Version: 1.0 | Effective date: 2 November 2026 | Document ref: STQRY-DPA-01
1. About this Addendum
1.1 This Data Processing Addendum ("DPA") forms part of the STQRY Terms & Conditions available at https://www.stqry.com/terms-conditions (the "Terms") between OnCell Systems, Inc. (trading as STQRY), 165 Taylor Rd, Honeoye Falls, NY 14472, USA ("STQRY") and the customer that has agreed to the Terms ("Customer").
1.2 This DPA is incorporated into the Terms by reference. It applies automatically, without signature, from the earlier of (a) the effective date above and (b) the date the Customer first agrees to the Terms, for as long as STQRY processes Customer Personal Data. By accepting the Terms, or continuing to use the Services after the effective date, the Customer agrees to this DPA on behalf of itself and, where applicable, its Affiliates that are Controllers of Customer Personal Data.
1.3 A Customer that requires a countersigned copy for its records may request one at privacy@stqry.com. Signature is not required for this DPA to be effective.
1.4 If there is a conflict between this DPA and the Terms, this DPA prevails in relation to the processing of Customer Personal Data. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
2. Definitions
| Term | Meaning |
|---|---|
| Data Protection Laws | All laws applicable to the processing of Customer Personal Data under the Terms, including the GDPR, the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), and the New Zealand Privacy Act 2020, each as amended or replaced from time to time. |
| GDPR | Regulation (EU) 2016/679 (General Data Protection Regulation). |
| UK GDPR | The GDPR as retained in UK law under the European Union (Withdrawal) Act 2018, as amended (including by the Data (Use and Access) Act 2025). |
| Customer Personal Data | Personal data that STQRY processes on behalf of the Customer in providing the Services, as described in Annex 1. |
| Services | All STQRY Products provided under the Terms, including STQRY Apps, STQRY Guide, STQRY Kiosk, STQRY Fleet, STQRY Collect, STQRY Marketplace, STQRY Chat, STQRY Engage, the STQRY websites and the STQRY content management platform, and any related support. |
| Sub-processor | Any third party engaged by STQRY that processes Customer Personal Data on STQRY's behalf. |
| Personal Data Breach | A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data. |
| Standard Contractual Clauses / SCCs | The standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021. |
| UK Addendum | The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under s119A of the Data Protection Act 2018 (version B1.0), as amended. |
Terms such as "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the GDPR.
3. Roles and scope
3.1 For Customer Personal Data, the Customer is the Controller (or a Processor acting on behalf of its own controller) and STQRY is the Processor (or Sub-processor, as applicable).
3.2 This DPA does not apply to personal data for which STQRY is an independent Controller, including Customer account, billing and sales contact information and data STQRY uses to operate, secure and improve its own business. That processing is described in the STQRY Privacy Policy at https://www.stqry.com/privacy-policy.
3.3 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
4. Customer obligations
4.1 The Customer is responsible for: (a) having a lawful basis for the processing and for providing any notices and obtaining any consents required by Data Protection Laws, including for analytics or tracking features it enables in its apps; (b) the accuracy and lawfulness of the Customer Personal Data and the means by which it was obtained; and (c) ensuring its instructions comply with Data Protection Laws.
4.2 The Customer is responsible for choosing a hosting region appropriate to its needs when setting up its account, and for configuring the Services (including user access, optional data collection features and third-party integrations it connects) appropriately.
5. STQRY obligations
STQRY will:
5.1 Instructions. Process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law (in which case STQRY will inform the Customer before processing unless the law prohibits this). The Terms, this DPA and the Customer's use and configuration of the Services are the Customer's complete instructions. STQRY will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.
5.2 Confidentiality. Ensure that persons authorised to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory obligation of confidentiality, and only access it as needed to provide the Services.
5.3 Security. Implement and maintain the technical and organisational measures in Annex 2, which meet the requirements of Article 32 GDPR. STQRY may update these measures provided the overall level of security is not materially reduced.
5.4 Data subject requests. Taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects to exercise their rights under Chapter III GDPR. If STQRY receives a request directly, it will redirect the data subject to the Customer and will not respond itself except to confirm the redirection, unless the Customer authorises it to do so.
5.5 Assistance. Provide reasonable assistance to the Customer with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of processing and the information available to STQRY. The Customer will pay STQRY's reasonable fees for assistance beyond making its standard documentation available.
5.6 Records. Maintain a record of processing activities carried out on behalf of the Customer as required by Article 30(2) GDPR.
6. Sub-processors
6.1 General authorisation. The Customer gives STQRY general written authorisation to engage Sub-processors. The current list is published at https://www.stqry.com/sub-processor-list (the "Sub-processor List").
