Data processing agreement
Last updated · Plain English first, then the detail under each heading.
The short version
Your customers’ details are yours. We handle them only to do what you ask in QuotePaid, keep them safe and confidential, use only the suppliers we list, help you answer your customers, tell you fast if something goes wrong, and delete them when you leave.
01 Who this agreement is between
This agreement is part of our terms of service. You accept it by ticking the box when you sign up, and again if it changes; we keep a record of the version you accepted and when. For your customers’ details, your business is the controller (you decide why and how they’re used) and QuotePaid is your processor (we handle them for you). It meets Article 28 of the GDPR.
02 What we handle, and why
| Whose details | Your customers and the people you deal with for them (a tenant, a site contact) |
|---|---|
| What details | Names, addresses, emails, phone numbers, job details, quotes, invoices, payment status, photos, voice notes and the text made from them, and the record of messages sent |
| What we do with them | Store them, show them to you, send your quotes, invoices, receipts and reminders by email or link, take card payments through your Stripe account, turn voice notes into draft quotes |
| Why | To run QuotePaid for you, nothing else |
| For how long | While your account is open, then 90 days |
03 We act only on your instructions
What you do in QuotePaid is your instruction to us: adding a customer, sending a quote, switching on reminders. Our terms and this agreement are your other instructions. We don’t use your customers’ details for anything else, unless the law requires it, and then we’ll tell you first if the law allows. If we think an instruction breaks data protection law, we’ll tell you.
04 Confidentiality
Only people who need to see your customers’ details to run or support QuotePaid can see them, and they are bound to keep them confidential. Support staff open your account only to help you or to keep the service safe, and each time is logged.
05 Keeping it safe
Every connection is encrypted. Each business’s data is kept apart at the database level, so one business can never see another’s. Data is stored in Ireland, and access to it is limited and logged.
06 Our suppliers
You allow us to use the suppliers on our list of suppliers. Each one is bound by a written agreement with the same data protection duties as this one. We’ll email you at least 30 days before adding or replacing a supplier that handles your customers’ details. If you object, tell us at support@quotepaid.ie; if we can’t meet your objection, you can cancel before the change. We stay responsible to you for our suppliers.
07 Outside the EU
Some suppliers are in the United States: voice notes go there to be turned into text, and email logs are kept there. Each transfer is covered by the EU–US Data Privacy Framework where the supplier is certified, and by the EU’s standard contractual clauses in every supplier’s agreement.
08 Helping you
If a customer asks you to see, correct or delete their details, you can do most of it in the app: edit or remove the customer, download their quotes and invoices. Where you need more, we help. If a customer writes to us instead, we pass it to you.
If we find a breach that affects your customers’ details, we’ll tell you without undue delay, and within 48 hours of finding it, with what we know and what we’re doing about it, so you can meet your own 72-hour duty. We’ll also help with an impact assessment if you need one.
09 When you leave
You can download your quotes and invoices while your account is open and for 90 days after it ends. Then we delete your customers’ details, unless the law requires us to keep something. Copies in backups are deleted as the backups expire.
10 Showing we keep to this
We’ll give you the information you need to show this agreement is kept to, and answer reasonable questions from you or your auditor. Write to support@quotepaid.ie.
11 What we decide ourselves
For a few things we decide the purpose ourselves, so for those we answer as controller, as our privacy policy explains:
- building anonymised price ranges from sent quotes, with no customer details (only once at least 30 quotes from 5 businesses are in);
- looking at the names of custom trades, their units and price list item names across businesses, to choose which trades to support next;
- security and spam checks, and usage counts for fair limits.
12 Stripe
If you connect Stripe, you instruct us to create payments on your Stripe account and read their updates. Stripe handles card details under its own terms with you, the Stripe Connected Account Agreement, and its data processing agreement. Tell your customers that card payments go through Stripe.