Data Processing Agreement

Last updated 4 October 2026

1. Scope

This Data Processing Agreement ("DPA") is part of the agreement between Customer and Max Kugland, trading as Quinta5 ("Quinta5"), made up of the Order Form and the Terms of Service. It applies whenever Quinta5 processes personal data in Customer Data on Customer's behalf, and implements Art. 28 GDPR. Customer is the controller; Quinta5 is the processor. Terms defined in the GDPR and the Terms of Service have the same meaning here.

2. Details of processing

Subject matter, nature and purpose, the types of personal data and the categories of data subjects are set out in Annex 1. The DPA applies for as long as Quinta5 processes personal data for Customer.

3. Instructions

Quinta5 processes personal data only on Customer's documented instructions. The agreement and Customer's use of the Service are those instructions: storing, searching and drafting at a user's request, and giving connected AI assistants access when a user connects one. The exception is processing required by EU or member state law; Quinta5 then informs Customer beforehand unless the law prohibits this. Quinta5 tells Customer if it considers an instruction to infringe data protection law.

4. Confidentiality

Everyone Quinta5 authorizes to process personal data is bound to confidentiality.

5. Security

Quinta5 maintains the technical and organizational measures in Annex 2 (Art. 32 GDPR) and may improve them, as long as the level of protection does not fall.

6. Sub-processors

Customer authorizes the sub-processors in Annex 3. Quinta5 announces a new or replacement sub-processor at least 30 days in advance. Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, either party may terminate the affected part of the Service. Quinta5 imposes equivalent data protection obligations on each sub-processor and remains responsible for them.

A third-party AI assistant that a user connects to Quinta5 is not a sub-processor of Quinta5: Customer engages it under its own agreement with that provider.

7. Transfers outside the EU/EEA

Quinta5 transfers personal data outside the EU/EEA only with safeguards under Chapter V GDPR, as stated for each sub-processor in Annex 3.

8. Assistance

Quinta5 helps Customer, as far as the nature of the processing allows, to answer data subject requests (Chapter III GDPR) and to meet its obligations under Art. 32–36 GDPR. Requests Quinta5 receives directly from data subjects are forwarded to Customer.

9. Personal data breaches

Quinta5 notifies Customer of a personal data breach affecting Customer Data without undue delay, and in any event within 48 hours of becoming aware of it, with the information Customer needs for its own notifications (Art. 33 and 34 GDPR), supplementing it as more becomes known.

10. Deletion and return

When the agreement ends, Quinta5 provides Customer Data to Customer on request in a machine-readable format for 30 days, then deletes it, unless EU or member state law requires it to be kept. Deleted data remains in backups until those backups are deleted automatically 365 days after they were made. Customer can also request deletion earlier.

11. Audits

Quinta5 provides the information needed to demonstrate compliance with this DPA. Customer may audit, itself or through an auditor bound to confidentiality, with at least 30 days' notice, during business hours, and no more than once a year unless there is a specific reason. Audits must not disclose other customers' data.

12. Liability and precedence

Liability is governed by the Terms of Service; Art. 82 GDPR remains unaffected. If this DPA and the Terms of Service conflict on the processing of personal data, this DPA prevails.

Annex 1 — Details of processing

Subject matter and purpose

Providing the Service: storing, organizing and searching the material Customer's users upload to or create in Quinta5, and drafting answers, summaries and reports from it at a user's request. No other purpose; in particular no training of AI models.

Nature of processing

Storage, structuring, retrieval, search (including semantic search with embeddings), AI-assisted drafting, disclosure to connected AI assistants at a user's request, backup, deletion.

Categories of data subjects

Candidates, referees, interviewees, client contacts and other people named in Customer Data; Customer's users where they appear in Customer Data, for example as authors of notes.

Types of personal data

Identification and contact details, career history, interview and reference content, assessments written by Customer's users, and any other data Customer includes. Special categories of data (Art. 9 GDPR) only where Customer includes them and has a legal basis to do so.

Duration

The term of the agreement, then deletion under Section 10.

Annex 2 — Technical and organizational measures

• Encryption in transit: all connections to the Service use TLS.
• Separation: each customer's data is isolated at the database level with row-level security, so it cannot be reached through another customer's account or credentials.
• Authentication: no passwords; sign-in links are single-use and expire after 15 minutes; API keys and assistant credentials are stored only as hashes; every access is tied to a personal account.
• Application security: protection against cross-site request forgery, a strict content security policy, request rate limits and request logging.
• Operator access: only the operator of Quinta5 has administrative access across customers, and uses it only to run and support the Service.
• Hosting: application and database run on servers of Hetzner Online GmbH in Germany.
• Backups: the database is backed up daily to Amazon S3 in Frankfurt, Germany. Backups are transferred over TLS, stored encrypted (AES-256) with public access blocked, and deleted automatically after 365 days.

Annex 3 — Sub-processors

Hetzner Online GmbH, Gunzenhausen, Germany

Hosting of the application and database. Location: Germany.

Amazon Web Services EMEA SARL, Luxembourg

Storage of daily database backups (Amazon S3). Location: Frankfurt, Germany.

OpenAI Ireland Ltd, Dublin, Ireland

Embeddings for search and AI-assisted drafting. Processing in the United States by OpenAI affiliates under the EU Standard Contractual Clauses. Data sent through the API is not used for training and is kept for abuse monitoring for up to 30 days.

Contact

Questions about this DPA: max@quinta5.com. Our full details are in the imprint.