Data Processing Addendum

Last updated November 1, 2026

This Data Processing Addendum ("DPA") is part of the Terms of Service between Helios One Oy (business ID 3596623-5, Helsinki, Finland, "we") and the business using QuotedPart ("you"). It applies when we process personal data in Your Content on your behalf ("Customer Personal Data"). It takes effect when you accept the Terms; no signature is needed. For a countersigned copy, email touko@heliosone.fi. Terms defined in the GDPR have the same meaning here.

1. Roles and instructions

• You are the controller of Customer Personal Data, or a processor acting for your own controller. We are your processor and, under the California Consumer Privacy Act (CCPA) and similar US state laws, your service provider or processor.
• We process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we tell you first where the law allows. The Terms, this DPA and your use and settings of QuotedPart are your instructions. We tell you if we believe an instruction breaks data protection law.
• You instruct us to process Customer Personal Data to provide, secure and support QuotedPart, including AI reading of drawings and RFQs, and to measure and improve its accuracy using usage data and AI logs as described in the Privacy Policy.
• You are responsible for having a lawful basis and giving the notices needed for us to process Customer Personal Data.

2. Details of the processing

• Subject matter and duration: providing QuotedPart under the Terms, until the data is deleted under section 8.
• Nature and purpose: hosting, storage, transmission, display, AI analysis, email delivery, analytics, support and troubleshooting.
• Data subjects: your users, your customers' and suppliers' contacts, and people named in files or emails you upload or forward.
• Personal data: names, business email addresses, phone numbers, company names and addresses, job titles, email content and signatures, purchase order details, and any personal data in files.
• Sensitive data: none is needed. Don't upload special categories of personal data or other sensitive personal data.

3. Confidentiality

Everyone we authorize to process Customer Personal Data is bound by confidentiality and has access only as far as their work needs.

4. Security

We maintain technical and organizational measures appropriate to the risk, including: encryption in transit and at rest, per-shop access checks on every request, password hashing, random secret links, least-privilege staff access, secrets kept out of code, encryption of ITAR vault parts in the shop's browser before upload, and providers with recognized security certifications.

5. Subprocessors

• You authorize the subprocessors listed below. We bind each by a written contract with data protection obligations that are substantially no less protective than this DPA, and we remain responsible for them.
• We give at least 30 days' notice of a new subprocessor by email to shop owners and by updating this page. You may object on reasonable data protection grounds. If we can't resolve the objection, you may end the Terms and we refund prepaid fees for the period after the end.

6. Assistance

• If a data subject contacts us about Customer Personal Data, we refer them to you and don't respond ourselves unless you instruct us to.
• We help you, taking into account the nature of the processing, to respond to data subject requests and to meet your obligations on security, breach notification, data protection impact assessments and prior consultation.

7. Personal data breaches

We notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We give you the information you need to meet your own obligations as it becomes available, and take reasonable steps to contain the breach.

8. Deletion and return

• You can export your data at any time, including after a trial or subscription ends while the shop is read-only.
• When the shop owner requests deletion, we delete Customer Personal Data within 30 days, unless the law requires us to keep it. A read-only shop is deleted on request, or by us after 12 months with at least 30 days' notice to the owner.
• Copies in providers' backups are deleted as the backups are overwritten, and are protected under this DPA until then.

9. Audits

We make available the information needed to show compliance with this DPA and answer reasonable security questionnaires. Where that isn't enough, you or an independent auditor bound by confidentiality may audit our compliance once a year on 30 days' notice, at your cost and during business hours, or more often if a regulator requires it or after a breach. We may meet audit requests with our providers' current certifications and reports where they cover the question.

10. International transfers

• Customer Personal Data is hosted in the United States (Convex on AWS us-east-1). You authorize the transfers needed to provide QuotedPart to the countries listed for our subprocessors.
• For transfers of personal data from the EU, EEA, UK or Switzerland to a subprocessor in a country without an adequacy decision, we rely on the subprocessor's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions) or on the Standard Contractual Clauses (Commission Decision (EU) 2021/914).
• Where the GDPR requires transfer safeguards between you and us because you are outside the EEA, the Standard Contractual Clauses, Module Four (processor to controller), apply and are incorporated by reference, governed by Finnish law with disputes before the courts of Finland. For UK data, the UK International Data Transfer Addendum applies as needed.

11. US state privacy laws

Where the CCPA or a similar US state law applies to Customer Personal Data, we:

• process it only for the business purposes in the Terms and this DPA;
• don't sell or share it, as those terms are defined in the CCPA;
• don't retain, use or disclose it outside our direct business relationship with you, or for any purpose other than those business purposes;
• don't combine it with personal data from other sources, except as those laws permit;
• comply with those laws, give the same level of privacy protection they require, and tell you if we can no longer meet them;
• allow you to take reasonable steps to stop and fix any unauthorized use.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, as far as the law allows. If this DPA conflicts with the Terms on personal data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.