Data processing addendum · Register Quick LLC

1. Who this addendum is for

This addendum forms part of the agreement between your firm and Quick LLC, a Wyoming limited liability company at 30 N Gould St Ste R, Sheridan, WY 82801, USA, trading as Register Quick LLC. It takes effect when your firm creates a partner account, and covers the personal data your firm sends us about its clients.

It is written for accounting and law firms that order US company formation, registered agent and compliance services for their clients through our partner portal. Founders buying for themselves deal with us as controller, not processor — our privacy policy is the page for you.

Where UK or EU GDPR applies to your firm's processing, or India's Digital Personal Data Protection Act 2023 applies, this addendum governs it. Where it conflicts with our terms of service on a data protection matter, this addendum wins; on everything else the terms win. We will sign a copy if your compliance file needs one.

We are not a law firm or an accountancy firm, and this page is a contract term, not legal advice.

2. Roles

Your firm is the controller of its clients' personal data — or the processor, where it acts on a client's instructions.
We are the processor, or sub-processor where your firm is a processor. We act on your firm's instructions, not its clients'.
Where a founder buys directly from us, we are the controller. A different relationship with different duties, which the privacy policy covers.

Each side answers for its own compliance. Your firm is responsible for having a lawful basis — or the notice and consent the DPDP Act requires — to send us client data, and for telling its clients that a US formation provider is involved.

3. What we process

Subject matter and duration. Providing the services your firm orders, for as long as the partner account is open, plus the retention in section 9.

Nature and purpose. Collecting, checking, storing and transmitting client information to form US companies, appoint a registered agent, apply for an EIN, make state and federal filings, keep documents and deadlines in the portal, take payment and support the account.

Data subjects. Your firm's clients; the owners, managers, directors and officers of the companies your firm orders for; the contacts your firm names; and your firm's own staff who use the portal.

Categories of personal data.

names, including any former name a filing needs;
email addresses and phone numbers;
home and business addresses, and the country a person lives in;
nationality or country of citizenship;
ownership percentages and each person's role in the company;
whether an owner holds a US Social Security number or ITIN, and the number itself where a filing cannot be made without it;
identity documents, such as a passport page, where a state, the IRS or our US filing and registered agent partner requires verification;
order, plan and billing records. Card details are entered with our payment processor and are not stored on our systems;
correspondence between your firm, us and the agencies involved, including support messages.

We do not ask for special category data. An identity document reveals more than a filing needs, so send only the page asked for.

4. What we undertake as processor

Documented instructions only. The agreement and this addendum are the standing instruction: placing an order, completing a form or using a portal feature counts as an instruction, as does a written request from an authorised person at your firm. If US law compels us to process otherwise, we tell you first where the law allows.
Unlawful instructions. If we believe an instruction breaks data protection law, we say so, and may pause that work until it is resolved.
Confidentiality. Everyone with access — our staff and our contractors — is under a written duty of confidence that survives their engagement, and access is limited to those who need it.
Security. We keep appropriate technical and organisational measures; our security page describes them and is kept current.
Assistance. We help with data subject requests, impact assessments, prior consultations and regulator questions so far as we reasonably can. Routine help is included; substantial engineering work we cost with you first.
Breach notice. If we become aware of a personal data breach affecting your firm's client data, we tell your firm without undue delay and in any case within 48 hours. We say what happened, what data is involved and what we are doing, and update you as we learn more. Notifying a regulator or the people affected is the controller's decision.

5. Sub-processors

Your firm gives general authorisation for us to use sub-processors. Our sub-processor page lists the current categories and providers, including our US filing and registered agent partner. We do not publish that partner's name publicly; partner firms can request the named list by email.

We email partner firms before a new sub-processor starts work on their clients' data, with at least 14 days' notice where we can.
Each sub-processor is bound by written terms equivalent to this addendum, and we remain responsible to your firm for what they do.
Your firm may object on reasonable data protection grounds within that period. We will try to resolve it — another provider, another configuration, or keeping those clients out of that part of the service. If we cannot, your firm may terminate the affected service, and our refund policy covers what is already paid.

6. International transfers

We are a US company, and we should be plain about where data goes. The application and its database run on servers in Falkenstein, Germany, operated by Hetzner Online GmbH, so day-to-day storage sits in the EU. Our team accesses it from outside the EU and the UK. Some transfers are unavoidable, because they are the service:

filing data goes to the US state you file in, and to the IRS for an EIN application;
our US filing and registered agent partner receives what it needs to act as agent;
payments are processed by Stripe;
messages sent to the AI assistant on our site are processed by a third-party AI provider.

Where UK or EU GDPR applies and data leaves the UK or the EEA for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses of 4 June 2021 — controller-to-processor or processor-to-processor module, as the roles in section 2 require — and on the UK International Data Transfer Addendum. Accepting this addendum incorporates those clauses, and section 3 supplies the annex details. Alongside them we encrypt in transit and send no more than the filing requires.

Transfers necessary to perform the contract — sending an owner's name and address to a state agency so the company can exist — are also made on that basis, and only the fields the agency's form requires are sent.

We hold no transfer certification and do not claim one: we are not certified under the EU-US Data Privacy Framework. If your firm's assessment needs more than the clauses and measures above, tell us before you send client data.

7. Requests from data subjects

If one of your firm's clients contacts us directly to see, correct, export or delete their data, we do not answer on your firm's behalf: we confirm receipt, explain that their firm is the controller, and pass it to your firm's partner-account contact promptly. Your firm decides how to respond, and can ask us to find, change, export or delete anything needed to answer.

8. Audits

Written questionnaires. Once a year we answer a reasonable written security questionnaire and give you what you need to show we are meeting this addendum. There is no charge for it.
What we cannot give you. We have no third-party audit report to hand over — no SOC 2 report, no ISO certification, no independent penetration test. We are a small company and would rather say so. What we can give you is an accurate written description of how the service is built and run.
On-site audits. We accommodate an inspection where a supervisory authority, or a law that applies to your firm, requires one: at your firm's cost, on 30 days' written notice, under a confidentiality agreement, limited to your clients' data, and without access to other customers' data or disruption to their service.

9. Return and deletion

When a partner account ends, or your firm stops using a service for a particular client:

your firm can sign in and export that client's records and documents for 30 days;
after that we delete or anonymise the personal data we hold as processor;
the exception is records we are required to keep — filing, tax and payment records. We keep those for the periods in our privacy policy, use them for nothing else, and they stay protected by this addendum while we hold them.

If your firm asks us to delete a client's data sooner, we will, subject to that same exception.

10. Liability, changes and contact

Liability under this addendum is subject to the limits and exclusions in our terms of service, which apply to the agreement as a whole, not once per document. Nothing here limits a data subject's rights or either side's responsibility to a regulator.

We may update this addendum. We post the new version here with a new date and email partner-account administrators before it takes effect. If a change would materially reduce the protection your firm relies on, tell us; if we cannot agree, your firm can end the agreement under the terms.

We provide a signed copy on request. Questions about this addendum, and anything else about data protection, go to [email protected], or by post to Quick LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.