Q-Meet Data Processing Agreement

1. Parties and Roles

The parties are:

• Controller: the Customer using Q-Meet and determining the purposes and means of the relevant processing ("Customer" or "Controller").
• Processor: Qbim Aktiebolag (QBIM AB), Swedish company registration number 556944-6981, Västra Torggatan 18, 652 24 Karlstad, Sweden ("QBIM" or "Processor").

Where the Customer itself acts as processor for another controller, QBIM acts as sub-processor and the Customer confirms that it is authorised to appoint QBIM.

2. Purpose, Instructions and Allocation of Responsibility

This DPA governs QBIM's processing of personal data on behalf of the Customer in connection with Q-Meet and is intended to satisfy Article 28 GDPR.

The Customer is controller for Customer Personal Data submitted to, generated in or otherwise processed through Q-Meet. QBIM acts as processor and shall process Customer Personal Data only on the Customer's documented instructions, this DPA and applicable law. The Customer's use and configuration of Q-Meet, selection of meetings for processing and activation of optional integrations constitute documented instructions within the agreed functionality of the Service.

If Union or Member State law requires QBIM to process Customer Personal Data beyond the Customer's instructions, QBIM shall, where legally permitted, inform the Customer before the processing takes place.

QBIM shall inform the Customer without undue delay if QBIM considers an instruction to infringe GDPR or other applicable Union or Member State data protection law.

The Customer is responsible for determining the purposes of processing, establishing an appropriate lawful basis, providing required information to data subjects, ensuring that meetings are recorded and processed lawfully, obtaining consent or other approval where required and ensuring that the processing is necessary and proportionate.

3. Nature, Purpose and Scope of Processing

QBIM processes personal data to provide Q-Meet, an AI-assisted meeting service for recording or receiving meeting audio, transcription, meeting documentation, AI-based analysis, storage, search, retrieval and related meeting functionality.

For a meeting selected by the Customer for processing, Q-Meet captures or receives audio, produces a transcript and performs AI-based analysis to generate meeting outputs. The Customer determines which meetings are processed. Calendar integration is optional and may be left inactive or disabled. Q-Meet does not provide CRM or telephony integration and does not connect to the Customer's email mailbox; meeting summaries may however be sent by email as a system delivery function.

3.1 Categories of Data Subjects

• Customer employees and consultants.
• Officers and representatives.
• Customers, prospective customers, suppliers and partners.
• Meeting participants and contact persons.
• Other persons whose information is included in meetings, uploaded material or an activated integration.

3.2 Categories of Personal Data

• Names, email addresses, telephone numbers and other contact information.
• User, authentication and technical account identifiers.
• Meeting and calendar metadata, including participation information.
• Audio and voice data during recording and transcription. Voice data is not used for biometric identification.
• Transcripts, notes, summaries, decisions, action points, follow-up information and other AI-generated meeting content.
• Professional, business-related and other information expressed during meetings or contained in uploaded material.
• IP address, user agent, traffic metadata and operational, security and access logs.

Q-Meet does not require special categories of personal data under Article 9 GDPR or Article 10 data for its ordinary functionality. Such information may nevertheless occur incidentally in meeting content. The Customer is responsible for determining whether any such processing is necessary and lawful.

Q-Meet does not perform solely automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR. Q-Meet is not intended for biometric identification, emotion detection or equivalent behavioural profiling.

3.3 Retention During the Agreement

Customer Personal Data in the primary Service environment is retained for as long as the Customer uses the Service and the data is required for the functionality selected by the Customer, unless the Customer deletes it earlier. The Customer can delete individual meetings and users and may request full deletion.

Operational backups have a rolling technical retention of 7 days. On termination, the specific deletion periods in Section 9 apply. Temporary working copies are used only for technical processing required to provide the Service and are cleared in accordance with applicable operational and lifecycle routines. High-level data flows and retention are described in Appendix 1.

3.4 Restriction on Use and AI Model Training

QBIM shall not use Customer Personal Data for its own purposes such as marketing, profiling, independent product development, independent statistics or training AI models. Product and quality development may be performed using anonymised or aggregated information that no longer constitutes personal data. AI providers are engaged as sub-processors only to perform processing required for the Service. QBIM does not make a Zero Data Retention (ZDR) commitment unless it has been specifically verified and agreed for the relevant provider and configuration.

4. Technical and Organisational Security Measures

Taking into account the nature, scope, context and purposes of processing and the risks to the rights and freedoms of individuals, QBIM shall implement appropriate technical and organisational measures in accordance with Article 32 GDPR. The following summarises the measures applied to Q-Meet and shall be read together with Appendix 2.

