Data Processing Agreement (DPA)
pursuant to Art. 28 GDPR · QuickQuote - quickquote.tech · Version: 9 August 2026
English courtesy translation of the German legal text. In case of discrepancies, the German version shall prevail.
Preamble
This Data Processing Agreement (the "DPA") is concluded between the provider of the QuickQuote software as processor and the customer as controller and supplements the General Terms and Conditions (T&Cs) of QuickQuote.
This DPA applies to all processing activities in which the processor processes personal data on behalf of the controller arising in connection with the use of the QuickQuote software.
Section 1 Parties
Processor:
Lukas Keßler / QuickQuote
Buergermeister-Fuchs-Str. 70, 68169 Mannheim
Email: privacy@quickquote.tech
Controller:
The customer as stored in the T&Cs and in the customer account (hereinafter the "Controller" or "Customer").
Section 2 Subject Matter and Duration of Processing
(1) The subject matter of the commissioned processing is the provision of the cloud-based QuickQuote software for the digital capture of inspection and order data, for project management, quotation preparation, execution and site documentation, time tracking and invoice preparation in the skilled trades sector, including the receipt of enquiries via public enquiry links shared by the customer.
(2) The duration of commissioned processing corresponds to the duration of the usage agreement in place between the parties (Section 15). After termination of the usage agreement, the rules on data deletion pursuant to Section 9 of this DPA apply.
Section 3 Nature and Purpose of Processing
(1) The processor processes personal data exclusively on behalf of and in accordance with documented instructions of the controller, unless a legal obligation requires different processing.
(2) Processing includes in particular the following activities: collection and capture, storage, structuring, automated transcription of voice recordings, AI-supported analysis, summarization and translation of content, AI-supported review of quotation and invoice drafts, transmission to the sub-processors named in Section 7, and deletion of data in the course of using the software. Processing also includes the receipt, storage and provision of end-customer enquiries submitted via the customer's public enquiry links. Such enquiries are not processed automatically by AI services; AI-supported processing only takes place once the customer transfers an enquiry into a project.
(3) When the Quey AI and voice assistant is used, processing includes creating a role-limited workspace context, transmitting the current user question and that context to the AI sub-processor, generating a text and voice answer, and retaining a time-limited usage record for security, abuse-prevention and evidence purposes. Quey does not make substantive changes to workspace data and does not make solely automated decisions producing legal or similarly significant effects.
Section 4 Types of Data and Categories of Data Subjects
Within the scope of commissioned processing, the following categories of data may be processed:
| Categories of data subjects | Type of data |
|---|---|
| Employees and users of the customer | Name, email address, login credentials, usage behavior, working and break times, timesheet and approval data, absence and sickness information, optionally uploaded certificates of incapacity for work, voice and audio recordings (voice notes), transcripts generated from them, assistant questions, and assistant usage and audit data |
| End customers of the customer (for example commissioning parties of skilled-trade services) | Name, address, contact details, addresses of properties and construction sites, appointment data, project information, photos, notes, quotes, invoices and associated documents where recorded in the workspace |
| Prospects and enquirers of the customer (persons who submit an enquiry via a public enquiry link or QR code of the customer) | Name, phone number and/or email address, description of the request, requested service, postcode and town |
| Suppliers and other business partners of the customer | Name, address, contact details, incoming invoices, delivery notes, amounts, payment and approval information and associated documents |
| Persons depicted in photos | Image data from construction sites and inspections |
| Other persons whose data the customer records in the software | Other personal data entered by the customer |
When the absence-management feature is used, sickness information and uploaded certificates of incapacity for work may be processed as health data within the meaning of Art. 9 GDPR. The controller shall ensure the required legal basis, restrict access permissions and determine an appropriate retention period. Otherwise, special categories of personal data should not be entered in free-text fields, documents or public enquiry forms unless this is necessary for the relevant purpose and legally permissible.
Section 5 Obligations of the Processor
(1) The processor processes personal data exclusively in accordance with the controller's documented instructions and the provisions of this DPA.
(2) The processor shall ensure that persons authorized to process personal data have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality.
(3) The processor shall take all necessary technical and organizational measures pursuant to Art. 32 GDPR to ensure a level of protection appropriate to the risk.
