This addendum applies to studios and individual organizers using Quorin to process information about renters, staff and class customers. It is a public web-page addendum, not a downloadable DPA workflow. The version incorporated in the applicable service agreement identifies the agreed data-processing terms.

These data-processing terms apply when Quorin handles personal information on behalf of a studio or individual organizer under the applicable service agreement. The relevant studio or organizer determines the purposes of its customer administration, subject to applicable law. Quorin processes that information to perform the agreed services and lawful documented instructions. Each party remains responsible for processing it carries out for its own purposes, including applicable account, security and legally required transaction records. The legal characterization of each role follows the applicable privacy law and actual processing activity.

Quorin processes personal information on behalf of the studio or organizer only to perform the agreed services and lawful documented instructions, including bookings, class rosters, payments, communications and account access. Studio settings, generated renter terms, renter addenda, and renter-facing policies are studio instructions and responsibilities only to the extent lawful. Organizer instructions are subject to the same limit. General product improvement is not an unrestricted authorization to reuse customer information for another purpose. Any processing for a party's own purposes remains subject to its own lawful basis and duties.

Processed data may include names, phone numbers, emails, studio and organizer roles, class purchases and attendance, booking details, room and rate selections, payment status, payment-provider identifiers, communication logs, support and user-submitted AI content, audit events, device and security data, and usage records.

Quorin must protect personal information processed under this addendum with reasonable administrative, technical and organizational safeguards appropriate to its sensitivity and the processing risks, as required by applicable law. Platform controls include authenticated access, role-based restrictions and operational audit records. Access to confidential information must be limited to authorized persons who need it for the agreed services and are subject to confidentiality obligations. These obligations continue after their access or the services end. No platform or transmission method is guaranteed to be completely secure.

Quorin uses service providers for the enabled hosting, database, authentication, storage, payment, email, SMS, analytics and AI functions. Where a provider processes personal information on Quorin's behalf to perform these services, Quorin must limit the disclosure to what is needed and require protections appropriate to that processing and applicable law. Quorin remains responsible for its own selection, instructions and obligations concerning those providers. A provider may separately process information for its own lawful purposes under its applicable terms; that role does not transfer Quorin's own duties to the provider.

Personal information may be processed in Canada, the United States or other locations used for the enabled services. Before a transfer or processing arrangement takes place, each party must perform the assessments and put in place the protections required of it by applicable law. Where Quorin processes information on a studio's or organizer's behalf, it must provide the information about its processing reasonably needed for that party's legally required assessment. This clause does not itself supply an assessment, authorize a transfer prohibited by law or guarantee storage in a particular country.

Quorin must cooperate with the studio or organizer in responding to requests and inquiries concerning information processed on its behalf, and provide the assistance and access required by applicable law. Requests concerning Quorin's own processing may be sent to hello@quorin.studio. Each party remains responsible for its own notices to individuals and authorities.

Quorin must notify the studio or organizer of confidentiality events affecting information processed on its behalf, and allow legally required verification, in accordance with the applicable legal triggers and deadlines.

When the mandate or service contract ends, Quorin must stop using information processed solely on the studio's or organizer's behalf and return or securely delete it as required by applicable law and lawful documented instructions. Quorin must continue to protect any information lawfully retained and limit its use to the purpose justifying that retention.

Information that Quorin lawfully processes for its own purposes is governed by the Privacy Policy and applicable retention requirements. Calling a record an audit record, backup or platform record does not by itself justify keeping it. Platform limitations do not displace legal deletion or return duties. This addendum does not promise an immediate automated purge or a self-service export of all records.

This addendum is intended to be governed by Quebec law and the applicable federal laws of Canada, unless mandatory law requires otherwise.

Where section 18.3 of Québec's Act respecting the protection of personal information in the private sector applies, Quorin must notify the studio's or organizer's person in charge of personal information protection without delay of any violation or attempted violation, by any person, of a confidentiality obligation concerning the information communicated to Quorin. Quorin must also allow that person to verify compliance with confidentiality requirements. This obligation is not limited to a confirmed incident or a finding of serious injury. Other applicable notification requirements and deadlines continue to apply.

In particular, where section 18.3 of Québec's private-sector privacy law applies, Quorin must not keep that delegated information after the mandate or contract expires, except where retention is required by law.