Data Processing Agreement

Draft of 14 November 2026. Questions: support@quoterunway.com.

1. Parties and scope

This Data Processing Agreement ("DPA") is between [Legal entity name], [Registered address] ("QuoteRunway", the processor) and the company that uses QuoteRunway ("the Customer", the controller). It forms part of the Terms of Service and applies whenever QuoteRunway processes personal data for the Customer. If this DPA and the Terms disagree about personal data, this DPA wins.

2. What is processed

3. Instructions

QuoteRunway processes personal data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's use and settings of the service are those instructions. If QuoteRunway thinks an instruction breaks data protection law, it will say so. If the law requires processing the Customer didn't ask for, QuoteRunway will tell the Customer first, unless the law forbids that.

4. Confidentiality

Everyone at QuoteRunway who can reach personal data is bound by confidentiality, and only looks at a customer's data to give support the Customer asks for, to keep the service running and secure, or when the law requires.

5. Security

QuoteRunway keeps the technical and organisational measures in Annex A, and may improve them as long as protection doesn't go down.

6. Subprocessors

• The Customer allows QuoteRunway to use the subprocessors listed at quoterunway.com/subprocessors.
• QuoteRunway will give at least [30] days' notice by email before adding or replacing one. The Customer may object on reasonable data protection grounds. If we can't resolve it, the Customer may cancel and get a refund of any prepaid fees for the time left.
• Each subprocessor is bound by data protection terms at least as protective as this DPA, and QuoteRunway stays responsible for them.
• Systems the Customer connects itself (its mail, PSA, distributors, documentation or other tools) are not QuoteRunway's subprocessors: data goes to them on the Customer's instruction, under the Customer's own agreements with them.

7. Helping the Customer

QuoteRunway will help the Customer, as far as reasonably possible, to answer people exercising their rights (access, correction, deletion and the like), with security, with impact assessments and with regulators. Most of this the Customer can do in the app itself: editing and deleting records, and downloading a full backup. If someone contacts QuoteRunway directly about the Customer's data, we'll pass the request on to the Customer.

8. Personal data breaches

QuoteRunway will tell the Customer without undue delay, and within [72] hours, after becoming aware of a personal data breach affecting the Customer's data. It will say what is known (what happened, what data and roughly how many people, what's being done) and update the Customer as more is learned.

9. Deletion at the end

• Until the end of the subscription, the Customer's admins can download an encrypted backup of all its data at any time.
• When a subscription ends, the Customer's database is deleted after the periods in the Terms: 30 days after an unconverted trial ends; [N] days after cancellation; and no sooner than 90 days after an unpaid lock, with warnings first.
• Copies in platform backups are overwritten on the backup cycle, within [backup retention, e.g. 30 days].
• QuoteRunway may keep what the law requires (for example billing records), protected and only for that purpose.

10. Audits

QuoteRunway will make available the information needed to show it meets this DPA, and will answer reasonable security questionnaires. [Legal review: on-site audit rights, notice period and costs.]

11. Where data is processed

QuoteRunway stores and processes data in the United States (see subprocessors). Where data protection law requires a transfer mechanism for personal data leaving the EEA, UK or Switzerland, [Legal review: Standard Contractual Clauses / UK addendum / Data Privacy Framework] apply.

12. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as QuoteRunway processes personal data for the Customer.

Annex A: security measures

• Separation: each company has its own database. Every request is tied to one company by its address, and sessions and passes for one company are refused on every other.
• Sign-in: password plus authenticator code for everyone, with no way to turn the code off; single-use recovery codes; lockout after repeated wrong attempts; admin pages ask for the code again. QuoteRunway's own platform staff sign in separately, also with an authenticator, and each change to a company needs a fresh code and is logged.
• Encryption: HTTPS for everything in transit; storage encrypted at rest by the database provider; keys for connected systems and authenticator secrets encrypted again inside the database; passwords and recovery codes stored only as one-way hashes.
• Customer links: long random tokens, stored only as hashes (and encrypted for reminders), never written to logs; recalled, replaced and expired links stop working.
• Evidence: acceptance records are sealed with fingerprints and can't be changed or deleted through the app.
• Audit log: sign-ins, failed sign-ins, changes, downloads, backups and restores, kept 2 years, append-only from the app.
• Backups: company backups encrypted with AES-256-GCM under a passphrase the admin chooses, behind the authenticator code; restores are checked in full before anything changes and can be undone. [Platform backups: schedule, retention and restore testing.]
• Limits: rate limits on sign-in, public pages and help requests; size and type checks on uploads.
• Mail: quote and customer emails go only through the Customer's own mail system. QuoteRunway's own sender is used for account email only.
• Logs and errors: request logs keep field names, not values, and redact tokens and secrets.
• Releases: new versions go live only after their automated checks pass.