This Data Processing Addendum (“DPA”) forms part of the agreement governing the Customer’s use of myQuest Skills, including the applicable signed agreement, order form, and Terms of Service (collectively, the “Agreement”).
This DPA applies between MyQuest Ltd. (“myQuest”) and the organization receiving the Services (“Customer”) where myQuest processes personal data on the Customer’s behalf.
“Customer Personal Data” means personal data processed by myQuest on behalf of the Customer in connection with the Services.
“Data Protection Laws” means privacy and data protection laws applicable to that processing, including, where applicable, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and applicable Israeli and United States privacy laws.
“Sub-processor” means a third party, including a myQuest affiliate, engaged to process Customer Personal Data on the Customer’s behalf.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
Other data protection terms have the meanings given to them under applicable Data Protection Laws.
The Customer acts as controller and myQuest acts as processor. Where the Customer acts as a processor for another controller, myQuest acts as its sub-processor, and the Customer must have authority to appoint and instruct myQuest.
myQuest will process Customer Personal Data only on documented Customer instructions, including instructions concerning international transfers, unless applicable law requires otherwise. In that case, myQuest will inform the Customer before processing unless legally prohibited.
The Agreement, this DPA, the Customer’s configuration of the Services, and documented requests from authorized Customer representatives constitute those instructions.
myQuest may select the technical means necessary to carry out the instructions, subject to this DPA. It will promptly inform the Customer if, in its opinion, an instruction infringes applicable Data Protection Laws.
The details of processing are set out in Schedule 1.
The Customer must establish an appropriate legal basis for processing, provide required privacy notices, obtain and record permissions or consents where required, and ensure that its instructions comply with applicable Data Protection Laws.
The Customer manages User permissions and must promptly communicate requests requiring myQuest’s assistance so that applicable legal deadlines can be met.
These responsibilities do not exclude obligations imposed directly on myQuest by law.
myQuest will ensure that authorized personnel are subject to contractual or statutory confidentiality obligations and that access is limited to what is necessary to provide, operate, secure, and support the Services, including requested content development and implementation services.
myQuest will maintain appropriate technical and organizational measures under applicable Data Protection Laws, taking account of the processing and risks to individuals. These measures are summarized in Schedule 2 and may be updated without materially reducing the overall protection of Customer Personal Data.
The Customer authorizes processing by approved AI Sub-processors to provide enabled features, including simulations, transcription, assessment, feedback, and content authoring assistance.
Customer content and Customer Personal Data are not used by myQuest to train, fine-tune, or build AI models.
AI diagnostic logs may contain prompts, model responses, and conversation text. They remain subject to this DPA, with access limited to authorized personnel for troubleshooting, security, and investigation of service issues.
These permissions do not authorize unrelated product development, cross-customer analytics, or use of Customer content to develop content for other customers.
The Customer grants general written authorization for myQuest and its Sub-processors to engage further Sub-processors in accordance with this section. Relevant providers are identified in the published sub-processor list.
myQuest will assess relevant Sub-processors before engagement, impose written data protection obligations meeting applicable legal requirements and providing protection consistent with this DPA, and remain responsible for their performance of those obligations.
myQuest will notify the Customer of intended additions or replacements by email or an in-service notice and update the published list. The Customer will have seven days to object on reasonable data protection grounds before the new Sub-processor begins processing its data.
The Parties will work in good faith to resolve an objection. myQuest will not begin the disputed processing while the objection remains unresolved. If no reasonable solution is available, either Party may terminate the affected portion of the Services without a termination penalty. Other financial consequences remain subject to the Agreement.
Customer Personal Data may be processed in countries other than the Customer’s country, including the United States, where myQuest’s hosting infrastructure and certain service providers are located.
Where required by applicable Data Protection Laws, myQuest will ensure that international transfers are covered by an appropriate transfer mechanism, including an applicable adequacy decision or standard contractual clauses approved by the European Commission.
The Customer may contact support@myquest.co for further information about applicable safeguards.
Mandatory standard contractual clauses applicable to a transfer prevail over conflicting provisions of this DPA or the Agreement.
myQuest will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and, where feasible, no later than 48 hours after becoming aware.
The notice will describe, to the extent known, the breach, affected data and individuals, likely consequences, measures taken or proposed, and a contact for further information. Available information may be provided in stages without delaying initial notification.
myQuest will investigate, contain, and mitigate the breach and assist the Customer with applicable notification obligations. Notification does not itself constitute an admission of liability.
Any shorter notification period expressly agreed in a signed agreement remains applicable.
Taking account of the processing and information available to it, myQuest will provide appropriate assistance with individuals’ rights requests, security obligations, breach notifications, data protection impact assessments, and required consultations with supervisory authorities.
Requests received directly from individuals concerning Customer Personal Data will be promptly referred to the Customer. myQuest will respond substantively only on the Customer’s instructions or as required by law, informing the Customer of that requirement where permitted.
The Customer determines responses concerning processing under its control. Reasonable charges for assistance beyond standard functionality and support may be agreed in advance, except where required because of myQuest’s breach. Charges must not delay or prevent legal compliance.
myQuest will retain Customer Personal Data only as necessary to provide the Services under the Customer’s documented instructions and applicable law.
Upon the Customer’s request or at the end of the processing Services, myQuest will return or delete Customer Personal Data, at the Customer’s choice, and delete remaining copies unless retention is required by law. Continued storage for possible account reactivation may be agreed in writing for a specified period.
Deletion will be carried out without undue delay and within applicable legal deadlines. Backups and logs may be deleted through defined retention cycles, provided that any continued retention is lawful, access is restricted, and the information is not used for unrelated purposes. Relevant deletion instructions will also apply to Sub-processors.
myQuest will provide information about applicable retention periods and confirm the status of deletion upon request.
myQuest will provide information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, by the Customer or an authorized independent auditor.
The Customer will ordinarily first review relevant security documentation, certifications, and available audit reports. Further audits will be coordinated on reasonable advance notice, subject to confidentiality safeguards and protection of other customers’ information.
Audits will ordinarily occur during business hours, no more than once in twelve months, and with reasonable measures to avoid disruption. These limits do not prevent additional or urgent audits required by law, a supervisory authority, a Personal Data Breach, or reasonable evidence of noncompliance.
The Customer will bear reasonable audit costs, subject to applicable law and any different written agreement. Audit arrangements must not restrict mandatory audit rights or disclosure to competent supervisory authorities.
The Agreement’s liability and indemnification provisions apply to this DPA, including claims arising from its breach. Nothing limits individuals’ statutory rights, supervisory authorities’ powers, or obligations that cannot lawfully be excluded or limited.
This DPA prevails over conflicting provisions concerning Customer Personal Data, unless expressly modified by a signed data processing agreement and permitted by law. It does not authorize processing prohibited by the Agreement.
The Agreement’s governing law and jurisdiction provisions apply, except where mandatory Data Protection Laws or applicable transfer clauses require otherwise.
The Parties will cooperate on amendments reasonably necessary to comply with changes in Data Protection Laws. Associated commercial changes must be agreed separately and must not authorize unlawful processing.
If a provision is unenforceable, the remaining provisions continue in effect. This DPA remains effective while myQuest processes Customer Personal Data on the Customer’s behalf.
Data protection requests and notices may be sent to support@myquest.co.
myQuest maintains measures proportionate to the processing risks, including:
Last updated: October 2026