QUANTAN — Data Processing Agreement

Quantan Innovations Pvt Ltd
Version 2.0 — Effective Date: 1 June 2025

THIS DATA PROCESSING AGREEMENT GOVERNS THE PROCESSING OF PERSONAL DATA BY QUANTAN INNOVATIONS PVT LTD ON BEHALF OF PRINT SHOP OPERATORS USING THE QUANTAN PLATFORM. IT IS INCORPORATED INTO AND FORMS PART OF THE TERMS OF SERVICE.

1. Parties and Background

This Data Processing Agreement ('DPA' or 'Agreement') is entered into between:

Data Controller (Controller):

The print shop operator or business entity ('you', 'Client', or 'Controller') that subscribes to and uses the Quantan platform, including the Quantan Software and Quantan Kiosk. As the Controller, you determine the purposes and means of processing personal data of your end customers (print job submitters) through the platform.

Data Processor (Processor):

Quantan Innovations Pvt Ltd, G No. 1050, Mauli Nivas, Nr. Methar Mery Society, Wagholi, Haveli, Pune – 412207, Maharashtra, India ('Quantan Innovations'). As the Processor, Quantan Innovations processes personal data on your behalf as instructed through the operation of the platform.

This DPA is drafted in compliance with the Digital Personal Data Protection Act, 2023 ('DPDP Act, 2023'), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ('SPDI Rules'), and all other applicable Indian data protection laws.

2. Definitions

• 'Personal Data' means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act, 2023.
• 'Processing' means any operation performed on Personal Data including collection, storage, use, sharing, disclosure, deletion, or transmission.
• 'Data Principal' means the individual to whom Personal Data relates — in this context, the end customers who submit print jobs through the Quantan Kiosk or Software.
• 'Data Fiduciary' has the meaning ascribed under the DPDP Act, 2023, and corresponds to the Controller under this DPA.
• 'Consent Manager' means a registered entity under the DPDP Act, 2023 through which Data Principals may manage consent, where applicable.
• 'Sub-Processor' means any third party engaged by Quantan Innovations to process Personal Data on behalf of the Controller.
• 'Security Incident' means any unauthorised access, disclosure, alteration, loss, or destruction of Personal Data.

Part A — Nature and Scope of Processing

3. Subject Matter and Nature of Processing

3.1 Categories of Personal Data Processed

In the course of providing the platform services, Quantan Innovations may process the following categories of Personal Data on behalf of the Controller:

• End customer names and contact details, where collected through the Quantan Kiosk;
• Print job files, document content, and metadata submitted by end customers;
• Device identifiers and usage logs associated with the Controller's registered devices;
• Transaction references related to print job processing.

3.2 Purpose of Processing

Quantan Innovations processes Personal Data solely for the following purposes as instructed by the Controller:

• Operating and delivering the platform's print management functionality;
• Transmitting print jobs between the Quantan Kiosk, Software, and connected printers;
• Storing print job records for queue management and job tracking;
• Providing technical support, diagnostics, and remote monitoring as authorised by the Controller;
• Complying with applicable Indian legal obligations.

Quantan Innovations will not process Personal Data for any purpose other than those specified above unless required by applicable law.

Part B — Obligations of the Parties

4. Obligations of the Controller

As the Data Controller, you represent, warrant, and agree that:

• You have a lawful basis for collecting and processing the Personal Data of your end customers, including obtaining valid consent where required under the DPDP Act, 2023;
• You will provide adequate notice to Data Principals (end customers) about the collection and processing of their Personal Data in connection with the platform;
• You will promptly inform Quantan Innovations of any changes to your processing instructions that may affect Quantan Innovations' obligations under this DPA;
• You will ensure that all Personal Data provided to Quantan Innovations for processing is accurate and lawfully collected;
• You will not instruct Quantan Innovations to process Personal Data in a manner that violates applicable Indian law or this DPA;
• You will implement appropriate organisational and technical measures on your own systems to protect Personal Data before it is transmitted to the platform.

5. Obligations of the Processor

Quantan Innovations, as the Data Processor, agrees to the following:

5.1 Process on Instructions Only

Process Personal Data only on documented instructions from the Controller, except where required to do so by applicable Indian law. Where Quantan Innovations is required by law to process Personal Data without the Controller's instruction, it will notify the Controller of such legal requirement before processing, unless prohibited by law.

5.2 Confidentiality

Ensure that all personnel authorised to process Personal Data are bound by appropriate confidentiality obligations and are aware of their data protection responsibilities.

