Data Processing Agreement (DPA)

This DPA also applies to free job scheduling under Section 5a of the Terms. Its scope includes team and job-site data, appointments, working hours, absences, approvals and signatures in timesheet PDFs. A separately ordered paid storage package adds photos, delivery notes and PDFs to the free planner. No payment data is required for use of the free core; payment processing for a separately ordered package is distinct from it. AI processing and medical-certificate attachments are not part of the free planner even with a storage package. Public enquiry links are currently unavailable.

pursuant to Art. 28 GDPR · QuickQuote - quickquote.tech · Version: 20 September 2026

English courtesy translation of the German legal text. In case of discrepancies, the German version shall prevail.

Preamble

This Data Processing Agreement (the "DPA") is concluded between the provider of the QuickQuote software as processor and the customer as controller and supplements the General Terms and Conditions (T&Cs) of QuickQuote.

This DPA applies to all processing activities in which the processor processes personal data on behalf of the controller arising in connection with the use of the QuickQuote software.

Section 1 Parties

Processor:

Lukas Keßler / QuickQuote
Buergermeister-Fuchs-Str. 70, 68169 Mannheim
Email: privacy@quickquote.tech

Controller:

The customer as stored in the T&Cs and in the customer account (hereinafter the "Controller" or "Customer").

Section 2 Subject Matter and Duration of Processing

(1) The subject of processing is the provision of the cloud-based QuickQuote software for project management, job scheduling, working-time and absence management and, depending on the selected plan, site visits, site documentation, AI features, quotes and invoices. This DPA also applies to free job scheduling, personal calendar subscriptions and the storage and provision of photos, delivery notes and PDFs with a storage package. Public enquiry forms are currently inactive.

(2) The duration of commissioned processing corresponds to the duration of the usage agreement in place between the parties (Section 15). After termination of the usage agreement, the rules on data deletion pursuant to Section 9 of this DPA apply. Cancellation of a storage package alone ends neither use of the free core nor this DPA. Existing files remain readable after cancellation of the package; further processing remains subject to this DPA and the controller’s instructions.

Section 3 Nature and Purpose of Processing

(1) The processor processes personal data exclusively on behalf of and in accordance with documented instructions of the controller, unless a legal obligation requires different processing.

(2) Depending on the functions actively used, processing includes collection, storage, structuring, modification and deletion of data, transcription of voice recordings, AI analysis and translation, review of quote and invoice drafts and transmission to sub-processors named in Section 7. In QuickQuote Pro, manually entered material, measurement and note entries are sent to the AI sub-processor without a separate trigger when a project is handed over to the office, in order to translate foreign-language entries into the company language. Public enquiry forms are currently unavailable. Any historical enquiry data remains subject to this DPA.

(3) Quey is not currently enabled. When Quey is used, the current user question, a limited history of the current conversation and a role-restricted workspace context may be processed and sent to the AI sub-processor to generate an answer. When voice input is deliberately activated, recordings may be stored temporarily and sent to OpenAI for cloud transcription; deletion is initiated after processing succeeds or fails. Technical errors can delay cleanup. Depending on the voice mode, device or browser speech services may also be used. For Quey’s cloud speech output, answer text is sent to OpenAI to generate audio. Supported internal changes occur only after a visible preview and explicit confirmation by an authorised user. Audit and operation records are handled under Section 9(5). AI features are not included in the free plan.

(4) The calendar subscription in the free planner and in Pro provides job and absence data for read-only retrieval by an external calendar service through a personal subscription link. This includes requests, planner notes as entered and absence types such as “Sick”. The link works like a password and enables retrieval without signing in to QuickQuote. It can be regenerated or revoked. Revocation stops future retrieval through that link but does not delete data already copied into external calendars. Selection and use of the external calendar service are governed by the controller’s documented instructions.

Section 4 Types of Data and Categories of Data Subjects

Within the scope of commissioned processing, the following categories of data may be processed:

Recording that a person is ill can constitute health data under Art. 9 GDPR. The controller ensures an appropriate legal basis, informs employees and determines necessary access and suitable retention periods. This DPA does not replace that legal basis. Diagnoses and health information unnecessary for absence management should not be entered. Medical-certificate attachments are available only in QuickQuote Pro; the storage package does not enable them in the free planner. This responsibility also applies when sickness information is provided through the calendar subscription.

