Data Processing Addendum
Last updated: September 26, 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between WEDO4U LTD, trading as QubeHub (“Processor”), and the customer (“Controller”) for the QubeHub platform. That agreement is either the Terms of Service or a signed subscription agreement. This DPA applies whenever QubeHub processes personal data on the Controller’s behalf. It takes effect automatically, with no signature needed. A signed copy is available on request from [email protected].
If a signed agreement contains its own data processing terms, those terms prevail over this DPA.
1. Definitions
Terms such as “personal data”, “processing”, “controller”, “processor”, “personal data breach” and “data subject” have the meanings given in Regulation (EU) 2016/679 (“GDPR”). “Data Protection Laws” means:
- the GDPR;
- Cyprus Law 125(I)/2018;
- Directive 2002/58/EC, as implemented in Cyprus.
2. Roles and instructions
2.1 The Controller determines the purposes and means of processing personal data in its Customer Data. QubeHub processes that data as processor.
2.2 QubeHub processes personal data only on the Controller’s documented instructions. The Controller’s instructions are:
- the agreement;
- the Controller’s configuration of the platform;
- any further written instructions that the two sides agree.
This applies unless the law requires otherwise. In that case, QubeHub will tell the Controller before processing, unless the law prohibits it.
2.3 QubeHub will tell the Controller if it believes an instruction breaches Data Protection Laws.
2.4 QubeHub does not sell Controller personal data. It does not use that data for its own purposes or combine it with other customers’ data. QubeHub may use aggregated, anonymised statistics that cannot be linked to the Controller, to any individual or to any property or transaction.
3. Details of processing
- Subject matter and duration. Provision of the QubeHub platform for the subscription term, plus the post-termination export period in section 10.
- Nature and purpose. Hosting, storage, transmission and processing of Customer Data to provide:
- portfolio management, CRM, rentals and marketing;
- AI pre-qualification and outreach;
- partner and client portals;
- integrations;
- onboarding, migration and support.
- Data subjects. The Controller’s leads, prospects, buyers, tenants, agents, personnel and other contacts.
- Categories of data. Identification and contact details; communication content and metadata; property interests and preferences; deal, reservation and payment-schedule information; consent and opt-out records; usage data.
- Special categories. None intended. The Controller will not submit them.
4. Confidentiality and personnel
Personnel who can access Controller personal data are bound by written confidentiality obligations. They have access on a need-to-know basis under role-based controls. QubeHub remains responsible for their acts and omissions.
5. Security
QubeHub implements appropriate technical and organisational measures under Article 32 GDPR. They include:
- a separate database instance for each customer, hosted in the EU (Germany);
- encryption in transit and at rest;
- one-time-password and magic-link authentication;
- role-based access control across the platform APIs;
- multi-factor authentication on the hosting, cloud and source-code accounts used to administer customer environments;
- database access restricted to whitelisted IP addresses;
- logging of administrative access, with logs kept for at least 12 months;
- infrastructure-level backups;
- vulnerability and patch management.
The current measures are summarised on the Security page. QubeHub may update them, provided the overall level of protection does not decrease.
6. Sub-processors
6.1 The Controller authorises QubeHub to engage sub-processors. The current list is at qubehub.ai/subprocessors.
6.2 QubeHub will give at least 30 days’ prior notice of any new or replacement sub-processor. Notice is given by email to the Controller’s account contact and by updating the list. The Controller may object on reasonable data-protection grounds within that period. If the two sides cannot agree an alternative within 30 days of the objection, the Controller may terminate the affected services and receive a pro-rata refund of prepaid fees for the unused period.
6.3 QubeHub imposes data-protection obligations on each sub-processor that are no less protective than this DPA. QubeHub remains liable for each sub-processor’s performance.
6.4 AI sub-processors.
- QubeHub does not use Controller personal data to train, fine-tune or improve any AI model, and ensures that no sub-processor does so.
- Where data is sent to an AI model provider for inference, the provider must not use it for training. It must minimise retention, apply zero-data-retention where available for QubeHub’s account, and in any event keep inputs and outputs for no more than 30 days, for service delivery and abuse monitoring only.
- Storing the Controller’s knowledge-base materials in a retrieval index is sub-processing under this DPA. It is limited to materials the Controller has uploaded or approved, and ends under section 10.
6.5 Integrations that the Controller switches on, such as its messaging accounts, telephony, e-signature or its own CRM, are directed by the Controller. They are not QubeHub sub-processors.
7. International transfers
Controller personal data is hosted in the EEA. It is transferred outside the EEA only to sub-processors on the list, and only under a valid transfer mechanism: an adequacy decision, including the EU–US Data Privacy Framework, or the Standard Contractual Clauses (Commission Decision 2021/914). Where the Standard Contractual Clauses are needed between the parties, they are incorporated by reference: Module 2 or Module 3 as applicable, Cyprus law, and the Cyprus courts.
8. Assistance
Taking into account the nature of the processing, QubeHub assists the Controller in:
- responding to data subject requests, mainly through the platform’s export, correction and deletion tools;
- meeting its obligations on security, breach notification, data protection impact assessments and prior consultation.
Where this assistance goes beyond standard platform functionality, it is charged at reasonable cost.
9. Personal data breaches
QubeHub notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Controller personal data. The notice includes the information then available. QubeHub supplements it as further information becomes available, provides a full report within 72 hours of becoming aware, and takes reasonable steps to contain and remedy the breach.
10. Return and deletion
For 90 days after the agreement ends, whatever the reason, the Controller can export its data using the platform tools. The same applies if QubeHub becomes insolvent or stops providing the platform. QubeHub then deletes Controller personal data from production systems within 60 days, and from backups in the ordinary rotation, unless the law requires it to be kept.
11. Audits
QubeHub makes available the information reasonably needed to demonstrate compliance with this DPA. The Controller, or an independent auditor it appoints, may audit that compliance under these conditions:
- no more than once a year;
- on at least 30 days’ notice;
- during business hours;
- at the Controller’s cost;
- without access to other customers’ data;
- subject to confidentiality.
Where documentation or independent reports reasonably answer the Controller’s questions, QubeHub may rely on them instead of an audit.
12. Liability and precedence
Liability under this DPA is subject to the limitations in the agreement. If this DPA conflicts with the agreement on the protection of personal data, this DPA prevails. If a signed subscription agreement contains its own data processing terms, those terms prevail over this DPA.