QuickQuoteFor office & job site

Privacy Policy

for the QuickQuote software · Version: 20 September 2026

English courtesy translation of the German legal text. In case of discrepancies, the German version shall prevail.

1. Controller

The controller responsible for data processing in connection with the use of the QuickQuote software is:

Lukas Keßler / QuickQuote
Buergermeister-Fuchs-Strasse 70
68169 Mannheim
Email: privacy@quickquote.tech

Note: As soon as a company is incorporated (for example a UG or GmbH), that company shall replace the natural person named above as controller.

2. General Information

This Privacy Policy explains the nature, scope and purpose of the processing of personal data when using the QuickQuote software, the web application at app.quickquote.tech, the website quickquote.tech and the mobile apps for iOS and Android.

Personal data means any information by which you can be personally identified.

3. Data Collected

When using QuickQuote, the following data may be processed:

Order and site inspection data that the business records about its customers is processed by the provider as a processor on behalf of the business pursuant to Art. 28 GDPR. Details are governed by the data processing agreement (DPA). The data processing agreement is concluded upon registration and also applies to the free job-scheduling plan.

Acceptance link and wall display (QuickQuote Pro): A quote email from the business may contain a signed acceptance link that is valid for 60 days. Opening the link changes nothing. Only when the business’s customer expressly submits the acceptance on the confirmation page do we store the acceptance with its time and the recipient address on the record and notify the business in the app. Owner, boss and office can create display links for a screen at the business. These are valid for 180 days by default and can be revoked at any time. Anyone who opens such a link sees the weekly plan without signing in, with the names of active installers and technicians and of other scheduled people, customer names and project labels of the jobs, titles of planner appointments, job periods and approved or reported absences with their type, as well as the company name and logo, but without notes, addresses or prices. The business decides where the link is opened. The provider processes both as a processor on behalf of the business.

Calendar subscription (free planner and Pro)

Each member can create a personal subscription link under Account and add it to an external calendar, such as Google Calendar, Outlook or Apple Calendar. The calendar service retrieves the jobs and absences provided through the link on a read-only basis; QuickQuote remains the source. The feed also includes requests and planner notes as entered, and the type of an absence, such as “Sick”. The link works like a password: anyone who has it can retrieve the data provided through it without signing in to QuickQuote. It can be regenerated or revoked. Revocation stops future retrieval through that link; it does not delete data already copied into an external calendar. The company determines how the link is used under its instructions and is responsible for the lawfulness of disclosure to the chosen calendar service. Creating or adding the link does not replace a required legal basis or required information for the affected persons. In particular, the information on health data below remains applicable.

Counters and status reports: Counters for AI calls, tokens and calls per account are used to limit costs and abuse. If hour entries on a device could not be transferred to the server, the app reports this to the server: whenever the number changes, about once a day while it is unchanged and once when the fault has been resolved. This allows us to detect and fix such faults. This report contains no content of the entries. The legal basis in each case is Art. 6(1)(f) GDPR (legitimate interest in secure, cost-limited and fault-free operation).

Even recording that a person is ill can constitute health data under Art. 9 GDPR. The business is responsible for an appropriate legal basis, informing employees and setting suitable retention periods, in particular under Art. 9 GDPR and Section 26 BDSG where applicable. Diagnoses and unnecessary health information should not be entered. QuickQuote processes business absence data as a processor on the business’s instructions. The DPA does not itself provide a legal basis for collecting that data.

The data is processed for the functions described below, contract administration, secure operation and compliance with statutory duties.

4. Purpose and Legal Bases of Processing

Data is processed for the following purposes:

Legal bases:

5. Hosting and Infrastructure (Google Firebase, Netlify)

The QuickQuote software (web application at app.quickquote.tech) is provided through Google Firebase (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Firebase is used for the following services:

The server-side Cloud Functions are configured in the europe-west1 region; Cloud Firestore is operated in the European multi-region eur3. Certain globally provided Firebase services, in particular Authentication, Cloud Messaging, Analytics and Crashlytics, may also process data outside these regions.

In this context, personal data (for example email address, name, project data, technical usage data) may be processed on Google's servers. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google. Google LLC is certified under the EU-U.S. Data Privacy Framework; additionally, standard contractual clauses pursuant to Art. 46 GDPR are in place.

Legal basis: Art. 6(1)(b) GDPR.

