Legal

Data Processing Agreement

Last updated: 1 June 2026

Version: 1.1.0

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Data Controller") and Zero Drift Ltd, trading as Quorate ("Data Processor") for the provision of governance and meeting management services.

1. Definitions

Terms used in this DPA have the meanings given in the UK GDPR and Data Protection Act 2018.

2. Scope

This DPA applies to all personal data processed by Quorate on behalf of your organisation through the Platform.

3. Processor Obligations

Quorate shall:

  • Process personal data only on documented instructions from the Controller
  • Ensure persons authorised to process data are under confidentiality obligations
  • Implement appropriate technical and organisational security measures
  • Engage sub-processors only under the general authorisation in section 5, giving at least 30 days' notice of any new sub-processor so the Controller can object
  • Assist the Controller with data subject rights requests
  • Delete or return all personal data at the end of the service
  • Make available all information necessary to demonstrate compliance

4. Security Measures

  • Encryption at rest (AES-256) and encryption in transit (TLS) on every connection between your browser and Quorate
  • Row-level security isolating each organisation's data
  • Dependency vulnerability auditing, and virus scanning of uploaded files
  • Access controls and audit logging
  • Data centre security (AWS eu-west-2, London)

5. Sub-processors

See the Sub-processor List at quorate.app/legal/sub-processors.

6. Data Transfers

Organisation data and account data are stored and processed in the United Kingdom (AWS, London region, eu-west-2). Requests reach Quorate through Amazon CloudFront edge locations in North America, Europe and Israel, and static files we serve may be cached there. Payment details are processed by Stripe, which may transfer them to the United States and other countries. Where personal data leaves the UK, the transfer relies on UK adequacy regulations where they apply (including the UK Extension to the EU–US Data Privacy Framework for certified recipients), or otherwise on the International Data Transfer Addendum to the EU Standard Contractual Clauses in the recipient's data processing terms. If your organisation turns on an optional integration listed on our Sub-processor List, that provider's transfer terms apply as described there.

7. Data Breach Notification

We will notify you without undue delay (and within 72 hours) of becoming aware of a personal data breach.

8. Term

This DPA remains in effect for the duration of the service agreement.