DPA URL: https://quiiq.com/dpa
Policy version: 2026.10.25
This Data Processing Agreement ("DPA") forms part of the Terms of Service between TICCO (The Indian Consultancy & Company) ("Processor", "we", or "TICCO") and the Business Customer that uses QUIIQ ("Controller" or "you"). QUIIQ is a product developed and operated by TICCO (The Indian Consultancy & Company).
This DPA applies only to Customer Data that we process on your instructions. It does not change our role as controller of Account, billing, and security data, as described in the Privacy Policy.
1. Definitions
Capitalized terms have the meaning in the Terms and Privacy Policy. "Applicable Data Protection Law" means GDPR, UK GDPR, Indian law (including the Digital Personal Data Protection Act, 2023, when in force for the relevant obligation), and other laws that apply to the processing.
2. Subject matter and duration
We process Customer Data to provide the Service (inbox, CRM, workflows, widgets, mobile apps, connected channels, and AI Assistants you enable) for as long as you have a workspace and thereafter until deletion under the Privacy Policy retention schedule.
3. Nature and purpose of processing
Processing includes storage, transmission, display, backup, support, workflow execution, and AI inference or retrieval that you configure. Categories of data subjects include your team members and End Users who contact you. Types of Customer Data include identifiers, message content, attachments, CRM fields, uploaded knowledge, embeddings, and channel credentials.
4. Instructions
You instruct us to process Customer Data only: (a) to provide and secure the Service; (b) as documented in the Terms, Privacy Policy, this DPA, and your in-product settings; and (c) as required by law (in which case we will notify you unless legally prohibited). You warrant that your instructions are lawful and that you have provided required notices to End Users.
5. Confidentiality
We ensure persons authorized to process Customer Data are bound by confidentiality obligations and access data only as needed to perform their role.
6. Security
We implement appropriate technical and organizational measures, including encryption in transit, access controls, logging, and segregated production environments on AWS, as summarized on our Security page. You are responsible for workspace permissions, channel credentials, and how you configure AI Assistants.
7. Subprocessors
You authorize us to use the subprocessors listed in the Privacy Policy, currently:
- Amazon Web Services (AWS): Cloud hosting, compute, databases, object storage, caching (including Redis), backups, and related production infrastructure. Vector indexes derived from uploaded knowledge are stored in this infrastructure.
- Vercel: Hosting and delivery of the public website at quiiq.com
- OpenAI: AI Assistants, draft and automated replies, embeddings, and retrieval over uploaded knowledge and relevant conversation context
Independent channel and payment providers (for example Meta, Telegram, Razorpay, Cashfree, Apple, Google) are not subprocessors appointed by us for inbox content in the same way; they process data under their own terms when you connect those services.
We will impose data-protection terms on subprocessors no less protective than this DPA. We will update the Privacy Policy when we add a material subprocessor. If you object to a new subprocessor on reasonable data-protection grounds within 14 days of notice, we will discuss alternatives. If we cannot reasonably accommodate the objection, you may stop using the affected feature or terminate the affected subscription.
8. Assistance with rights requests
Taking into account the nature of processing, we will assist you with reasonable and appropriate technical and organizational measures so you can respond to End User rights requests. In-product tools (contact deletion, exports, channel disconnect, workspace deletion) are the primary means. We will not respond to an End User as controller of your Customer Data except to redirect them to you, unless law requires otherwise.
9. Incidents
We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Data, and will provide information reasonably available to us to help you meet your notification duties. Notification is not an admission of fault.
10. International transfers
You authorize transfers of Customer Data to countries where we and our subprocessors operate, including transfers to OpenAI. Where GDPR or UK GDPR requires a transfer mechanism, the parties rely on Standard Contractual Clauses (controller to processor) as needed, with this DPA and the Privacy Policy completing the description of processing.
11. Return and deletion
During the term you may export Customer Data using available in-product tools or by requesting assistance at hello@ticco.in. After a confirmed workspace deletion, we delete Customer Data from production systems within 30 days. Encrypted backups expire within 90 days. Attachments, uploaded knowledge, and embeddings are included in that deletion. Residual copies may remain only as required by law (for example certain billing records we hold as controller) or until backup rotation completes.
Channel disconnection without workspace deletion does not delete previously imported Customer Data.
12. Audit
Upon written request not more than once per 12 months (unless a competent authority or confirmed incident reasonably requires more), we will provide information reasonably necessary to demonstrate compliance with this DPA, such as this policy set, security summary, and subprocessor list. On-site audits are not offered as a standard right; any additional audit is subject to written agreement, confidentiality, and your cost except where we are in material breach.
13. Liability
Liability under this DPA is subject to the limitations in the Terms, except where Applicable Data Protection Law prohibits limitation.
14. Order of precedence and changes
If this DPA conflicts with the Terms on processing of Customer Data, this DPA controls. We may update this DPA in the same manner as the Terms. Version 2026.10.25.
15. Contact
hello@ticco.in
TICCO (The Indian Consultancy & Company), 15A, City Vista, Tower A, Fountain Road, Kharadi, Pune 411014, Maharashtra, India