DATA PROCESSING ADDENDUM

Customer data processing terms

Updated 16 September 2026

This DPA forms part of the Terms whenever QuercusQuote processes Customer Personal Data, including invited access and free trials. The customer is normally controller and QuercusQuote is processor. This DPA prevails over conflicting processing provisions in the Terms.

1. Scope and instructions

Customer Personal Data means personal data processed on the customer’s behalf in providing the service. We process it only on documented customer instructions, including transfer instructions, to provide, secure and support the contracted service. The Terms, this DPA and use of the service constitute the initial instructions. We will immediately inform the customer if, in our opinion, an instruction infringes applicable data-protection law. If law requires other processing, we will inform the customer before processing unless that law prohibits notice on important public-interest grounds.

We will not sell Customer Personal Data or use it for advertising, unrelated model training or our own unrelated purposes. The service is not intended for special-category or criminal-offence data unless expressly agreed in writing. Our separate controller activities are explained in the Privacy Notice.

2. Confidentiality and security

Access is limited to authorised personnel with a need to know who are bound by confidentiality commitments or appropriate statutory duties. We will implement technical and organisational measures appropriate to the risk and required by applicable data-protection law. Measures include encrypted transport, specialist identity services, secure sessions, server-side tenant separation, access controls, backups and operational logging.

3. Incidents

We will notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. We will provide available information about its nature, likely consequences, affected records and people, mitigation and a contact, with further information supplied in stages. We will assist with containment, investigation and the customer’s notification obligations.

4. Subprocessors

The customer gives general written authorisation for subprocessors listed in the published schedule. We will notify intended additions or replacements at least 30 days before use, allowing objection on reasonable data-protection grounds. If an urgent security or continuity need requires shorter notice, we will give as much advance notice as practicable and retain an opportunity to object before affected processing begins. If no timely solution is possible, we will pause affected processing or allow termination of the affected service with a refund of unused prepaid charges.

Each subprocessor must be bound by written obligations providing the same level of protection for its processing. We remain responsible to the customer for performance of those obligations. Schedule changes do not authorise unrelated marketing or sales of personal data.

5. Rights and assessments

Taking account of the nature of processing, we will assist through appropriate technical and organisational measures, insofar as possible, with data-subject rights requests. We will assist with security, breach notification, impact assessments and prior regulator consultation, taking account of information available to us. We will promptly notify the customer of requests concerning its data and respond on its behalf only on instructions or where legally required. The customer remains responsible for its lawful basis, notices, accuracy and decisions on requests.

6. Return, deletion and audit

At the customer’s choice when the processing service ends, we will return or delete Customer Personal Data and delete existing copies unless applicable law requires storage. Workspace export and deletion are available from Account while operational access is active. At unpaid trial expiry, operational access and self-service export are locked; the workspace is retained for six months from expiry, with warnings before deletion, unless the customer subscribes or gives an earlier deletion instruction. Contact privacy@quercusquote.app for assisted rights handling where direct access is restricted. Legally retained data will be isolated, used only for that requirement and deleted when it ends. Provider recovery copies must be accounted for in deletion; no unverified backup-expiry period is promised here.

We will make available information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the customer or its mandated auditor. Reasonable arrangements for confidentiality, security, timing and costs must not prevent or unduly delay these rights or regulator access.

7. Transfers and local processor restrictions

Before a restricted transfer, we will ensure a lawful mechanism is in place and document required assessments and supplementary measures. The appropriate UK IDTA, UK Addendum or other instrument must actually be completed where relied on; this paragraph alone does not execute it. Customers may request relevant safeguard information through privacy@quercusquote.app.

Where applicable US service-provider or contractor rules apply, we process data only for the specified contracted purposes and not outside the direct business relationship, do not sell or share it for cross-context behavioural advertising, and do not combine it with other-source personal information except where applicable law permits. We will notify the customer if we can no longer meet applicable obligations and allow reasonable steps to verify compliance and stop and remediate unauthorised use. Any further mandatory jurisdiction-specific terms must be completed before the affected activity is enabled.

Annex: processing description