Optional telemetry: Usage analytics and error diagnostics are disabled by default. Only after explicit device-specific consent are screen views, selected usage events, app and device versions and technical crash and error data transmitted to Firebase Analytics or Crashlytics. In the web application, after consent, minimised error records containing time, error type, route, build, platform and user ID may be stored in Cloud Firestore. Consent can be withdrawn at any time in the profile settings with effect for the future; collection then stops on the respective device. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Account management page: Firebase Authentication and Firebase Cloud Functions are also used on the account management page at quickquote.tech/en/account. When this page is opened, the required Firebase JavaScript files are loaded from www.gstatic.com. Google may process technically necessary connection data, in particular the IP address, time, and browser and device information. When signing in, the email address and password are sent to Firebase Authentication for verification. The account page does not write the entered password to browser storage. After successful sign-in, the session data required for authentication is sent to a Cloud Function in europe-west1 to create a Stripe customer portal session; the browser is then redirected to Stripe. These operations are not used for advertising or audience measurement.

The marketing website quickquote.tech (not the web application) is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. This does not affect the use of Firebase on the account management page described above. When the website is accessed, Netlify processes technically necessary server log data (in particular the IP address, time of access, page requested, user agent) in order to deliver the website and ensure its security. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Netlify; the transfer to the USA is based on standard contractual clauses pursuant to Art. 46 GDPR.

When starting a paid subscription via the checkout form on the pricing page, interested parties provide the owner email address and company name as required information. We also process the confirmation of business status, acceptance of the Terms and DPA, acknowledgement of the Privacy Policy, the relevant document versions, language and the selected number of additional licenses. This data is used to prepare the order, create a secure checkout session with Stripe and keep evidence of the legal confirmations (see Section 7 “Payment Processing (Stripe)”). If the pricing page is opened with a ref source parameter, this value is sent to the server together with the checkout information, recorded in the Stripe metadata of the checkout session and used for a daily source counter. This solely measures which of our own referrals initiated a checkout; we do not use cookies or cross-browser identifiers for this purpose and do not create a cross-site usage profile. It is not used for advertising purposes or shared with third parties for advertising purposes.

Legal basis for website hosting: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). Legal basis for the checkout form: Art. 6(1)(b) GDPR (performance of pre-contractual measures). Source attribution is based on Art. 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of our own referrals).

Firebase App Check: We use reCAPTCHA Enterprise in the web application, Play Integrity on Android and App Attest or DeviceCheck on iOS to check requests for authenticity and protect our infrastructure. Google may process IP addresses, device and browser information and technical validation signals. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in protecting the application against abuse.

5a. Free Job Scheduling

Registration and evidence: During registration in the web application, we process the verified email address, owner's name, company name, selected language and company profile. We store the free plan, owner membership, timestamps and document versions of acceptance of the Terms and DPA, and confirmation of business status. This provides and documents the free usage agreement (Art. 6(1)(b) GDPR). The DPA governs processing employee and customer data on behalf of the business.

Source: The workspace records whether registration started from the web application or our own planner page (signupSource). This measures our own referrals without cookies, cross-device identifiers or a cross-site profile. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in evaluating our own referrals. An upgrade link contains the suggested number of team seats and a short-lived authorisation issued to the verified owner. This authorisation is bound to the owner, workspace, email address and selected seats and is valid for ten minutes. It is transferred in the URL fragment, removed from the address when read, kept only in the page’s memory and sent to the checkout server with the purchase request. It is not saved in browser storage or logs. Names and email addresses are not transferred in the link.

Secure purchase authorization: In a separate area inaccessible to app users, the server stores only the hash of the short-lived authorization, not the plain token. It also stores the associated account ID, business, owner email address, selected team seats, a hash of the purchase details and, where available, the Stripe checkout session ID and URL. This data prevents unauthorized purchases and allows the same purchase request to be repeated safely. Unused authorizations expire after ten minutes. Records for a started checkout session are retained until the open Stripe session expires, normally after 24 hours. A cleanup job running every six hours removes expired entries in bounded batches; a backlog may delay actual deletion. The legal bases are Art. 6(1)(b) GDPR for preparing the requested purchase and Art. 6(1)(f) GDPR for protection against abuse and duplicate orders.

Invitations: The owner may enter invitees' names, email addresses, optional phone numbers and roles. Invitations contain the company name, inviter's name and company contact address and are sent through Resend. On acceptance, membership, role, invitation reference and acceptance time are stored. The business is responsible for entering this data lawfully. Invited employees do not enter into their own DPA for the business.