4.1 Encryption and Key Management

• Customer Personal Data in the primary storage environment is encrypted at rest using AES-256 or equivalent provider-managed encryption.
• Sensitive integration credentials are additionally protected through application-level encryption where applicable. Encryption keys are managed through provider security mechanisms and access-controlled key management systems.
• QBIM applies encrypted transport to internet-facing web and API flows and primary storage services. TLS 1.2 or higher is used for those flows where the protocol is applicable. QBIM manages transport protection for other internal and external data flows on a risk-based basis.
• Recordings stored locally on a Customer device are protected by the device and operating system storage and access controls.

4.2 Access, Administrative Access and Confidentiality

QBIM applies role-based access control and the principle of least privilege. A limited group of authorised development and operations personnel, together with necessary service identities, have technical production access where required for operations, support, security, backup or deployment.

QBIM personnel may access Customer Personal Data only where necessary for requested support and troubleshooting, service recovery, security work or other explicit Customer instructions. Access shall be limited to what is necessary for the task and performed by authorised personnel subject to confidentiality obligations.

MFA is used for central interactive administrative access paths. Other administrative access paths and non-interactive service identities are protected by role-based permissions, separate credentials and platform-specific security controls.

4.3 Customer Isolation (Tenant Isolation)

Q-Meet uses customer isolation in multiple layers. Customer data is separated through separate customer environments and data stores where appropriate and through authenticated tenant-based access controls in shared services.

Customer isolation is verified through application testing, code review, threat modelling and access-control checks in connection with relevant changes.

4.4 Logging, Vulnerability Management and Patching

Access and security logging is used for operations, troubleshooting, incident handling and security follow-up and is applied based on each system's function, risk and processing purpose. Logging coverage and retention may therefore vary between systems and access paths. Operational logs normally have 14 days retention and platform/security logs may be retained for longer periods.

QBIM performs recurring dependency, configuration and vulnerability checks and handles identified findings through its ordinary prioritisation and patch process. Infrastructure and platform updates are performed on an ongoing basis and production releases are planned, tested and deployed in a controlled manner.

4.5 External Security Review

QBIM performs recurring external security controls through a specialised external security service for attack-surface scanning and identification of security vulnerabilities. Identified findings are handled through QBIM's security, prioritisation and patch processes.

QBIM's security work is supplemented by recurring external security controls. Current information on certifications and other external security reviews may be provided on request to the extent relevant to the Customer's assessment.

5. Sub-processors and International Transfers

The Customer grants QBIM general prior authorisation to engage the sub-processors identified in Appendix 1 and the current Q-Meet Sub-processor List. QBIM shall ensure through written agreements that sub-processors are subject to data protection obligations that, in relevant respects, provide the protection required by this DPA and Article 28 GDPR.

Appendix 1 constitutes the complete list of sub-processors used by QBIM to process Customer Personal Data as of the version date. QBIM shall provide at least 30 days' written notice before appointing a new material sub-processor or making a material change to such processing. The Customer may object on reasonable and documented data-protection grounds. If the Parties cannot resolve a well-founded objection, the Customer may terminate the affected part of the Service before the relevant processing begins.

Where personal data is transferred to or made accessible from a country outside the EU/EEA, QBIM shall ensure that a valid transfer mechanism under Chapter V GDPR is used. Where the European Commission has adopted an adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework for eligible participating US organisations, the transfer may rely on that decision. Otherwise, where applicable, the European Commission Standard Contractual Clauses (SCC) under Article 46 GDPR are used together with relevant supplementary technical and organisational safeguards.

QBIM has conducted and documented a Transfer Impact Assessment (TIA) for the identified international transfers and transfer mechanisms used for Q-Meet. The assessment is reviewed at least annually and earlier upon material changes to sub-processors, data flows, processing regions, transfer mechanisms or relevant law. On request, QBIM may provide relevant information regarding the TIA and its conclusions, taking into account security, confidentiality and trade-secret interests.

5.1 Public Authority Requests

Where legally permitted, QBIM shall notify the Customer if QBIM receives a binding public-authority request requiring disclosure of Customer Personal Data. QBIM shall disclose only the information legally required and, where appropriate and reasonably possible, may challenge a request that it reasonably considers unlawful or disproportionate.

6. Data Subject Rights, DPIA and Audits

Taking into account the nature of the processing and to the extent possible, QBIM shall assist the Customer through appropriate technical and organisational measures in fulfilling obligations concerning data subject rights, including access, rectification, erasure, restriction, objection and portability.

On request, QBIM shall provide information about the Service processing that the Customer reasonably needs to assess lawful basis, necessity and proportionality and to carry out a data protection impact assessment under Article 35 GDPR.

QBIM shall make available information necessary to demonstrate compliance with Article 28 GDPR. Review shall first take place through available documentation and security materials. If this is not sufficient, QBIM shall, with reasonable advance notice, permit and contribute to an audit or inspection performed by the Customer or an independent auditor. Such audit shall normally take place no more than once in any twelve-month period unless an additional audit is required due to a Personal Data Breach, binding authority requirement or another concrete and objectively justified circumstance. Audits shall be performed during normal business hours, minimise disruption and not compromise Service security, other customers' information or QBIM trade secrets. The Customer bears its own audit costs. Reasonable support required under Article 28 GDPR is included; work beyond this may be charged by separate agreement.