(4) The processor shall assist the controller in complying with obligations pursuant to Arts. 32 to 36 GDPR insofar as this lies within the processor's sphere of influence.
(5) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR.
Section 6 Obligations of the Controller
(1) The controller is solely responsible for the lawfulness of the collection and processing of personal data when using QuickQuote.
(2) The controller shall ensure that an appropriate legal basis pursuant to Art. 6 GDPR exists for all personal data entered into QuickQuote.
(3) The controller shall inform the processor without undue delay if errors or irregularities in the processing of personal data are identified.
(4) The controller shall issue instructions relating to data processing exclusively in written or electronic form.
Section 7 Use of Sub-Processors
(1) The controller hereby grants the processor general authorization to engage the following sub-processors:
| Sub-processor | Service | Location / third-country transfer |
|---|---|---|
| Google Ireland Limited (Firebase, Google Cloud) Gordon House, Barrow Street, Dublin 4, Ireland |
Hosting, database, authentication, storage, cloud functions | Ireland; Cloud Functions in europe-west1 and Cloud Firestore in eur3. Globally provided Firebase services may process outside these regions. Where data is transferred to Google LLC (USA): EU-U.S. DPF + standard contractual clauses |
| OpenAI Ireland Ltd. 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland |
Transcription of deliberately recorded voice notes and AI-supported analysis and answer generation, including Quey | Ireland; third-country transfers to affiliates or sub-processors on the basis of standard contractual clauses or an adequacy decision |
| Stripe, Inc. | Payment processing | USA: EU-U.S. DPF + standard contractual clauses |
| Resend, Inc. | Transactional email delivery | USA: standard contractual clauses under Art. 46 GDPR |
API content is not used by OpenAI for model training by default. QuickQuote has not enabled voluntary data sharing for model training. For the Responses API used by QuickQuote, application state is retained for at least 30 days by default unless different data controls are configured. In addition, abuse-monitoring logs containing customer content may generally be retained for up to 30 days; different data controls apply only where they have been approved by OpenAI and configured for QuickQuote. In each case, only the data required for the relevant function is transmitted.
Netlify, Inc. exclusively hosts the marketing website quickquote.tech and does not process any data on behalf of the controller; Netlify is therefore not a sub-processor within the meaning of this DPA. Stripe, Inc. is named as a precaution insofar as payment data is processed in connection with the usage agreement.
(2) The processor shall inform the controller of intended changes regarding the addition or replacement of sub-processors. The controller has the right to object to such changes within four weeks after notification. If the controller objects within this period and no amicable solution is reached, both parties are entitled to terminate the usage agreement with one month's notice.
(3) The processor shall ensure that sub-processors are subject to the same data protection obligations as the processor itself.
(4) The processor aims to process personal data primarily within the European Union or the European Economic Area. Where processing takes place in third countries, this is done exclusively on the basis of appropriate safeguards pursuant to Art. 46 GDPR or an adequacy decision of the European Commission.
Section 8 Assistance with Data Subject Rights
(1) The processor shall assist the controller, within technical possibilities, in handling requests from data subjects (access, rectification, erasure, restriction, portability, objection).
(2) Incoming requests from data subjects addressed directly to the processor shall be forwarded to the controller without undue delay.
Section 9 Deletion and Return of Data
(1) After termination of the usage agreement, the data stored in QuickQuote by the controller is kept available for collection and possible reactivation for a period of 90 days. After expiry of this period, all personal data of the controller will be deleted automatically and irreversibly, unless statutory retention obligations prevent deletion. The processor shall announce the deletion at least 30 days in advance by email to the administrator address on file. The controller can download its data using the software's export function; the export function and the retrieval links remain available for the entire 90 days. The export can be triggered at most once per calendar month; media files are not part of the export package, but can be downloaded via the retrieval links contained in the export.
(2) Upon the controller's request (by email to privacy@quickquote.tech), all personal data of the controller will be irreversibly deleted within 30 days, unless statutory retention obligations prevent deletion.
(3) At the controller's request, the processor shall confirm complete deletion of the data in writing.