Processing scope: The free plan processes basic site data including customer name, address, contact details and description, planner events, team assignments, absences, working hours, approvals and corrections. It also processes working-time models with a name, scheduled hours for each weekday and an effective date, their assignment and change history, and individual annual leave allowances, carry-over and reference year, employment start date and working days per week. Invitations may contain these employment details as the intended assignment before acceptance. Customer signatures are drawn into the timesheet PDF. Push messages can inform staff about scheduled jobs. Without a storage package, photo and supporting-document uploads are not part of the free core. A separately ordered paid storage package enables photos, delivery notes and PDFs to be uploaded and made available for the company. Medical-certificate attachments remain exclusive to QuickQuote Pro and are not included in the free planner even with a storage package. The storage package does not enable AI features. The setup character displays fixed explanatory text and is not an AI assistant. The free plan does not transmit content to OpenAI for AI processing. User-entered text is not translated automatically.

Storage package: Only the owner enables the add-on in the browser or on Android. Use of the free core remains separate from this order. Uploaded photos, delivery notes and PDFs are processed as business files; existing role permissions continue to apply. After cancellation of the storage package, existing files remain readable. Cancellation of the package alone does not end the free usage agreement and is not an instruction to delete the files. The provisions below and the DPA continue to govern their return or deletion.

Abuse prevention: Registration attempts are limited over time by account, network signal and overall volume. Individual counters convert account and network signals into HMAC values using a randomly generated secret that changes daily. IPv6 addresses are first reduced to a /64 network. These counters do not store plain IP addresses, email addresses or account IDs. The values are pseudonymised, not anonymous: while the daily secret is stored, the provider can technically recompute whether a counter belongs to a known account ID or IP address. The counters are used solely to limit volumes and are not analysed for any other purpose. Entries expire 48 hours after the relevant window; a cleanup job running every six hours removes expired entries in bounded batches. A backlog, for example during distributed mass registration, may delay actual deletion. Daily secrets expire after 48 hours and are also cleaned up. Global daily totals of successful registrations and business-specific invitation and checkout counters are also used. These business and aggregate counters, and remaining order records, are not subject to the cleanup of short-lived registration hashes described above; the purpose-based retention rules in Section 12 apply. These limits protect against spam, automated mass registration and unnecessary infrastructure load (Art. 6(1)(f) GDPR).

Team limits: The server checks roles and the permitted number of memberships. Unassigned or excess accounts may be deactivated automatically. The owner may request a review through support.

Payment and retention: Free registration collects no payment data and creates no Stripe checkout session. Section 7 applies only upon a separate paid order, such as QuickQuote Pro or the storage package. Free workspaces are not deleted automatically solely due to inactivity. Ending use and returning or deleting business data are handled with the owner under Section 12 and the DPA or take place through self-service deletion under Section 14. Business and account data is distinct from short-lived abuse counters.

5b. Public Enquiry Forms

Public enquiry forms and the former free enquiry access are currently unavailable. Free job scheduling does not activate these functions.

6. Use of AI Services (OpenAI)

To support certain functions, the API of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland is used. Before another AI service provider is used, this Privacy Policy will be updated accordingly and the change will be communicated under the rules governing sub-processors.

Depending on the function, the following data is transmitted to the AI service:

Automatic translation at handover: When a project in QuickQuote Pro is handed over to the office, after the site visit or after completion of the work, the server checks manually entered material, measurement and note entries without a separate trigger. For this purpose, the name, details, category, unit, title and note text of these entries are sent to OpenAI. Foreign-language entries are translated into the company language, and the original text remains in the entry. Entries that have already been translated or were captured by AI are not sent again. This translation does not take place on the free plan.

Quey AI and voice assistant

Quey is not currently enabled. The information on Quey in the following four paragraphs applies only once Quey is enabled.

Quey is an AI-supported text and voice assistant in QuickQuote Pro. QuickQuote creates a limited context on the server from data the requesting user may access under their role. This can include project and customer names, site addresses, appointments, team assignments, status and review information, and amounts and payment status for authorised administrative roles. The context, user question and a limited history of the current conversation may be sent to OpenAI. Photos and complete files are not part of the automatically created Quey context. Information users enter into the conversation may also be processed.