7. Information to Meeting Participants

The Customer is responsible as controller for ensuring an applicable lawful basis for recording, transcription and other processing and for providing data subjects with information required under GDPR and other applicable law.

For digital meetings where the Q-Meet meeting bot is used, Q-Meet is displayed as a meeting participant. The bot's visibility is a technical transparency signal but does not itself constitute consent or replace the Customer's information obligations. QBIM recommends that the user expressly informs participants that the meeting will be recorded and/or transcribed before the processing begins.

For physical meetings or other recording situations where no Q-Meet bot or equivalent technical indicator is visible, the Customer/user must provide the information to participants before recording begins.

Recommended notice that the Customer may adapt: "We use Q-Meet to record and transcribe this meeting for documentation and follow-up. The organisation that invited you to the meeting is the data controller for this processing. Please contact the meeting organiser for further information about the processing and your rights."

8. Personal Data Breaches

Where a Personal Data Breach affects Customer Personal Data processed by QBIM on behalf of the Customer, QBIM shall notify the Customer without undue delay and no later than 24 hours after QBIM becomes aware of the incident.

The initial notification shall, to the extent information is then available, include:

• a description of the nature of the incident;
• the systems, data categories and categories of data subjects potentially affected;
• known or likely consequences;
• containment, mitigation and remediation measures taken or planned; and
• contact details for continued incident handling.

Where complete information is not available at the time of the first notification, information may be provided in phases without undue delay. Incident contact: support@qbim.se.

QBIM's incident process includes identification and initial containment, assessment of scope and affected customers, technical and organisational measures, customer communications, documentation, root-cause analysis and corrective actions.

9. Exit, Return and Deletion

On termination, QBIM shall, at the Customer's choice, delete or return the Customer Personal Data processed on the Customer's behalf and thereafter delete existing copies unless continued storage is required under applicable Union or Member State law.

On request, QBIM shall return Customer Personal Data that remains at termination in an existing and technically available standard format. Text and structured data is normally returned in CSV or another existing export format. Audio files that remain stored at the time of return shall be returned in their existing technical format to the extent covered by the Customer's request.

Return under the preceding paragraph concerns existing data in an existing standard format. Work involving special structuring, conversion, migration, compilation, customer-specific formats or migration support may be charged according to QBIM's then-current consulting rates after agreement with the Customer.

If the Customer chooses deletion, or after requested return has been completed, QBIM shall initiate deletion of Customer Personal Data. The practical timing may be coordinated with the Customer to enable return, but Customer Personal Data in primary systems shall be deleted no later than 30 days after termination unless continued retention is required by applicable law.

QBIM shall ensure that Customer Personal Data processed on the Customer's behalf is also deleted by relevant sub-processors in accordance with this DPA and each sub-processor's applicable deletion and retention processes.

Backups remain subject to equivalent confidentiality and security requirements and are progressively deleted no later than 90 days after termination. During that period backup copies are used only for recovery and continuity purposes and are not returned to active processing except where necessary for recovery. On request, QBIM may provide written confirmation after the deletion process has been completed in accordance with this DPA.

10. Liability and Damages

Liability for damage caused by processing in breach of GDPR shall be assessed and allocated in accordance with Article 82 GDPR and applicable data-protection law. Administrative fines shall be borne by the Party on which the relevant authority imposes the fine, without prejudice to any right of recourse under law or contract.

Each Party shall inform the other without undue delay of circumstances reasonably likely to cause material harm relating to the processing and shall reasonably cooperate to prevent and limit such harm.

Unless mandatory law provides otherwise, the Parties' inter-party liability under this DPA is subject to the liability limitations and exclusions in the Agreement. This does not limit data subjects' rights under GDPR or liability that cannot be limited under mandatory law.

11. Term, Changes and Governing Law

This DPA applies for as long as QBIM processes Customer Personal Data on behalf of the Customer. In the event of conflict between this DPA and the Agreement, this DPA prevails with respect to processing of Customer Personal Data on behalf of the Customer.

Changes to this DPA shall be made in writing. Updates to the complete sub-processor list are handled in accordance with Section 5 and do not require separate signature unless the Customer objects through that process.

This DPA is governed by Swedish law. Disputes shall be handled under the dispute-resolution provision in the Agreement or, if none exists, by the Swedish courts.

Appendix 1 – Sub-processors, Data Locations and Data Flows

This Appendix constitutes QBIM's complete Q-Meet sub-processor list and high-level data-flow description as of 15 September 2026.

Microsoft Azure provides the primary hosting environment for Q-Meet. The primary hosting region for Customer Personal Data is Sweden Central, Sweden.

Appendix 2 – Summary of Technical and Organisational Measures (TOM)

Contact