6.2 Sub-processor terms. STQRY will enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA, and remains responsible to the Customer for each Sub-processor's performance of those obligations.
6.3 Notice of changes. STQRY will give at least 30 days' notice before engaging a new Sub-processor by updating the Sub-processor List. The Customer is responsible for checking the Sub-processor List for updates.
6.4 Objection. The Customer may object to a new Sub-processor on reasonable data protection grounds by writing to privacy@stqry.com within the notice period. The parties will discuss the objection in good faith. If STQRY cannot reasonably accommodate it, the Customer may terminate the affected Services by written notice. Fees already paid are not refundable.
6.5 Emergency replacement. Where a Sub-processor must be replaced urgently for security or service continuity reasons, STQRY may do so immediately and will notify the Customer as soon as practicable, with the objection right in 6.4 then applying.
7. Personal Data Breaches
7.1 STQRY will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
7.2 The notice will be sent to the Customer's account owner and any security contact recorded in the Services, and will include, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases as it becomes available.
7.3 STQRY will take reasonable steps to contain, investigate and mitigate the breach and will cooperate with the Customer so it can meet its notification obligations under Articles 33 and 34 GDPR. Notification by STQRY is not an acknowledgement of fault or liability.
8. International transfers
8.1 Hosting region. Customer Content and account data are stored in the hosting region selected by the Customer. Some supporting services run in fixed locations, as described in the Sub-processor List: visitor analytics (currently the United States), web hosting and logging (Germany), and AI processing (New Zealand and the United States). Media is delivered to visitors through content delivery networks with edge locations worldwide. STQRY and its Sub-processors may also access Customer Personal Data from other countries, including New Zealand and the United States, only as needed to provide, support and secure the Services.
8.2 Transfer mechanisms. Where a transfer of Customer Personal Data from the EEA, UK or Switzerland to a country outside those areas is not covered by an adequacy decision (for example, the EU adequacy decisions for New Zealand and the United Kingdom, or a recipient's certification under the EU-US Data Privacy Framework), the parties agree that:
- EEA transfers: the SCCs are incorporated into this DPA by reference, with Module Two (controller to processor) applying where the Customer is a Controller and Module Three (processor to processor) applying where the Customer is a Processor. The Customer is the data exporter and STQRY is the data importer;
- UK transfers: the SCCs apply as amended by the UK Addendum, with Table 1 completed with the parties' details in this DPA, Tables 2 and 3 completed by reference to this Section 8 and Annexes 1 to 3, and both parties able to end the UK Addendum as set out in its Section 19;
- Swiss transfers: the SCCs apply with references to the GDPR read as references to the FADP, the competent supervisory authority being the Swiss Federal Data Protection and Information Commissioner, and "Member State" not interpreted so as to exclude data subjects in Switzerland from suing in their place of habitual residence.
8.3 SCC selections. For the SCCs: (i) the optional docking clause in Clause 7 applies; (ii) Option 2 (general written authorisation) applies under Clause 9(a), with the notice period in Section 6.3; (iii) the optional wording in Clause 11(a) does not apply; (iv) under Clause 13, the competent supervisory authority is that of the Customer's EU establishment or, if none, of its EU representative under Article 27 GDPR, or otherwise the Irish Data Protection Commission; (v) under Clause 17, Option 1 applies and the governing law is the law of Ireland; (vi) under Clause 18, disputes are resolved by the courts of Ireland; and (vii) Annexes I to III of the SCCs are completed by Annexes 1 to 3 of this DPA.
8.4 Onward transfers. STQRY will ensure that any onward transfer to a Sub-processor is covered by a valid transfer mechanism under Data Protection Laws.
8.5 Government access requests. If STQRY receives a legally binding request from a public authority for Customer Personal Data, it will (unless legally prohibited) notify the Customer, challenge the request where there are reasonable grounds to do so, and disclose only the minimum data required.
9. Audits and information
9.1 STQRY will make available to the Customer, on request, the information reasonably necessary to demonstrate compliance with Article 28 GDPR, which may include this DPA, its security documentation, completed security questionnaires and any available third-party audit reports or certifications.
9.2 Where that information is not reasonably sufficient, or where required by a supervisory authority, the Customer (or an independent auditor it appoints that is bound by confidentiality and is not a competitor of STQRY) may conduct an audit, including an inspection, on at least 30 days' written notice, no more than once in any 12-month period (except after a Personal Data Breach or at a supervisory authority's direction), during business hours and in a way that does not unreasonably disrupt STQRY's operations. The Customer bears the cost of the audit, including STQRY's reasonable costs of supporting it.