For deliberately started Quey voice input, processing depends on the mode used. In cloud mode, audio is stored temporarily in Firebase Storage and sent to OpenAI for transcription. Deletion of the temporary recording is initiated after processing succeeds or fails; technical errors can delay cleanup. Alternatively, operating-system or browser speech recognition may be used. The relevant provider may process audio on its servers. For speech output, the selected system voice may send answer text to a network-based speech-synthesis service. For Quey’s cloud speech output, the answer text to be read aloud is sent to OpenAI to generate audio. Recognised text is processed in the same way as typed input.

Quey access and change records include user references, role and time. The regular query log does not contain question text. Where beta signals are enabled, an abbreviated user question of up to 400 characters may be processed. These beta signals are scheduled for deletion after 30 days; daily cleanup may be delayed by errors or a backlog. Minimised records of confirmed changes are separate and may remain with business records for longer. Answers, the full system prompt and complete workspace context are not stored as regular query logs. Role permissions and Section 12 govern access and retention.

Quey provides non-binding work guidance. Supported internal changes may be carried out following a visible preview and explicit confirmation by an authorised user. Quey does not send external messages or make solely automated decisions that produce legal or similarly significant effects. Assessing or monitoring employee performance or behaviour is not a purpose of the feature.

Information common to all AI features

Data is transmitted to OpenAI only when the relevant AI feature is actively used or for the automatic translation at handover described above, limited to the data needed for that purpose. Temporary audio files are scheduled for deletion after processing; transcripts may remain in the associated record. OpenAI does not use API content for model training by default; QuickQuote has not enabled voluntary data sharing for this purpose. Quey uses the Responses API with store: false, so it does not request storage of response state for later API retrieval. For other calls without this setting, OpenAI may retain application state for at least 30 days by default. Separate abuse-monitoring logs may generally include content for up to 30 days, subject to legally required exceptions. Complete zero retention at OpenAI is not promised.

Processing takes place automatically. The substantive accuracy or completeness of generated results cannot be guaranteed. Users are obliged to review AI-generated results on their own responsibility.

For customers established in the EEA, the Data Processing Addendum with OpenAI Ireland Ltd. applies. Where OpenAI transfers data to affiliates or sub-processors outside the EEA, the Data Processing Addendum provides for standard contractual clauses or an adequacy decision.

Where QuickQuote processes workspace content on behalf of the customer, it acts as a processor on the customer's documented instructions pursuant to Art. 28 GDPR. The customer, as controller, determines the applicable legal basis, in particular for customer and employee data. Where QuickQuote processes its own account, security or evidence data as controller, the processing is based on Art. 6(1)(b) or (f) GDPR, as applicable.

7. Payment Processing (Stripe)

Payments are processed by Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. When purchasing a Pro subscription or a separately ordered storage package, data required for payment processing (for example name, email address, billing address) is transmitted to Stripe.

Complete payment data (for example card numbers) is processed exclusively by Stripe and is not stored on our servers. Stripe is PCI DSS certified. Subscription management takes place through the customer portal at quickquote.tech/en/account.

Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Stripe.

Legal basis: Art. 6(1)(b) GDPR.

8. Email Delivery (Resend)

For sending transactional emails (such as invitations, welcome emails, notifications), we use the service Resend, Inc., 2261 Market Street #4059, San Francisco, CA 94114, USA.

In this process, the recipient's email address, the respective email content and, for document delivery, the PDF selected by you are transmitted to Resend. For delivery and support documentation, QuickQuote stores in the associated business record the recipient address, time sent, Resend message ID and the name and size of any attachment sent.

Data transfers to the USA take place on the basis of standard contractual clauses pursuant to Art. 46 GDPR.

Legal basis: Art. 6(1)(b) GDPR.

9. Web Fonts

This website uses the fonts “Inter”, “Instrument Serif” and “Barlow” for consistent visual presentation. The font files are served from the same server as the website (first-party hosting), not via external Google servers. No connection to Google is established and no IP address or other data is transferred to Google or any third party for the purpose of loading fonts.

10. Cookies and Local Storage

Local hours draft: An unfinished hours entry can be resumed as a draft on the same device for one day. The locally stored draft is associated with the user, company and relevant entry. This temporary storage allows an interrupted entry to be continued.

On the publicly accessible content pages of quickquote.tech, we do not use cookies or other browser identifiers for advertising, tracking or analytics purposes.

