Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms part of the QuickOmniPay Terms of Use (the “Main Agreement”) between (1) ML Digital Group LLC, a Wyoming (USA) limited liability company, registration no. 2026-002060085, 30 N Gould St, STE R, Sheridan, WY 82801, USA, privacy contact: mldigitalgroup.llc@gmail.com (“Processor” or “QuickOmniPay”); and (2) the author who connects a Telegram channel, group or other content to QuickOmniPay and accepts this DPA (“Controller” or “Author”).

When this DPA applies. It applies whenever QuickOmniPay processes subscriber personal data on the Author's behalf. It satisfies the processor-contract requirements of the GDPR (Art. 28) and of the Law of Ukraine “On Personal Data Protection”. Where a provision refers to the GDPR and the GDPR does not apply to the processing, that provision applies only to the extent it is consistent with the applicable law.

1. Definitions

1.1. “Applicable Data Protection Law” means the data protection laws that apply to the processing under this DPA, including, where applicable, Regulation (EU) 2016/679 (“GDPR”) and the Law of Ukraine “On Personal Data Protection”.

1.2. “Personal Data”, “Processing”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given in the Applicable Data Protection Law.

1.3. “Services” means the QuickOmniPay features the Author uses to create subscription plans, receive payment-status notifications, keep subscriber records, and grant or remove access to the Author's Telegram channels and groups.

1.4. “Sub-processor” means a third party engaged by QuickOmniPay to process Personal Data on the Author's behalf.

1.5. “Instructions” means this DPA, the Author's settings in the Services, and other written instructions consistent with the Services.

2. Roles

2.1. For subscriber data processed to run the Author's paid access, the Author is the controller and QuickOmniPay is the processor.

2.2. QuickOmniPay is an independent controller for processing for its own purposes: the Author's account, SaaS billing, fraud and abuse prevention, platform security and legal compliance. That processing is governed by the Privacy Policy, not this DPA.

2.3. Telegram, and the payment provider the Author connects (for example monobank, LiqPay, WayForPay, Stripe or Revolut), are not QuickOmniPay's sub-processors. The Author and subscribers use them under their own agreements with those providers.

3. Processor obligations

QuickOmniPay shall: 3.1. process Personal Data only on the Author's Instructions, including for international transfers, unless the law requires otherwise; in that case it shall inform the Author first where legally permitted; 3.2. tell the Author promptly if it believes an Instruction breaches Applicable Data Protection Law; 3.3. ensure that people authorised to process Personal Data are bound by confidentiality; 3.4. apply the security measures in Annex 2; 3.5. engage Sub-processors only under Section 4; 3.6. help the Author answer Data Subject requests: the Author can view, export and delete subscriber records in the dashboard, and QuickOmniPay shall forward any request it receives directly to the Author within 5 business days; 3.7. reasonably assist the Author with security, breach notification, data protection impact assessments and prior consultation; 3.8. notify Personal Data Breaches under Section 8; 3.9. delete or return Personal Data under Section 7; 3.10. make available the information needed to demonstrate compliance and allow audits under Section 6.

4. Sub-processors

4.1. The Author gives general authorisation to engage the Sub-processors listed in Annex 1.

4.2. QuickOmniPay shall bind each Sub-processor by a written contract with data protection obligations no less protective in substance than this DPA, and remains responsible for its Sub-processors' performance.

4.3. QuickOmniPay shall announce any new or replacement Sub-processor at least 15 days in advance by a message in @QuickOmniPay_bot and an update of the list at pay.quickomnipost.com/subprocessors. The Author may object on reasonable data protection grounds within that period.

4.4. If an objection cannot be resolved, the Author may stop using the affected feature or terminate the Services, and receives a pro-rata refund of prepaid fees for the unused period.

5. International transfers

5.1. Personal Data is processed in the countries listed in Annex 1. QuickOmniPay shall not transfer Personal Data to other countries except under the Instructions and Applicable Data Protection Law.

5.2. Where the GDPR applies to the Author, the parties enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor), which are incorporated by reference. For the Clauses: Annex I is Annex 1 of this DPA, Annex II is Annex 2, the supervisory authority is the one competent for the Author, and the governing law and courts under Clauses 17 and 18 are those of Ireland.

5.3. QuickOmniPay relies on the EU–US Data Privacy Framework or the Standard Contractual Clauses for its US-based Sub-processors, as indicated in Annex 1.

6. Audits

6.1. On written request, QuickOmniPay shall provide, within 30 days, documentation reasonably needed to demonstrate compliance with this DPA. 6.2. If the documentation is insufficient, or a Supervisory Authority requires it, the Author or an independent auditor bound by confidentiality may audit, with at least 30 days' notice, once per calendar year, unless a Personal Data Breach justifies an additional audit. 6.3. Audits shall not give access to other customers' data or to source code, and shall be at the Author's cost unless they reveal a material breach by QuickOmniPay.

7. Deletion and return

7.1. The Author can export and delete subscriber records in the dashboard at any time. 7.2. Within 30 days after termination of the Services, QuickOmniPay shall delete the Author's subscriber data, unless the Author asks for an export before that date or the law requires storage. 7.3. Backups are overwritten within 90 days. Until then they remain access-restricted and are not used for ordinary operations. 7.4. On request, QuickOmniPay shall confirm deletion in writing.

8. Personal Data Breaches

8.1. QuickOmniPay shall notify the Author without undue delay, and in any case within 48 hours after becoming aware of a Personal Data Breach affecting the Author's data. 8.2. The notice shall describe, as far as known: the nature of the breach and the approximate number of Data Subjects and records affected; its likely consequences; the measures taken or proposed; and a contact point. Information may be provided in stages. 8.3. The Author decides whether to notify a Supervisory Authority or Data Subjects. QuickOmniPay shall cooperate with the Author's investigation and remediation.

9. Liability and term

9.1. This DPA applies for as long as QuickOmniPay processes Personal Data on the Author's behalf. Obligations on confidentiality, security and deletion survive termination until fulfilled. 9.2. Each party is responsible for its own compliance with Applicable Data Protection Law. Liability under this DPA is subject to the limitations in the Main Agreement, except where Applicable Data Protection Law does not permit them. 9.3. Governing law and dispute resolution follow the Main Agreement, except for the Standard Contractual Clauses, which follow Section 5.2. If this DPA conflicts with the Main Agreement on data protection, this DPA prevails; if either conflicts with the Standard Contractual Clauses, the Clauses prevail.

10. Acceptance

10.1. The Author accepts this DPA by ticking the acceptance box when connecting a channel in @QuickOmniPay_bot or the dashboard. QuickOmniPay records the Telegram account ID, the DPA version and the date and time of acceptance. 10.2. The Author confirms that it has a lawful basis to have subscriber data processed and that it informs subscribers about this processing, including that QuickOmniPay acts as its processor.

Annex 1 — Details of processing

Sub-processors (confirmed against the live stack, 18 Oct 2026)

Telegram and the Author's payment provider are not sub-processors (Section 2.3). No error-monitoring or email-marketing sub-processor is used at present.

Annex 2 — Technical and organisational measures

This Annex describes measures actually implemented as of 18 Oct 2026. It is a description, not a certification or audit report.