10. Retention, return and deletion
10.1 During the term, the Customer can export its content and data using the STQRY API, which provides its data in JSON format and its media as the original raw files.
10.2 Customer Content. Customers often return to the Services, so after termination or expiry STQRY will keep the Customer's account, Customer Content (the guides, tours, media and other content the Customer uploads, including any personal data in it), STQRY Engage data and account user records in an inactive state so the Customer can reactivate them. This is the Customer's instruction for the purposes of Article 28(3)(g) GDPR, and the retained data remains subject to this DPA. The Customer may delete its account at any time, during the term or after it ends, by writing to privacy@stqry.com or support@stqry.com (as set out in the Terms). When the account is deleted, STQRY will delete all Customer Personal Data in it, including Customer Content, account user records and Visitor Data, within 30 days, unless applicable law requires retention. The Customer can export its Customer Content before deleting the account (Section 10.1).
10.3 Retention periods. Personal data about visitors and end users of the Customer's apps ("Visitor Data"), and all other Customer Personal Data, including Customer Content (such as tour content and media uploads), account user records and all STQRY Engage data, is kept until the Customer deletes it or deletes its account. The only exceptions are logs, which are kept for limited periods. STQRY Chat conversation logs are deleted 12 months after collection. Raw analytics event data, such as device identifiers, IP addresses and usage events, is deleted within 13 months of collection, after which STQRY keeps only aggregated statistics that do not identify any individual. After termination or expiry of the Services, STQRY Chat logs and raw analytics data are deleted within 90 days, and STQRY Engage data is kept with the inactive account under Section 10.2.
10.4 Backups. Data deleted from production systems is overwritten in backups in the ordinary course within 30 days, and remains protected by this DPA until then.
11. Liability
11.1 Each party's liability arising out of or in connection with this DPA (including the SCCs, to the extent permitted by them) is subject to the limitations and exclusions of liability in the Terms. Nothing in this DPA limits either party's liability to data subjects under the SCCs or where it cannot be limited under applicable law.
12. Term, changes and governing law
12.1 This DPA continues for as long as STQRY processes Customer Personal Data, and survives termination of the Terms to that extent.
12.2 STQRY may update this DPA (a) to reflect changes in Data Protection Laws or guidance from a supervisory authority, (b) to implement new or replacement transfer mechanisms, or (c) in any other way that does not materially reduce the protection of Customer Personal Data. STQRY will give at least 30 days' notice of material changes by posting the updated version and notifying the Customer's account owner. Previous versions will be kept available on request.
12.3 Except as required by the SCCs or Data Protection Laws, this DPA is governed by the law and jurisdiction that govern the Terms.
Annex 1: Description of the processing
| Item | Description |
|---|---|
| Data exporter | The Customer, as identified in its STQRY account. Role: Controller (or Processor). Contact: the account owner recorded in the Services. |
| Data importer | OnCell Systems, Inc. (trading as STQRY), 165 Taylor Rd, Honeoye Falls, NY 14472, USA. Role: Processor. Contact: privacy@stqry.com. EU and UK representative (Article 27 GDPR and UK GDPR): Prighter Group, with its local partners, contactable at https://app.prighter.com/portal/11163964898. |
| Subject matter and duration | Provision of the Services under the Terms, for the term of the Customer's subscription and any retention after termination under Section 10. |
| Nature and purpose of processing | Hosting, storage, retrieval, display, transmission, backup, support and deletion of Customer Personal Data in order to provide the Services, including: running the STQRY content management platform; delivering guides to the Customer's mobile apps, web apps and kiosks; collecting and reporting usage analytics for the Customer; processing ticketing, forms, surveys, email sign-ups, STQRY Engage features and STQRY Chat conversations where the Customer enables them; providing technical support; and maintaining service security and reliability. |
| Categories of data subjects | (a) The Customer's authorised users of its STQRY account (staff, contractors, volunteers); (b) visitors and end users of the Customer's apps, web apps and kiosks; (c) individuals who appear in, or are named in, content the Customer uploads (e.g. contributors, narrators, people in photos or videos). |
| Categories of personal data | (a) Account users: name, email address, login credentials (hashed), role, activity logs, IP address; (b) end users: device identifiers, IP address, approximate location derived from IP, app usage and interaction events, language and device settings, and, only where the Customer enables relevant features, visitor login details (name, email address and hashed credentials), information submitted through forms, surveys, ticketing, email sign-up or STQRY Engage features, and questions and conversation logs from STQRY Chat; (c) content: names, images, voices and biographical information included in Customer content. STQRY does not store precise device location. |
