Customer Data Processing Addendum (Customer DPA)

Last updated: October 18, 2026

Version: 2026-10-18

Parties: This DPA is between Quick HR Solutions, LLC (“Quick HR,” “Processor,” or “Service Provider”) and the customer entity that has agreed to the Quick HR Terms of Service or a written order for CypressHR (“Customer,” “Controller,” or “Business”).

This DPA forms part of the agreement between the parties for CypressHR (the “Agreement”). If there is a conflict on data-protection topics, this DPA controls.

You are the employer and decide what worker data goes in. Quick HR processes that data only to run the Service for you. We don’t sell it. We protect it. If something goes wrong with security, we tell you promptly.

1. Roles and scope

1.1 Customer is the controller (and employer of record for Customer’s workers) for Customer Personal Data processed in the Service.

1.2 Quick HR is the processor / service provider for Customer Personal Data.

1.3 This DPA applies to personal data that Customer or its users upload to, or generate in, the Service about employees, contractors, applicants (if any in scope), or other individuals, when Quick HR processes that data to provide the Service (“Customer Personal Data”).

1.4 This DPA does not make Quick HR a PEO or co-employer.

1.5 Website/account/billing data that Quick HR collects about Customer’s business contacts for Quick HR’s own sales/billing operations is Track A (as described in our Privacy Policy) and is outside the “Customer Personal Data as processor” scope except where the same record serves both purposes.

2. Definitions (short)

• Personal Data / Personal Information: information linked or reasonably linkable to an identified or identifiable individual.
• Process / Processing: any operation on Personal Data (collect, store, use, disclose, delete, etc.).
• Security Incident: unauthorized access to or acquisition of Customer Personal Data maintained by Quick HR that compromises security, confidentiality, or integrity, including a “breach of system security” under Tex. Bus. & Com. Code § 521.053 when Sensitive Personal Information is involved.
• Sensitive Personal Information (SPI): as defined in Tex. Bus. & Com. Code Chapter 521 (and analogous terms under other laws if applicable).
• Subprocessor: a third party engaged by Quick HR to process Customer Personal Data to help deliver the Service.

Other capitalized terms have the meanings in the Agreement unless stated here.

3. Customer instructions

3.1 Quick HR will process Customer Personal Data only: (a) to provide, secure, maintain, and support the Service; (b) as documented in the Agreement, Track B (as described in our Privacy Policy), and this DPA; and (c) on Customer’s other documented instructions (email or in-product configuration counts), unless law requires otherwise.

3.2 Customer instructs Quick HR to process Customer Personal Data for the purposes listed in Annex 1.

3.3 Quick HR will notify Customer if, in Quick HR’s opinion, an instruction violates applicable data-protection law (without obligation to provide legal advice).

3.4 Customer is responsible for the lawfulness of its instructions, the accuracy of Customer Personal Data, required notices to individuals, and for not uploading prohibited data (Annex 2 / Terms keep-outs). Medical employment documents belong in the Medical / ADA vault.

4. Confidentiality

4.1 Quick HR will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations. 4.2 Access is least privilege and need-to-know for operations, security, and Customer-requested support. 4.3 Quick HR does not offer paid services to read Customer ER investigation files as a vendor product.

5. Security measures

5.1 Quick HR will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, as described in Annex 4 (Security Measures) and the Security Posture one-pager.

5.2 Measures at launch include (summary): encryption in transit and at rest; MFA; logically keeping each customer’s data separate from every other customer’s; backups; audit logging; least-privilege access; vulnerability management on a defined cadence.

5.3 Quick HR has not completed a SOC 2 audit or any other third-party security certification and does not claim one. Our hosting (Vercel) and database (Neon) providers maintain their own SOC 2 reports.

6. Subprocessors

6.1 Customer authorizes Quick HR to use subprocessors to deliver the Service. The current list is in the Subprocessors page and summarized in Annex 3.

6.2 Quick HR puts written data-protection terms in place with each subprocessor. Where a subprocessor does not offer a separate data processing agreement, Quick HR relies on that subprocessor's published terms, privacy policy and security commitments, and will seek a separate agreement where one is available.

6.3 Quick HR remains responsible for subprocessors’ performance under this DPA.

6.4 Notice of change: Quick HR will provide Customer advance notice of material subprocessor additions or replacements (email to admin contact or in-app notice) at least 30 days before the change becomes effective for Customer Personal Data, except for emergency security replacements, which Quick HR will notice as soon as practicable. Customer may object on reasonable data-protection grounds; the parties will discuss in good faith. If unresolved, Customer may terminate the affected Service for convenience with a pro-rata refund of prepaid unused fees.

7. Assistance with individual and regulator requests

7.1 If Quick HR receives a request from an individual relating to Customer Personal Data, Quick HR will not respond substantively as controller; Quick HR will forward the request to Customer without undue delay, unless legally prohibited.

7.2 Taking into account the nature of processing, Quick HR will provide reasonable assistance to Customer (via product features such as export/access controls where available, and commercially reasonable support) so Customer can respond to individual rights requests and employment-record obligations.

7.3 Quick HR will provide reasonable assistance with Customer’s data protection impact assessments or regulator inquiries related to the Service, at Customer’s expense if the assistance is extraordinary.

