Data Sub-Processor Policy

Quark Sub-Processors

Version: 1.1

Last Updated: May 16, 2022

Quark uses certain sub-processors to provide key components of its SaaS and cloud-hosting services and wider ecosystem, explained in the table below.

Due Diligence

Quark’s due diligence process involves evaluating the security, privacy and confidentiality practices of approved sub-processors that potentially may have access to process information within the service to carry out designated activities on Quark’s behalf.

We enter into written agreements with sub-processors that enforce compliance with applicable data protection laws, security controls, confidentiality and international data transfer requirements.

We also restrict sub-processor access to only what is necessary to maintain and provide the Quark service to our customers. Sub-processors are strictly prohibited from using customer service, content or personal information for any purpose other than to support Quark in providing the service to its customers.

Appointing and Changing Sub-Processors

Quark will notify customers of the appointment of any new sub-processor or changes to any existing sub-processor that will materially affect the processing of personal information involved within Quark activities, where it assumes the role of data processor (the delivery of SaaS or cloud-hosting services and technical support) within its wider ecosystem.

The customer may object to the appointment of, or any change, in the sub-processor where it has reasonable grounds for doing so. In such circumstances, Quark shall be entitled to address the objection through one of the following options at its sole discretion:

Cease to use the relevant sub-processor
Take steps suggested by the customer to address the objection
Cease to provide the particular services to the data controller, which involve the relevant sub-processor

Entity Name	Entity Type	Entity Data Storage Country
Amazon Web Services, Inc.	Cloud service provider and associated infrastructure services (analytics, compute, database, security, networking, and storage) The storage and processing of personal information for the performance of the application services provided by Quark to the client, pursuant to the contract and for the duration of the performance of those services. Personal information, stored within the application database and associated infrastructure services includes – Contact details, e.g., name, username, corporate email address IP address and location information	Headquartered in United States (not the location of processing activities) Multi-tenant SaaS systems – QPP NextGen and Quark Docurated Deployed in AWS data centers in the United States and EU (data controller choice as to which will be used for primary data location) Single-tenant SaaS systems – QPP NextGen and Quark Docurated Deployed in any of the AWS data center locations, selected by the data controller Single-tenant cloud-hosting systems – QPP hosting Deployed in any of the AWS data center locations, selected by the data controller
Service Cloud (Salesforce)	Technical product support ticketing Quark uses Service Cloud for its SaaS support and ticketing system. Quark customers and their end users create accounts directly in the system, with an email address and username. The Service Cloud system processes end users’ information as needed, only to allow communication back and forth on bug tickets, enhancement requests and to answer any other questions raised with the Quark support team. Information Service Cloud has access to for this purpose is end-user name and corporate email address.	United States
Nalpeiron	Quark Product Licensing Quark uses Nalpeiron for its SaaS licensing system. The Nalpeiron system processes no end users’ information directly, as email address and company name are pseudonymised with a hashing mechanism before sending. This is to allow communication back and forth from our software to its license entitlement service, providing ongoing license count for each active customer account.	United States
Site 24×7	Quark Environment Monitoring Information site 24×7 has access to for this purpose is only Quark assigned environment IP address. No customer personal information is shared with this sub-processor.	United States

Service-Specific Processing

Quark may process personal information in relation to specific product services, as per the table below. These services are additional to the main product and therefore may require additional commercial discussion and contractual agreement.

When consent is needed for use of the additional service, it will be presented within the product, referring to information in the table below.

Service	Service and Data Processed	Data Processing Country
QuarkXPress Legacy Document Converter	QuarkXPress documents will be uploaded to a U.S.-based server for conversion. No personal information will be used during this process, and no data will be permanently stored on the server. Data will be temporarily stored during processing, before being removed once the converted document has been returned to the end user.	Server in the United States Vendor – AWS