| Special category data | None intended. The Customer must not use the Services to process special categories of data (Article 9 GDPR) or criminal offence data unless agreed in writing. Any such data included in Customer content is protected by the measures in Annex 2. |
| Frequency of transfer | Continuous, for the duration of the Services. |
| Retention | All Customer Personal Data, including Customer Content (such as tour content and media uploads), all STQRY Engage data and account user records: kept during the term and afterwards in an inactive account until the Customer deletes the data or the account (Sections 10.2 and 10.3). Logs are the only exception. STQRY Chat logs: deleted 12 months after collection. Raw analytics data: deleted within 13 months, with only aggregated statistics kept. Chat logs and raw analytics data are deleted within 90 days after termination (Section 10.3). |
| Sub-processor transfers | As set out in the Sub-processor List (Annex 3), for the subject matter, nature and duration described there. |
| Competent supervisory authority | As set out in Section 8.3(iv). |
Annex 2: Technical and organisational security measures
| Area | Measures |
|---|---|
| Governance and policies | Documented information security policies, reviewed at least annually and approved by management. Glen Barnes is responsible for security and privacy. |
| People | Staff and contractors with access to Customer Personal Data sign confidentiality obligations, receive security and privacy awareness training on joining and annually, and have access removed promptly on leaving. |
| Access control | Role-based access control in the STQRY content management platform, managed by Customer administrators. Internal access to production systems on a least-privilege, need-to-know basis, protected by multi-factor authentication and reviewed quarterly. Unique accounts; no shared credentials. |
| Encryption | Data in transit encrypted with TLS 1.2 or higher. Data at rest, including backups, encrypted using AES-256 or equivalent via the hosting provider's key management service. |
| Hosting and physical security | Core services hosted on Amazon Web Services in the Customer's selected region (United States, Canada, European Union, Singapore or Australia). STQRY Chat data is stored in MongoDB Atlas in the same region. Web apps, websites and logging are hosted by Hetzner in Germany, and visitor analytics run on STQRY-managed Matomo servers hosted by Linode (Akamai) in the US. Physical and environmental security of these data centres is provided by the hosting providers under their certified controls (e.g. ISO/IEC 27001, SOC 2). STQRY also runs AI audio generation and translation on its own servers in New Zealand, kept in a secured location with access limited to authorised staff. |
| Tenant separation | Logical separation of each Customer's data within the multi-tenant platform, so that no Customer can access another Customer's data or settings. |
| Operations security | Automated backups taken daily, retained for 30 days, stored in a separate availability zone, with restoration tested periodically. Capacity and availability monitoring with alerting. System clocks synchronised to a reliable time source. Change management with peer review before production deployment. |
| Vulnerability management | Dependencies and infrastructure scanned for vulnerabilities continuously. Critical security patches applied within 7 days. |
| Logging and monitoring | Application, access and security logs collected centrally and protected from tampering. Security and access logs are retained for 12 months; application and error logs are retained for up to 90 days. Error monitoring configured to minimise personal data in error reports. |
| Secure development | Separate development, staging and production environments. Production personal data is not used in development or testing. Secure coding practices and code review for all changes. |
| Data minimisation and privacy by default | Most visitor app content can be used without signing in. Where a Customer enables visitor login, which may be required for certain features, only the details needed for the login are collected. Device location is used on the device to trigger content and is not stored on STQRY servers. Optional data collection features (e.g. forms, analytics integrations) are off unless enabled by the Customer. |
| Supplier management | Sub-processors are assessed for security and data protection before engagement and are bound by written data protection terms. Transfer mechanisms are maintained as described in Section 8. |
| Incident management | Documented incident response procedure, with defined roles, severity levels, escalation and Customer notification steps meeting Section 7. Incidents are logged and reviewed after resolution. |
| Business continuity | Infrastructure designed for resilience across multiple availability zones. Disaster recovery plan with a recovery point objective (RPO) of 24 hours and a recovery time objective (RTO) of 48 hours, tested annually. |
| Data subject rights support | Customers can view, correct, export and delete content and account users through the Services. STQRY support assists with requests that cannot be handled through self-service. |
| Deletion and disposal | Customer data retained and deleted as set out in Section 10. Storage media disposal handled by the hosting providers under their decommissioning procedures, and by STQRY for its own servers, whose disks are securely wiped or destroyed when retired. |
Annex 3: Sub-processors
The Sub-processors authorised at the effective date are listed in the STQRY Sub-processor List at https://www.stqry.com/sub-processor-list, which forms part of this Annex. STQRY's own affiliates that may process Customer Personal Data are also listed there.