Section 5 Obligations of the Processor

(1) The processor processes personal data exclusively in accordance with the controller's documented instructions and the provisions of this DPA.

(2) The processor shall ensure that persons authorized to process personal data have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality.

(3) The processor shall take all necessary technical and organizational measures pursuant to Art. 32 GDPR to ensure a level of protection appropriate to the risk.

(4) The processor shall assist the controller in complying with obligations pursuant to Arts. 32 to 36 GDPR insofar as this lies within the processor's sphere of influence.

(5) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR.

Section 6 Obligations of the Controller

(1) The controller is solely responsible for the lawfulness of the collection and processing of personal data when using QuickQuote.

(2) The controller shall ensure that an appropriate legal basis pursuant to Art. 6 GDPR exists for all personal data entered into QuickQuote.

(3) The controller shall inform the processor without undue delay if errors or irregularities in the processing of personal data are identified.

(4) The controller shall issue instructions relating to data processing exclusively in written or electronic form.

(5) For calendar subscriptions, the controller’s instructions determine whether and to which calendar service business data is provided. Using the feature does not replace a required legal basis or required information for the affected persons. The personal subscription link must be treated like a password because it grants access.

Section 7 Use of Sub-Processors

(1) The controller hereby grants the processor general authorization to engage the following sub-processors:

OpenAI does not use API content for model training by default; QuickQuote has not enabled voluntary data sharing for this purpose. Quey uses the Responses API with store: false, so it does not request storage of response state for later API retrieval. For other calls without this setting, OpenAI may retain application state for at least 30 days by default. Separate abuse-monitoring logs may generally include content for up to 30 days, subject to legally required exceptions. Complete zero retention at OpenAI is not promised. Only data needed for the actively used function or for the automatic translation at handover (Section 3(2)) is transmitted.

Netlify, Inc. exclusively hosts the marketing website quickquote.tech and does not process any data on behalf of the controller; Netlify is therefore not a sub-processor within the meaning of this DPA. Stripe, Inc. is named as a precaution insofar as payment data is processed in connection with the usage agreement.

(2) The processor shall inform the controller of intended changes regarding the addition or replacement of sub-processors. The controller has the right to object to such changes within four weeks after notification. If the controller objects within this period and no amicable solution is reached, both parties are entitled to terminate the usage agreement with one month's notice.

(3) The processor shall ensure that sub-processors are subject to the same data protection obligations as the processor itself.

(4) The processor aims to process personal data primarily within the European Union or the European Economic Area. Where processing takes place in third countries, this is done exclusively on the basis of appropriate safeguards pursuant to Art. 46 GDPR or an adequacy decision of the European Commission.

Section 8 Assistance with Data Subject Rights

(1) The processor shall assist the controller, within technical possibilities, in handling requests from data subjects (access, rectification, erasure, restriction, portability, objection).

(2) Incoming requests from data subjects addressed directly to the processor shall be forwarded to the controller without undue delay.

Section 9 Deletion and Return of Data

(1) After the processing services end, the processor returns or deletes personal data processed on the controller’s behalf, according to the controller’s choice and documented instruction, and deletes existing copies unless retention is required by law. Automatic deletion solely due to inactivity or after a fixed period following termination is not currently implemented. Technical self-service exports do not replace the instruction or statutory duties to return or erase data. The owner can use the profile screen to create a JSON export containing personal profile data, the company profile, team data and projects, including recorded project hours and any inspection data, material and note entries and quote drafts. The content depends on the features used. The export does not represent all workspace data: separate planner events, absences, working-time models and individual leave settings, internal hours and additional project documents are not included. Media and PDF files are not embedded; any included file references must be retrieved separately. Timesheet PDFs can be downloaded through the timesheet feature. On the same device and for the same account, the app permits another export after 30 days. Statutory rights of access and data provision remain unaffected; further requests can be sent to privacy@quickquote.tech.

