
  5. Business Continuity: Daily encrypted database snapshots and disaster recovery testing.

SCHEDULE C: UK INTERNATIONAL DATA TRANSFER ADDENDUM (UK IDTA)

For Customers subject to the UK GDPR, this Schedule incorporates the UK ICO International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B.1.0).

  • Exporter: Customer (School / District).
  • Importer: QDrop (and its authorized AWS US authentication infrastructure).
  • Scope: Applies strictly to user authentication metadata (email addresses, hashed passwords) transferred outside Great Britain for identity verification. Core application data remains localized on UK servers.

SCHEDULE D: CANADIAN PRIVACY SCHEDULE

For Customers located in Canada, processing shall comply with PIPEDA, BC/AB PIPA, and Quebec Law 25:

  1. Data Localization Confirmation: All primary Canadian educational and application data is hosted and maintained on servers located in Canada.
  2. Quebec Cross-Border Transfers: Transfers of authentication metadata outside Quebec undergo a Privacy Impact Assessment (PIA) to verify adequate contractual safeguards.
  3. French Language Support: Legal and privacy documentation shall be made available in French upon request.

SCHEDULE E: UNITED STATES STUDENT DATA PRIVACY SCHEDULE

For Customers located in the United States, processing shall comply with federal and state student privacy regulations:

  1. FERPA Designation ("School Official"): To the extent QDrop processes education records subject to the Family Educational Rights and Privacy Act (FERPA), QDrop is designated as a "School Official" with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i). QDrop remains under the direct control of the educational institution regarding the use and maintenance of education records.
  2. Purpose Limitations: QDrop shall process student-related data solely to deliver the platform functionality authorized by the school district. QDrop shall strictly not sell student personal data, engage in targeted advertising, or build behavioral profiles of students or parents for commercial purposes.
  3. COPPA Compliance: To the extent the platform processes information related to children under 13, the educational institution acts as the parent's agent and consents to QDrop's collection and processing of such data strictly for educational purposes, pursuant to COPPA regulations.
  4. Data Ownership & Parental Access: All student data remains the property of the educational institution. QDrop shall assist the institution in fulfilling parent requests to inspect, correct, or delete student information held within the platform.
  5. State Privacy Law Alignment: QDrop aligns its operational safeguards with applicable state-level student data protection statutes (including California SOPIPA, New York Education Law 2-d, and Illinois SOPPA).