(4) Unopened enquiries received via a public enquiry link are deleted automatically 30 days after receipt. For opened or processed enquiries, the controller determines the further retention.
(5) Quey audit data comprising the user ID and name, role, time, a user question of no more than 400 characters and the number of projects included is retained for no more than 30 days. It is then deleted automatically and is included in any earlier complete workspace deletion.
Section 10 Notification of Personal Data Breaches
(1) The processor shall inform the controller without undue delay, as a rule within 24 hours and no later than within 48 hours after becoming aware, of personal data breaches pursuant to Art. 33 GDPR.
(2) To the extent possible, the notification shall contain: a description of the nature of the breach, the categories and approximate number of data subjects and data records concerned, the likely consequences and the measures taken or proposed.
(3) The duty to notify the competent supervisory authority of a personal data breach lies with the controller.
Section 11 Technical and Organizational Measures (TOMs)
The processor has implemented the following technical and organizational measures to protect personal data:
| Measure | Implementation |
|---|---|
| Encryption | Data transmission via TLS/HTTPS, encrypted data storage in Google Firebase |
| Access control | Authentication via Google Firebase Auth, role-based access rights (for example owner, manager, office, installer) |
| Availability control | Redundant cloud infrastructure at Google Firebase, automatic backups |
| Separation control | Tenant separation through workspace structure, data isolation per customer |
| Pseudonymization | Internal user IDs instead of plain names in system logs |
| Order control | DPAs with all sub-processors (Google, OpenAI, Stripe, Resend) |
| Disclosure control | No disclosure of data to third parties outside the named sub-processors |
| Input control | Logging of data changes, role-based access rights |
| Protection of public endpoints | Honeypot fields and server-side rate limiting for the public enquiry form; IP addresses are processed for this purpose only as a business-specific hash and are deleted after approximately 24 hours |
| Review procedure | Regular review, assessment and evaluation of the effectiveness of the measures (Art. 32(1)(d) GDPR), at least annually and additionally whenever there is specific cause |
| Administrative access | Two-factor authentication for all administrative accounts of the processor with the services used |
The processor may adapt the technical and organizational measures to the state of the art, provided that the agreed level of protection is not reduced.
Section 12 Right to Issue Instructions
(1) The controller may issue instructions to the processor regarding the processing of personal data at any time. Instructions must be transmitted in writing or by email to privacy@quickquote.tech.
(2) If the processor considers an instruction to be impermissible under data protection law, the processor shall inform the controller without undue delay. The processor is entitled to suspend execution of the instruction until the matter has been clarified.
Section 13 Controller's Right to Audit
(1) The controller has the right to verify the processor's compliance with data protection provisions and the terms of this DPA.
(2) Audits shall be conducted with reasonable prior notice (at least 5 business days) and at the controller's expense. The processor shall provide the necessary information and evidence.
(3) Instead of an on-site audit, the processor may offer submission of a current audit report by an independent third party.
Section 14 Final Provisions
(1) This DPA forms part of the contractual agreement between the parties and supplements QuickQuote's T&Cs.
(2) In the event of contradictions between this DPA and the T&Cs, the provisions of this DPA shall prevail with regard to data protection matters.
(3) This DPA is governed by the law of the Federal Republic of Germany. Place of jurisdiction is Mannheim.
(4) Amendments and additions to this DPA must be made in text form. The processor may amend this DPA with effect for the future, in particular in the event of changes to the legal situation or the scope of services; the processor shall inform the controller in text form at least four weeks before the amendments take effect. If the controller does not object within this period, the amended version is deemed accepted; the notification will point out this legal consequence.
(5) Should individual provisions of this DPA be invalid, the validity of the remaining provisions shall remain unaffected.
Section 15 Entry into Force
This DPA enters into force upon the customer's registration and acceptance of QuickQuote's T&Cs. It applies to every use of the software, regardless of whether the use is against payment (subscription) or free of charge (free enquiry access pursuant to the T&Cs); in this DPA, the subscription and the free enquiry access are together referred to as the "usage agreement". By accepting QuickQuote's T&Cs, the customer simultaneously agrees to the terms of this DPA.
Lukas Keßler · Buergermeister-Fuchs-Str. 70 · 68169 Mannheim · quickquote.tech