Data Processing Agreement
Last updated 1 November 2026
If you use Quiver privately, Wext AS is the controller and the privacy policy applies. This agreement applies when a business, for example a running club, a gym or a shop, uses Quiver to process personal data on behalf of others.
1. Parties and scope
The agreement is between the customer (controller) and Wext AS, org. no. 937 865 252 (processor). It forms part of the terms and meets the requirements of the General Data Protection Regulation (GDPR) Article 28. In case of conflict, this agreement takes precedence as regards personal data.
2. The processing
| Purpose | Fetching training and gear data from Strava and showing it in the app and on e-ink screens. |
|---|---|
| Nature | Collection, storage as a cache, calculation, display and erasure. |
| Data subjects | Users the customer gives access, who have connected a Strava account. |
| Data | Account details (e-mail, name), Strava ID and profile (name, city, country), activities (title, time, place name, distance, pace, elevation gain, average heart rate, laps, shoe), shoes, settings, screens, purchases and subscription status, and technical logs. |
| Special categories | Average heart rate per run, where it exists in Strava, may count as health data (Art. 9). The customer must have a valid basis, normally the user's explicit consent. |
| Duration | For as long as the customer uses the service. |
3. The processor's obligations
- Process personal data only on the customer's documented instructions, which are this agreement and the use of the service.
- Ensure that everyone with access is bound by confidentiality.
- Implement technical and organisational measures under Article 32 (see section 6).
- Help the customer respond to requests from data subjects (access, rectification, erasure, portability).
- Help the customer with data protection impact assessments and prior consultations, where relevant.
- Give the customer the information needed to show that the agreement is followed, and allow audits after reasonable notice, at most once a year unless a breach gives reason for more.
4. Sub-processors
The customer gives general prior authorisation for the sub-processors below. Each of them is bound by a data processing agreement with terms at least as strict.
| Provider | Purpose | Location | Mechanism |
|---|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd.) | Hosting: API, background jobs, database (Cloud SQL), Secret Manager and Firebase Hosting | EU/EEA (europe-north1, Finland; europe-west1, Belgium). Firebase Hosting serves through Google's global CDN | Stored in the EU/EEA. Google Cloud Data Processing Addendum with the EU Standard Contractual Clauses for any support access from outside the EEA |
| Clerk, Inc. | Sign-in and user accounts | USA | EU Standard Contractual Clauses in Clerk's DPA, and the EU–US Data Privacy Framework where Clerk is certified |
| Loops (loops.so) | E-mail: service messages and news you have asked for | USA | EU Standard Contractual Clauses in Loops' DPA, and the EU–US Data Privacy Framework where Loops is certified |
| RevenueCat, Inc. | In-app purchases: subscriptions to Quiver Pro through the App Store and Google Play | USA | EU Standard Contractual Clauses in RevenueCat's DPA, and the EU–US Data Privacy Framework where RevenueCat is certified |
New or replaced sub-processors are announced at least 30 days in advance. The customer may object on reasonable grounds. If we find no solution, the customer may terminate the service. The list is kept up to date on sub-processors.
Strava, Inc. is not a sub-processor. Strava is the source of the data, and users connect to Strava themselves. Strava is an independent controller for data stored there.
5. Transfers to third countries
The personal data is stored and processed in the EU/EEA on Google Cloud. Clerk, Loops and RevenueCat are in the USA. Only account details (Clerk), e-mail address and list choices (Loops), and user ID, purchases and device info (RevenueCat) are transferred to them, based on the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
6. Security
- Encryption in transit (TLS) and at rest. Strava tokens are additionally encrypted with AES-GCM.
- Screen tokens and codes are stored only as hashes. Each screen has its own revocable token.
- Secrets in Google Secret Manager. The database is reachable only by the service.
- Service accounts with least privilege. Builds run in CI without access to production.
- Daily backups, kept for 7 days.
- Strava data is stored for at most 7 days and deleted at once when a user disconnects.
7. Personal data breaches
The processor notifies the customer without undue delay, and no later than 48 hours after becoming aware of a breach, with what we know about what has happened, who is affected and what we are doing.
8. Deletion on termination
When the agreement ends, the processor deletes the personal data within 30 days, unless the customer asks for it to be handed over first or the law requires it to be kept. Backups are deleted when they expire after 7 days.
9. Governing law and venue
Norwegian law applies. Oslo District Court is the agreed venue.
Entering into the agreement
If your business needs a signed agreement, write to privacy@wext.as.