Contents 13 sections
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Kwotly Ltd (company no. 17027075, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ) ("Kwotly", "we", "us") and the business using the Kwotly platform ("you", the "Operator"). It applies whenever you use Kwotly to handle your customers' personal data and reflects the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Roles
- For your customers' personal data (names, contact details, addresses, photos, messages, quote details), you are the controller and Kwotly is your processor.
- For your own account data (your name, email, business details), Kwotly is the controller. That processing is covered by our Privacy Policy, not this DPA.
2. Subject matter and duration
Kwotly processes your customers' personal data to provide the platform: taking quote requests, analysing photos to detect items, drafting and sending quotes, handling messages, and, where card deposits are available on your plan, processing deposits. Processing lasts for the duration of your subscription, plus the wind-down period in section 10.
3. Data and data subjects
- Data subjects: your customers and prospective customers.
- Data categories: names, email addresses, phone numbers, pickup and delivery addresses, photos of rooms and items, message content, quote and payment details, and technical data such as IP addresses.
- The platform is not designed to process special category data (e.g. health data). You agree not to submit it deliberately.
4. Our obligations as your processor
We will:
- Process your customers' data only to operate the platform and on your documented instructions, unless UK law requires otherwise (in which case we will tell you before processing, where the law allows).
- Make sure anyone with access to the data is bound by confidentiality.
- Apply appropriate technical and organisational security measures (section 7).
- Help you respond to your customers' data-protection requests (access, erasure, and the other UK GDPR rights). Contact info@kwotly.co.uk.
- Help you meet your own obligations on security, breach notification, and impact assessments, taking into account the nature of the processing.
- Delete or return your customers' data at the end of the agreement (section 10).
- Make available the information you reasonably need to show this DPA is being met, and allow for audits as described in section 11.
5. Your obligations as controller
- You are responsible for having a lawful basis for the customer data you put into Kwotly, and for your own privacy notice to your customers.
- You must only message customers through the platform (including WhatsApp and SMS) where they have contacted you or otherwise agreed to hear from you, no cold messaging or spam.
- You must not upload data you have no right to use.
6. Sub-processors
You give general written authorisation for the sub-processors below. We will give you notice (by email or through the platform) before adding or replacing a sub-processor, and you may object on reasonable data-protection grounds; if we cannot resolve the objection you may cancel your subscription. We remain responsible to you for our sub-processors' performance.
| Sub-processor | What they do | Location |
|---|---|---|
| Anthropic | Photo analysis for item detection and quote drafting | United States |
| Google (Maps, Cloud Vision, Gemini) | Address lookup, distance calculation, optional photo analysis | United States |
| Clerk | Account sign-in and authentication | United States |
| Stripe | Payment and deposit processing | United States / Ireland |
| Twilio | WhatsApp and SMS messaging | United States |
| Resend | Transactional email delivery | United States |
| Railway | Application and database hosting | United States |
| Cloudflare | Sits in front of our website (requests and IP addresses pass through it), and stores our nightly database backups, encrypted before they are sent so Cloudflare cannot read them | Global network; backups held in the European Union |
| Vercel | Web hosting, and counting visits to our website (no cookies, private links stripped) | United States |
| PostHog (EU Cloud) | Product analytics: which pages and quote-form steps are used, with private links stripped. Customer pages are never screen-recorded | European Union |
| Sentry (Functional Software, Inc.) | Error monitoring: technical crash reports with personal details stripped out before sending | United States |
Swipe sideways to see the whole table.
Voice notes sent over WhatsApp are stored and shown to you as they arrived. They are not sent to a speech-to-text provider, so no sub-processor beyond Twilio receives them.
7. Security
We protect customer data with measures including encrypted connections (HTTPS), tenant-isolated data storage, hashed credentials and API keys, per-endpoint rate limiting, time-limited signed URLs for photo access, and nightly database backups that are encrypted before they leave our servers. Full details are in our Privacy Policy.
8. International transfers
Some sub-processors are based in, or may process data in, the United States. Where customer data leaves the UK, we rely on safeguards recognised under UK GDPR: adequacy regulations where they apply (including the UK–US Data Bridge), or the ICO's International Data Transfer Agreement / Addendum with the relevant provider.
9. Personal data breaches
If we become aware of a personal data breach affecting your customers' data, we will notify you without undue delay and give you the information you need to meet your own notification duties.
10. Deletion and return
When your subscription ends, we keep your data for 30 days so you can export it, then delete it, unless UK law requires us to keep specific records. You can also ask us to delete specific customer data at any time via info@kwotly.co.uk.
11. Audits
Once per year, and on reasonable notice, you may ask us for the information reasonably necessary to demonstrate compliance with this DPA. Where that is not sufficient, you may request an audit conducted in a way that does not put other operators' data at risk.
12. Liability and governing law
Liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by the laws of England and Wales.
13. Contact
Questions about this DPA: info@kwotly.co.uk.