Data processing agreement

Version of 7 November 2026.

This agreement forms part of the CashLead terms and conditions. It is concluded between the customer, as controller, and Quantum Liquid LLC, as processor.

1. Purpose

The processor processes the data uploaded by the customer in order to provide the service to the customer, for as long as the customer uses it.

2. Description of processing

• Purpose: linking deals, calculating time intervals, writing findings and alerts.
• Data subjects: contacts and representatives of the customer's customers and debtors, members of its sales and administrative team.
• Data: names, references, amounts, dates, according to the columns mapped by the customer.
• Data not to be uploaded: sensitive data within the meaning of the law, complete bank details that are not needed for reconciliation.
• Hosting location: European Union (Frankfurt), subject to article 6.

3. Instructions and confidentiality

The processor processes the data only on the customer's documented instructions: this agreement and the service settings. Authorised persons are bound by confidentiality.

4. Security

• Encryption in transit (TLS) and at rest (AES-256-GCM, key derived per company) of rows, file names and results.
• Files read in the browser: only the mapped columns are sent.
• Separation by company, checked on each request.
• Log of uploads, diagnostics and erasures.

5. Sub-processors

The customer authorises Vercel Inc. (hosting, Frankfurt) and Neon, Databricks, Inc. (database, Frankfurt). Any new sub-processor is announced 30 days in advance, and the customer can object by ceasing to use the service.

6. Transfers

The processor and its sub-processors are established in the United States. Any transfers, for operations and support, are governed by the European Commission's standard contractual clauses and their Swiss adaptation.

7. Assistance, data breach

The processor helps the customer respond to requests from data subjects. It informs the customer without undue delay of any data breach, no later than 72 hours after becoming aware of it.

8. Termination and erasure

The customer can erase its data at any time with the "Erase everything" button. The data disappears immediately from the database and within 6 hours from technical backups. On written request, the processor provides the information needed to demonstrate compliance with this agreement.