On the account management page at quickquote.tech/en/account, Firebase Authentication stores the sign-in state and session data required for authentication in the browser's session storage. The sign-in is stored as a session-based rather than a permanent local sign-in. In accordance with the Firebase SDK settings, it ends when the tab or window is closed; signing out also removes the sign-in state. The account page does not store the entered password in session storage. This storage is used exclusively for sign-in and access to the Stripe customer portal.

The web application at app.quickquote.tech may use browser storage for technically necessary authentication sessions, app settings and temporary state. Persistent offline storage of Firestore application data in the browser is not currently enabled. No data is stored for tracking or advertising purposes.

The decision on optional usage and error diagnostics is stored locally on the respective device. Without explicit consent, Firebase Analytics, Crashlytics and web error diagnostics remain disabled.

For functional usage counts in the public demo, we store only event totals per calendar day. We do not use cookies, user identifiers or raw IP addresses for this counter and do not create user profiles. Irrespective of this, the infrastructure providers named in Section 5 may process connection data when the service is accessed.

The homepage contains a clearly marked external link that lets users select QuickQuote as a preferred source on Google. We do not embed a Google script or content from Google for this purpose. A connection to Google is established only when the link is deliberately clicked. Google is responsible for the subsequent processing under its own privacy terms.

Technically necessary storage of and access to information on the end device is carried out pursuant to Section 25(2) no. 2 TDDDG where it is required to provide the expressly requested sign-in, account management or app functionality. The legal basis for the associated processing of personal data is Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR applies to security and functional usage counters. Optional usage analytics and error diagnostics are carried out only with consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

10a. Social Media Profiles

QuickQuote maintains public profiles on the following social networks:

When you visit one of these profiles, the relevant platform operator processes personal data under its own responsibility. This may include your IP address, device and browser data, and usage behaviour. If you are logged in, a link to your platform account may also be created. The operators may also use this data to create profiles and provide personalised advertising.

We use our profiles to present QuickQuote and to respond to messages, comments and enquiries. We process the associated data on the basis of Art. 6(1)(f) GDPR (legitimate interest in public relations and communication). Where an enquiry concerns entering into or performing a contract, the legal basis is Art. 6(1)(b) GDPR. We delete messages and comments once they are no longer required for handling the matter, unless statutory retention obligations apply.

The platform operators are X Corp. or Twitter International Unlimited Company (X), Meta Platforms Ireland Limited (Instagram) and LinkedIn Ireland Unlimited Company (LinkedIn). Information about their processing, international data transfers and your rights is available in their respective privacy policies: X, Instagram and LinkedIn. Rights relating to processing for which a platform operator is solely responsible are most effectively exercised directly with that operator. For processing by QuickQuote, contact us at privacy@quickquote.tech.

No social media tracking on quickquote.tech: This website does not embed pixels, tracking scripts or content from X, Instagram/Meta or LinkedIn. A connection to these platforms is only established when you click an external profile link.

11. Data Processing Agreements

Data processing agreements pursuant to Art. 28 GDPR apply to service providers acting as processors, in particular Google, Netlify, OpenAI Ireland Ltd. and Resend. Where a service provider acts as an independent controller for individual processing operations, the processing is additionally governed by that provider's statutory duties and privacy information.

12. Storage and Deletion of Data

Data is stored only as long as necessary to provide the software. Personal data is deleted as soon as the purpose of processing no longer applies, unless statutory retention obligations prevent deletion (for example tax retention periods pursuant to Section 147 AO).

Deletion of an individual user account (for example when an employee leaves):

When an account is deleted, sign-in data is deleted and contact details are removed from the membership profile; the name there is replaced with “Former User”. Business records and change histories may still contain personal data, including names, previous assignments or user identifiers. The business, as controller, determines their further retention and deletion under applicable law. Deleting an account does not anonymise all business data.

Termination of the workspace subscription:

Cancelling a paid subscription alone does not automatically delete all data. When processing on behalf of the business ends, QuickQuote returns or deletes business personal data and existing copies at the business’s choice, unless statutory retention obligations prevent deletion. This is handled through privacy@quickquote.tech after checking authority. Subject to the conditions in Section 14, the owner can also delete the workspace in the app. Owners should request any return of data before deletion; the app export does not include every data category. Data subject to mandatory retention is restricted to the required purpose. QuickQuote’s own contract, billing and security records are retained only for as long as their purpose or statutory obligations require.