(2) The controller sends return or deletion instructions to privacy@quickquote.tech. The processor implements them subject to statutory obligations and informs the controller about the scope of implementation and any legal obstacles. Where data must be retained under a legal obligation, the purpose and duration of that retention are communicated. If the owner is the only active person in the workspace and the workspace contains no business records such as sent or accepted quotes, invoices or incoming invoices, the owner can also delete the workspace in the account settings. This self-service deletion counts as a deletion instruction from the controller. It deletes the workspace data, stored files, memberships and the owner’s login permanently and without prior return. Any return of data must take place beforehand through the export under paragraph (1) or an instruction under the first sentence of this paragraph. Requests to end paid subscriptions can be sent to the provider together with the deletion instruction (Section 7 of the Terms).

(3) On request, the processor confirms the deletion performed in text form and identifies any remaining data that must be retained by law.

(4) Public enquiry forms are currently unavailable. Any historical enquiries remain subject to the controller’s instructions and the rules on return and deletion above.

(5) Regular Quey logging stores user identifiers, names, roles, timestamps and usage or operation metadata, but no question text, answer or complete conversation context. Confirmed internal changes may create additional audit and operation records. These business records are not subject to a uniform automatic 30-day deletion period; their return and deletion are governed by paragraphs (1) to (3). Separate diagnostic records for enabled beta users may contain question text limited to 400 characters. These records become due for deletion after 30 days and are removed by a daily cleanup process with batch limits; a backlog may delay actual deletion.

Section 10 Notification of Personal Data Breaches

(1) The processor shall inform the controller without undue delay, as a rule within 24 hours and no later than within 48 hours after becoming aware, of personal data breaches pursuant to Art. 33 GDPR.

(2) To the extent possible, the notification shall contain: a description of the nature of the breach, the categories and approximate number of data subjects and data records concerned, the likely consequences and the measures taken or proposed.

(3) The duty to notify the competent supervisory authority of a personal data breach lies with the controller.

Section 11 Technical and Organizational Measures (TOMs)

The processor has implemented the following technical and organizational measures to protect personal data:

The processor may adapt the technical and organizational measures to the state of the art, provided that the agreed level of protection is not reduced.

Section 12 Right to Issue Instructions

(1) The controller may issue instructions to the processor regarding the processing of personal data at any time. Instructions must be transmitted in writing or by email to privacy@quickquote.tech.

(2) If the processor considers an instruction to be impermissible under data protection law, the processor shall inform the controller without undue delay. The processor is entitled to suspend execution of the instruction until the matter has been clarified.

Section 13 Controller's Right to Audit

(1) The controller has the right to verify the processor's compliance with data protection provisions and the terms of this DPA.

(2) Audits shall be conducted with reasonable prior notice (at least 5 business days) and at the controller's expense. The processor shall provide the necessary information and evidence.

(3) Instead of an on-site audit, the processor may offer submission of a current audit report by an independent third party.

Section 14 Final Provisions

(1) This DPA forms part of the contractual agreement between the parties and supplements QuickQuote's T&Cs.

(2) In the event of contradictions between this DPA and the T&Cs, the provisions of this DPA shall prevail with regard to data protection matters.

(3) This DPA is governed by the law of the Federal Republic of Germany. Place of jurisdiction is Mannheim.

(4) Amendments and additions to this DPA must be made in text form. The processor may amend this DPA with effect for the future, in particular in the event of changes to the legal situation or the scope of services; the processor shall inform the controller in text form at least four weeks before the amendments take effect. If the controller does not object within this period, the amended version is deemed accepted; the notification will point out this legal consequence.

(5) Should individual provisions of this DPA be invalid, the validity of the remaining provisions shall remain unaffected.

Section 15 Entry into Force

This DPA enters into force upon the customer's registration and acceptance of QuickQuote's T&Cs. It applies to every use of the software, regardless of whether the use is against payment (subscription) or free of charge (free job scheduling pursuant to the T&Cs); in this DPA, the subscription and the free job scheduling are together referred to as the "usage agreement". By accepting QuickQuote's T&Cs, the customer simultaneously agrees to the terms of this DPA.

Lukas Keßler · Buergermeister-Fuchs-Str. 70 · 68169 Mannheim · quickquote.tech