Data Security Declaration

Netlion s.r.o., Company No. 05999235, registered office at Vladislavova 85, Vysoké Mýto-Město, 566 01 Vysoké Mýto, Czech Republic

Version 1.0, effective from 2026-08-23

This is a translation. The Czech version prevails in the event of any discrepancy.

This declaration describes the measures by which the Operator protects data processed by the QueryBeam service. It states only measures that are in place and effective; measures that are merely intended are not stated in it.

Article 1 – Nature of this document

1.1This declaration is not a certificate and is not an attestation issued by a third party. It is the Operator's own declaration as to the state of security, for the accuracy of which the Operator is responsible.

1.2The Operator does not hold certification under ISO/IEC 27001, nor a SOC 2 report. The facts stated in Article 8 are therefore stated as certifications of the providers whose services the Operator uses, not as certifications of the Operator.

1.3The measures under Articles 3 to 6 form Annex B to the data processing agreement and are, towards partners, a contractual undertaking rather than a description of intent.

Article 2 – Where data is processed

2.1The application and the database are operated on a server located in the Federal Republic of Germany, in a data centre in Nuremberg.

2.2The call transcript does not leave the European Union. Text processing, being the only processing in which the content of a call leaves as a whole, has been performed since 11 Aug 2026 by a provider established, with its infrastructure, in the European Union; no transfer to a third country arises.

2.3Telephone connectivity is operated in Ireland.

2.4A complete overview including transfer mechanisms is set out in the list of sub-processors. Processing outside the European Union takes place solely on the basis of a mechanism under Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR").

Article 3 – Access control

3.1Access to data is separated at database level; user and administrator roles hold different permissions.

3.2Access is restricted at the level of individual records, so that a user has access solely to data they themselves created. The restriction is enforced by the database, not by the application.

3.3For administrator accounts, multi-factor authentication is enforced; access to the administration without a second factor is not possible.

3.4Access by the Operator's staff to customer data is limited to the extent necessary for support and incident resolution and belongs solely to persons bound by confidentiality under Article 6.1.

3.5Release of a call record and release of a verbatim quotation of a statement are recorded by name.

Article 4 – Encryption

4.1All transmission of data is encrypted using TLS.

4.2The server's storage is encrypted; data is therefore encrypted at rest as well.

4.3Backups are encrypted. The decryption key is not stored on the server being backed up.

Article 5 – Logging and traceability

5.1Changes to data are recorded in an audit trail identifying the person who made the change.

5.2Operational records of calls, the audit trail and records of data release are subject to their own retention periods and are deleted by an automated job once those periods expire; the periods are set out in the Retention Policy.

5.3Retention periods are enforced by deletion jobs, not by an instruction to staff.

Article 6 – Organisational measures

6.1All persons with access to data are bound by a written confidentiality undertaking.

6.2Development and testing of the product take place solely on anonymised or synthetic data; real call transcripts are not used for that purpose.

6.3Engaging a further processor is subject to the procedure under Article 5 of the data processing agreement, including notice of at least 30 days.

6.4For every processor, evidence of the transfer mechanism is verified and the date of verification is recorded.

Article 7 – Backup and restoration

7.1A backup of the database is taken daily and retained for 30 days.

7.2The restorability of backups is verified quarterly.

7.3The age of the most recent backup is monitored by an automated check.

Article 8 – Certifications of providers whose services the Operator uses

8.1The following certifications belong to the providers stated, not to the Operator:

8.2Evidence is verified under the Operator's internal procedures and the date of the most recent verification is recorded.

Article 9 – What this declaration does not cover

9.1The Operator does not hold certification under ISO/IEC 27001, a SOC 2 report, or an equivalent attestation issued by an independent auditor.

9.2The Operator does not maintain security monitoring on a continuous basis.

9.3Health data contained in a call transcript is also retained at the provider of the voice interaction outside the European Union, on the basis of a mechanism under Chapter V of the GDPR; details are in the Retention Policy.

9.4The facts under Articles 9.1 to 9.3 are stated because a security declaration that is silent about what is not in place cannot be used to assess risk.

Article 10 – Verification and reporting

10.1A partner is entitled to verify performance of the measures under the procedure in Article 8 of the data processing agreement.

10.2The Operator shall report a security breach to the controller without undue delay and at the latest within 24 hours of becoming aware of it (Article 4.1(g) of the data processing agreement).

10.3Findings concerning security may be reported at info@querybeam.eu.

Article 11 – Changes to the declaration

11.1The declaration is updated on every change to the measures under Articles 3 to 7 and on any change to the facts under Article 8.

11.2A change is issued as a new version; effective wording is not altered retrospectively.