8. Security incidents and Texas Chapter 521

8.1 Detection and notice to Customer. Upon discovering a Security Incident affecting Customer Personal Data maintained by Quick HR, Quick HR will notify Customer without unreasonable delay and, where Tex. Bus. & Com. Code § 521.053(c) applies (Quick HR maintains SPI not owned by Quick HR), immediately after discovering the breach if SPI was or is reasonably believed to have been acquired by an unauthorized person.

8.2 Notice to Customer will include, to the extent known at the time: nature of the incident, categories of data and approximate number of individuals affected, likely consequences, measures taken or proposed, and a contact point. Quick HR may update the notice as investigation continues.

8.3 Roles under Chapter 521 (fact-specific).

• A person who owns or licenses computerized SPI generally has the duty to notify individuals without unreasonable delay and not later than the 60th day after determining a breach occurred (§ 521.053(b)).
• A person who maintains computerized SPI it does not own must notify the owner or license holder immediately (§ 521.053(c)).
• If ≥ 250 Texas residents are involved and a party is required to notify under § 521.053, that party must also notify the Texas Attorney General as soon as practicable and not later than the 30th day after determination (§ 521.053(i)).
• Notice to nationwide CRAs may apply if notifying more than 10,000 persons at one time (§ 521.053(h)).

8.4 Quick HR will reasonably assist Customer with Customer’s investigation and with Customer’s notices to individuals, regulators, and CRAs, including relevant logs and timelines Quick HR controls.

8.5 Notification may be delayed if a law-enforcement agency determines that notification will impede a criminal investigation (§ 521.053(d)); Quick HR will document and coordinate with Customer.

8.6 The parties will cooperate in good faith on public statements about a Security Incident affecting Customer Personal Data.

9. Return and deletion

9.1 During the subscription, Customer may export Customer Personal Data using available tools.

9.2 After termination or expiration of the Service, Quick HR will make Customer Personal Data available for export for 30 days (the “Export Window”).

9.3 After the Export Window, Quick HR will delete Customer Personal Data from active production systems within 60 days, and will delete or irreversibly anonymize residual copies in backups as those backups age out of the rolling retention window (typically 30–90 days), except for: (a) copies required by law; (b) copies needed for dispute resolution, security, or fraud prevention, retained in a secure, access-limited form; and (c) data on litigation hold per Customer’s written instruction.

9.4 Upon written request, Quick HR will provide a written confirmation of deletion from active systems after completion.

10. Audit rights

10.1 Upon reasonable written notice, no more than once per twelve (12) months (unless a Security Incident or regulator request justifies more), Customer may request information reasonably necessary to demonstrate Quick HR’s compliance with this DPA.

10.2 Questionnaire responses, architecture summaries, and (when available) independent reports will be the primary method. On-site or invasive audits require mutual agreement on scope, timing, confidentiality, and cost, and must not compromise other customers’ security.

11. Geographic scope / transfers (U.S. only for now)

11.1 Quick HR hosts its main systems in the United States. Each subprocessor and where it processes data is listed in Annex 3 and on the Subprocessors page.

11.2 CypressHR is not marketed for international / EU/UK employment-data use at this time. No “GDPR compliant” or “all international law” claims.

11.3 If Customer later needs processing for individuals outside the United States, the parties will discuss additional terms before treating that as in-scope.

12. No sale; no public AI training; limited use

12.1 Quick HR will not sell Customer Personal Data and will not share it for cross-context behavioral advertising.

12.2 Quick HR will not use Customer Personal Data to train public AI models.

12.3 Quick HR may create aggregated or de-identified data that does not reasonably identify individuals or Customer’s confidential workforce details, and may use that data to improve the Service, provided Quick HR does not attempt to re-identify.

12.4 Quick HR will not combine Customer Personal Data with other data to build profiles for Quick HR’s unrelated commercial purposes outside providing the Service.

13. Term

This DPA lasts as long as Quick HR processes Customer Personal Data under the Agreement and survives for provisions that by nature should survive (confidentiality, deletion, liability allocation referencing the Agreement, etc.).

14. Liability

Liability under this DPA is subject to the limitations and exclusions in the Agreement, except where prohibited by law. Nothing in this DPA reduces Customer’s responsibility as employer/controller.

15. Contact

Quick HR privacy / security contact: support@cypresshr.app Customer contact for notices under this DPA: admin email on the Customer account (or another privacy contact Customer designates in writing).

Annex 1: Details of processing

Annex 2: Prohibited data (keep-outs)

Customer will not instruct Quick HR to act as an electronic I-9 examiner (in-app Section 2 examination, remote ID verification, or biometric/selfie). Allowed: completed Form I-9 PDF/scan in restricted employee files plus I-9 status/checklist. Also prohibited: biometric timeclock data; CRA reports / adverse-action packages; medical certifications in general personnel files (use the Medical / ADA vault); native payroll/tax system-of-record packages; marketing SMS without recorded opt-in; AI auto-discipline/auto-reject/auto-score of protected traits.

Annex 3: Subprocessors

See the published Subprocessors list. Material changes per Section 6. Current subprocessors:

Annex 4: Security Measures (at launch)