Data Processing Addendum

Version 1.0 — published October 17, 2026

Version: 1.0 — published 2026-10-17. Companion: the sub-processor list · the Privacy Policy (version 2.8) · the Terms of Service.

It states what the product actually does; where it cannot state something, it says so rather than leaving a gap the reader has to find. Read §8 before relying on this addendum for a transfer out of the UK or the EEA.

---

1. Definitions

• "Customer Data" — personal information about the tenant's own customers that the tenant stores in JoQuote: contact details, service addresses, job and appointment records, invoices and payments, photos, signatures, notes.
• "Account Data" — personal information about the tenant's own users: names, emails, phone numbers, credentials, authentication factors.
• "Usage Data" — device information, log data, and the product analytics described in the Privacy Policy.
• "Processing", "Controller", "Processor", "Data Subject", "Personal Data", "Supervisory Authority" carry the meanings given in the applicable Data Protection Law.
• "Data Protection Law" — GDPR and UK GDPR where they apply, PIPEDA, Australia's Privacy Act 1988 and the APPs, Hong Kong's PDPO, CCPA/CPRA, and any other law applicable to the processing.
• "Sub-processor" — a third party engaged by JoQuote to process Customer Data, as listed in the sub-processor list.

2. Roles — where JoQuote is not a processor

JoQuote is a PROCESSOR for Customer Data. The tenant decides what to collect, why, how long to keep it, and to whom it relates. JoQuote processes it to provide the services and on the tenant's documented instructions.

JoQuote is a CONTROLLER for:

• Account Data — JoQuote decides the purposes and means of managing tenant user accounts.
• Usage Data and product analytics — collected for JoQuote's own purposes, as the Privacy Policy's analytics section describes. This does not extend to Customer Data: the Terms licence processing "solely to provide the services", and the Privacy Policy commits that JoQuote does not sell, does not use information for advertising, and does not train models on it.
• Security, fraud and abuse prevention.
• Cookies, authentication and preference tracking.
• JoQuote's own communications with tenant contacts about the service.

Independent controllers, not sub-processors: Stripe determines its own purposes for KYC, AML and sanctions processing. Intuit and Xero act for the tenant, who authorises them directly. JoQuote is not a processor for Stripe's KYC, and the tenant is not the controller of it.

3. JoQuote's obligations as processor

JoQuote will:

1. Process only on documented instructions — including for transfers to a third country — and inform the tenant if an instruction would infringe Data Protection Law. The Terms, this addendum and the tenant's configuration choices are the documented instructions.

2. Ensure confidentiality — restrict access to the personnel and contractors who need it, bound by confidentiality obligations, and log administrative access.

3. Implement the security measures in Schedule A, which are the measures actually in place rather than a generic commitment to "appropriate measures".

4. Assist with data subject rights. The tenant is the contact point for its own customers. JoQuote provides the technical means to access, correct, export and delete Customer Data from within the product, and assists the tenant in responding to a request. A data subject writing to JoQuote directly is answered within 30 days and pointed at the business responsible, which is what the Privacy Policy tells them will happen.

5. Assist with the tenant's own Article 32–36 obligations, including breach notification and impact assessments.

6. Notify the tenant of a personal data breach without undue delay and in any event within 48 hours of becoming aware of it, with the information the tenant needs to meet its own 72-hour obligation.

7. Delete or return Customer Data at the end of provision. The position stated in the Terms and the Privacy Policy is that account deletion is immediate and irreversible, that no separate archive of a deleted account is kept, and that connections are revoked at the provider rather than merely forgotten. Records of the subscription the tenant paid for survive, because tax law requires them; they contain no customer, job or payment data.

8. Make available the information needed to demonstrate compliance, and allow an audit or inspection reasonably requested by the tenant, once in any twelve months, on reasonable notice and subject to confidentiality. A current independent certification, if one exists, satisfies this clause for that period.

9. Not sell or share personal information, and not retain, use or disclose it outside the purposes set out here (the CPRA service-provider restriction).

4. Sub-processors

1. The tenant gives general written authorisation for the sub-processors listed in the sub-processor list.

2. JoQuote gives at least 30 days' notice of an intended change to that list, so the tenant can object. If the tenant objects on reasonable data-protection grounds and the parties cannot resolve it, the tenant may terminate the affected part of the services. The Privacy Policy makes the same promise.

3. JoQuote imposes data-protection obligations on each sub-processor no less protective than these terms. This is a legal requirement in Hong Kong (PDPO DPP4(2)), not merely good practice.

4. JoQuote remains liable to the tenant for its sub-processors' performance of those obligations.

5. Security incidents

See §3.6. Notification is not an acknowledgement of fault. Where a breach affects a tenant's own customers, JoQuote gives the tenant what it needs to notify them and does not contact them itself, because the tenant is the controller.

6. Audits

See §3.8.

7. Term, termination and survival

This addendum runs with the Terms. On termination JoQuote deletes Customer Data as described in §3.7. The confidentiality, sub-processor, audit and liability provisions survive for as long as JoQuote holds any Customer Data.

8. International transfers — stated honestly

Where Customer Data is held: the application and the database run on a server in Germany; uploaded files are stored in the same region. From where it is reached: JoQuote's support and administration reach that database from Hong Kong.

Those are two different facts, and the second one is the one that matters. Storing data in the EEA does not mean no transfer occurs when somebody outside it can read the data.

What is in place, and what is not:

• No Chapter V mechanism is named in this version. JoQuote has not executed Standard Contractual Clauses, does not rely on an adequacy decision for access from Hong Kong, and has not completed a transfer impact assessment.
• JoQuote will not represent that a mechanism exists when it does not. This section will name it once it is in place; a future version will say which instrument, or that the question has been resolved some other way.
• Google Analytics, if a platform administrator enables it, sends Usage Data (not Customer Data) to the United States. The Privacy Policy says so, and it loads only after the visitor consents.
• Australian tenants: APP 8 makes the discloser accountable for an overseas recipient's acts unless an exception applies. With storage in Germany and access from Hong Kong, that accountability is live.

A tenant that requires Chapter V cover for EU or UK personal data should not send it to JoQuote until this section names a mechanism. That sentence is here because the alternative — a paragraph that reads as though cover exists — would be worse for both parties.

Schedule A — the security measures actually in place

This schedule describes what is deployed, not a target state. Where a measure is a provider's rather than JoQuote's, it says so.