Data Processing Addendum

This DPA applies to personal data your organisation submits to the IMSQ platform — your users’ account data, learning and engagement records, and related content. For that data, your organisation acts as controller and IMSQ as processor. For IMSQ’s own operations (billing relationships, security telemetry, its Expert registry), IMSQ acts as an independent controller as described in the Privacy Policy.

Subject matter: delivery of the IMSQ capability platform. Duration: your subscription term plus the wind-down described in the Privacy Policy’s retention section. Nature and purpose: hosting, structured learning delivery, engagement facilitation, governance-record production, and support. Data subjects: your organisation’s users. Data categories: the categories listed in the Privacy Policy’s "Data we process" section.

IMSQ processes your organisation’s data only to operate the service and on your documented instructions; limits access to personnel bound by confidentiality; applies the security measures described in the Privacy Policy (row-level tenant isolation, MFA on privileged roles, encryption in transit and at rest, rate limiting, continuous error monitoring); assists with data-subject requests through the documented rights process; and notifies you without undue delay on becoming aware of a personal-data breach affecting your data.

IMSQ uses the following sub-processors to operate the service. Changes to this list are versioned in this document; the current list is always published here and on the Trust page.

Supabase — Database, authentication, file storage. Region: United States (us-east-1, AWS).

Stripe — Payment processing. Region: United States (primary), per Stripe's published sub-processor list.

Resend — Transactional email delivery. Region: United States.

Vercel — Hosting, edge network, cookieless analytics. Region: United States (primary).

Microsoft (Teams / Microsoft 365) — Operational notifications, corporate email tenant. Region: United Kingdom (tenant data location).

Sentry — Error monitoring. Region: European Union (Frankfurt).

Processing locations are stated per sub-processor above. Where personal data moves between regions, it does so under each named provider’s published data-protection framework (each maintains its own DPA and standard contractual protections).

At term end (or on verified request), your administrators can obtain an export of your account data, after which data is deleted or de-identified per the Privacy Policy’s retention section. Reasonable information needed for your supplier-governance file — including this DPA, the sub-processor list, and security-posture summaries — is available via privacy@imsq.org.

This published DPA states IMSQ’s standard processing terms. To execute a countersigned copy, contact privacy@imsq.org.