5.3 Security Measures

Implement and maintain appropriate technical and organisational security measures to protect Personal Data, including:

• Certificate-based authentication for device-to-server communications;
• Encrypted transmission of Personal Data over HTTPS;
• Access controls and audit logging on cloud infrastructure;
• Secure storage of credentials and authentication tokens;
• Regular internal security assessments and vulnerability reviews.

5.4 Sub-Processors

Quantan Innovations may engage Sub-Processors (such as cloud infrastructure providers) to assist in delivering the platform services. Quantan Innovations will:

• Ensure all Sub-Processors are bound by data protection obligations equivalent to those in this DPA;
• Remain fully liable to the Controller for the acts and omissions of Sub-Processors in relation to Personal Data processing;
• Notify the Controller at least 15 (fifteen) days in advance of any intended changes to Sub-Processors where such changes affect the processing of Personal Data.

5.5 Data Principal Rights Assistance

Assist the Controller in fulfilling its obligations to respond to Data Principal rights requests under the DPDP Act, 2023, including requests for access, correction, and erasure, within timelines that allow the Controller to meet its statutory response obligations.

5.6 Security Incident Notification

Notify the Controller without undue delay, and in any event within 72 (seventy-two) hours of becoming aware of a Security Incident involving Personal Data processed under this DPA. The notification will include:

• A description of the nature of the Security Incident;
• The categories and approximate number of Data Principals affected;
• The likely consequences of the Security Incident;
• Measures taken or proposed to address the Security Incident.

5.7 Return or Deletion of Data

Upon termination of the Controller's subscription or upon written request, Quantan Innovations will, at the Controller's choice, delete or return all Personal Data processed under this DPA within 30 (thirty) days, unless retention is required by applicable Indian law.

Part C — Data Governance

6. Data Retention

Personal Data processed under this DPA will be retained only for as long as necessary to fulfil the purposes described in Section 3.2, or as required by applicable Indian law. Specific retention periods are as follows:

• Print job files and content: Retained only for the duration necessary to complete the print job, after which they are deleted unless the Controller enables extended retention through Software settings;
• Usage logs and device data: Retained for the duration of the active subscription and for up to 30 (thirty) days following subscription expiry;
• Transaction references: Retained for 5 (five) years to comply with applicable tax and audit requirements under Indian law;
• All other Personal Data: Retained until Controller account deletion or written erasure request, subject to statutory obligations.

7. Cross-Border Data Transfers

Quantan Innovations stores and processes all Personal Data within the territory of India, in compliance with the DPDP Act, 2023. No Personal Data will be transferred outside India without the Controller's prior written consent and compliance with applicable data transfer requirements under Indian law.

8. Audit Rights

The Controller may, upon 30 (thirty) days' prior written notice to legal@quantan.io, request reasonable information or documentation to verify Quantan Innovations' compliance with this DPA. Quantan Innovations will provide relevant compliance documentation within 15 (fifteen) business days of such request. Physical audits of Quantan Innovations' infrastructure are subject to mutual agreement on scope, timing, and costs.

Part D — General

9. Liability

Each party shall be liable for any damage caused to Data Principals by its own non-compliance with applicable data protection law or this DPA. Where both parties are jointly responsible for processing-related damage to a Data Principal, liability shall be allocated in proportion to each party's degree of responsibility. Nothing in this section limits either party's liability to Data Principals under applicable Indian consumer protection or data protection law.

10. Term and Termination

This DPA is effective from the date the Controller activates the platform and remains in force for the duration of the Controller's active subscription. This DPA terminates automatically upon termination or expiry of the Terms of Service. Upon termination, the provisions of Section 5.7 (Return or Deletion of Data) shall apply. Sections 5.2, 6, 9, and 11 shall survive termination.

11. Governing Law

This DPA shall be governed by and construed in accordance with the laws of the Republic of India, including the DPDP Act, 2023, the Information Technology Act, 2000, and the SPDI Rules, 2011. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the competent courts in Pune, Maharashtra, India.

12. Contact

For all data processing inquiries, breach notifications, or formal DPA-related communications:

Legal and Compliance
Quantan Innovations Pvt Ltd
G No. 1050, Mauli Nivas, Nr. Methar Mery Society, Wagholi, Haveli, Pune – 412207, Maharashtra, India
Email: legal@quantan.io
Website: https://www.quantan.io

Quantan Innovations Pvt Ltd — Version 2.0 — Effective 1 June 2025
© 2025 Quantan Innovations Pvt Ltd — legal@quantan.io