GDPR Data Transfer Terms

Quant Fusion GDPR Data Transfer Terms

These Annexes form part of the Standard Contractual Clauses adopted by the European Commission on June 4, 2021 (Module Two, controller to processor) and are incorporated by reference into the International Transfers section of the Quant Fusion Terms of Service. By accepting the Quant Fusion Terms of Service, Customer agrees to be bound by these Annexes with respect to transfers of Personal Data from the European Economic Area, United Kingdom, or Switzerland to Quant Fusion in the United States. These Annexes will be updated from time to time. Material changes will be communicated per the Modifications section of the Terms of Service.

ANNEX I — DESCRIPTION OF PROCESSING

A. List of Parties

Data Exporter The business entity that has accepted the Quant Fusion Terms of Service and submits Personal Data to the Platform for processing. The Data Exporter acts as Data Controller.

Data Importer (Quant Fusion) Quant Fusion, LLC, a Florida limited liability company. Contact: [email protected] Role: Data Processor

B. Description of Transfer

Categories of data subjects Individuals whose personal data is contained in Customer Data submitted to the Platform, including employees, contractors, and business contacts of Customer and its customers, counterparties, and end users.

Categories of personal data Names, job titles, and contact information of individuals associated; user credentials for Platform access.

Sensitive data None anticipated. Customer shall not upload special category data to the Platform without prior written agreement with Quant Fusion.

Frequency of transfer Ongoing; data is transferred continuously during the Subscription Term as Customer Data is uploaded to or processed by the Platform.

Nature of processing Processing of Customer Data to perform the services described in the Quant Fusion Terms of Service.

Purpose of transfer To enable Quant Fusion to provide the Platform and perform its obligations under the Quant Fusion Terms of Service.

Retention period For the duration of the Subscription Term. Customer Data is deleted within sixty (60) days of termination, or returned upon Customer's written request, per the Term and Termination section of the Terms of Service.

C. Competent Supervisory Authority

The competent supervisory authority is determined in accordance with Clause 13 of the SCCs. For Customers established in Germany, the competent authority is the relevant German state data protection authority (Landesbeauftragte für Datenschutz). For Customers established elsewhere in the EEA, the competent authority is that of the Customer's establishment.

ANNEX II — TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Quant Fusion's technical and organizational security measures are described in the Security Measures section of the Quant Fusion Privacy Policy, available at quant-fusion.com.

ANNEX III — LIST OF SUB-PROCESSORS

Customer authorizes Quant Fusion to engage the following categories of sub-processors. The current list of authorized sub-processors is available upon written request per the Data and Privacy section of the Terms of Service. Updates to this list are governed by the Data Processing section of the Terms of Service.