13. Data Export and Data Portability (Art. 20 GDPR)

Personal profile export: All users can export their profile data in JSON format through the profile screen, including name, email address, phone number, role, membership status and joining date.

Workspace export: The owner can use the profile screen to create a JSON export containing personal profile data, the company profile, team data and projects, including recorded project hours and any inspection data, material and note entries and quote drafts. The content depends on the features used. The export does not represent all workspace data: separate planner events, absences, working-time models and individual leave settings, internal hours and additional project documents are not included. Media and PDF files are not embedded; any included file references must be retrieved separately. Timesheet PDFs can be downloaded through the timesheet feature. On the same device and for the same account, the app permits another export after 30 days. Statutory rights of access and data provision remain unaffected; further requests can be sent to privacy@quickquote.tech.

The customer is the controller for personal data contained in workspace content. This allocation and the technical export scope do not restrict statutory data subject rights against the relevant controller.

14. Account Deletion (Art. 17 GDPR)

Team members without the owner role (boss, office, technician, installer) can delete their account through the profile settings. Section 12 explains the effects on profile data, business records and change histories.

Deletion by the owner: If the owner is the only active person in the workspace, the owner can delete their account together with the entire business in the profile settings. This requires a recent sign-in and an explicit confirmation. Requests to end paid subscriptions can be sent to the provider together with the deletion instruction (Section 7 of the Terms). The workspace data such as projects, appointments, hours and absences, the stored files and photos, pending invitations, the memberships and the login are deleted. The deletion is final and cannot be undone. Any data needed should be saved beforehand using the workspace export under Section 13; the export does not include every data category. A technical deletion record with account, workspace and billing identifiers but without names, the payment and invoice data held by Stripe and the provider’s own records under Section 12 are retained. Counters stored outside the workspace and display links for the wall display are not deleted in this step; display links no longer show any data afterwards.

Self-service deletion is blocked while other active team members are in the workspace, or if the workspace contains business records such as sent or accepted quotes, invoices or incoming invoices, or is very large. With a team, the owner can first hand over the owner role to another person and then delete their account like a team member. In all other cases, the owner should contact privacy@quickquote.tech. The process establishes whether the business will continue or the workspace will close. Statutory data subject rights remain unaffected.

15. Rights of Data Subjects

You have the following rights with regard to your personal data:

Right to object under Art. 21 GDPR: Where we process personal data on the basis of Art. 6(1)(f) GDPR (in particular server log data and technical usage data), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms. You may send your objection informally to privacy@quickquote.tech.

To exercise your rights and for information requests pursuant to Art. 15 GDPR, please contact: privacy@quickquote.tech

Data subject requests are answered without undue delay and generally within one month. Any legally permitted extension is explained within that month.

16. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The competent supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg
Lautenschlagerstrasse 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

17. Transactional Emails

Free job scheduling also uses email verification and team invitations through Resend. No separate planner welcome email is sent. Invitations are initiated by the business.

In connection with the use of QuickQuote, the provider sends the following transactional emails:

These emails are required for operation of the software. Verification, account and billing emails are sent to the email address provided in the account or with the order, invitations to the invitee address entered by the business, and quote and invoice emails to the recipient address chosen by the user. Legal basis: Art. 6(1)(b) GDPR. When sending to the business’s customers, the provider acts as a processor on behalf of the business.

Internal operational notices: In addition, the system sends automatic notices through Resend to one of the provider’s own addresses at quickquote.tech: a daily notice when hour entries could not be transferred to the server (company name and identifier, name and shortened user identifier of the person affected, number of entries, error code, app version and platform), an early warning of high AI usage (business identifier, number of AI calls and tokens) and notices of critical technical errors, which may contain technical identifiers and in individual cases an email address. The purpose is to detect and fix faults quickly and to limit costs. The legal basis is Art. 6(1)(f) GDPR.

18. Contact

If you have questions regarding data protection, please contact:
Email: privacy@quickquote.tech

Lukas Keßler · Buergermeister-Fuchs-Str. 70 · 68169 Mannheim · quickquote.tech

Contact by email: If you contact us by email (for example at support@quickquote.tech or privacy@quickquote.tech), we process your email address, the content you provide and the time of your message in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We delete the correspondence once it is no longer required for handling the matter, unless statutory retention obligations (for example for business correspondence under the German Commercial Code (HGB) and the German Fiscal Code (AO)) require continued storage.