Last updated: 15 October 2025
About us: Quote M8 Ltd 3rd Floor, 86–90 Paul Street, London, EC2A 4NE
Company number: 16690448
This Data Processing Addendum (“DPA”) governs the processing of personal data by Quote M8 Ltd (“Quote M8”, “our”, “us” or “we”) as a processor on behalf of Customers.
Unless otherwise stated, the definitions in the Terms and Conditions shall apply in this DPA. In addition, the following definitions apply: “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “process”, “processing”, “appropriate technical and organisational measures” and “supervisory authority” shall have the meanings given to them in the Data Protection Laws.
Customer Personal Data: the personal data processed by Quote M8 on the Customer’s behalf as set out in the section titled “Processing Details” below.
Data Protection Laws: means all applicable data protection and privacy legislation in force in the United Kingdom, including but not limited to:
(i) the UK GDPR as defined in section 3(10) of the Data Protection Act 2018, and supplemented by section 205(4) (“UK GDPR”); and
(ii) the Data Protection Act 2018,
in each case as amended, updated or replaced from time to time.
Scope, nature and purpose of the processing
We will process personal data on behalf of the Customer when the Customer uses the Quote M8 web app to create or send quotes, store client details, or use the WhatsApp integration to send messages to clients. We process data only to provide, maintain and improve the Service.
Categories of data subject
Staff and representatives of the Customer, and staff and representatives of third parties that the Customer sends quotes to, or whose details are included in any Customer data stored within the Service.
Categories of personal data
Personal data provided by or on behalf of the Customer:
(i) for generating quotes;
(ii) for sending messages via WhatsApp; or
(iii) when using the Service to store information.
This may include individuals’ names, business contact details, phone numbers, and any other data entered into the Service by the Customer
Duration of processing
For the duration that we provide the Service to the Customer and throughout any period that we store Customer data after termination, as described in this DPA.
3.1 The Customer is the controller in respect of the Customer Personal Data and we act as a processor in respect of that data.
3.2 The Customer shall have sole responsibility for the legality, integrity and accuracy of Customer Personal Data. The Customer shall ensure that it has all necessary consents and notices in place to enable the lawful transfer of Customer Personal Data to Quote M8 for the duration, and purposes, of the Service.
3.3 We are the controller in respect of personal data provided by you where that personal data is not Customer Personal Data (for example, account and billing data).
See our Privacy Notice for details where we act as controller.
The Customer shall, as controller of the Customer Personal Data:
4.1 maintain records which indicate how it processes personal data under its responsibility, containing at least the minimum information required by Data Protection Laws;
4.2 ensure that it has provided all necessary notices to data subjects in accordance with Data Protection Laws; and
4.3 ensure that it has established a legal basis for transferring the personal data to Quote M8 and, where necessary, has obtained and recorded all necessary consents.
To the extent that we process Customer Personal Data on behalf of the Customer, we shall:
5.1 process that Customer Personal Data only on the Customer’s documented instructions, which shall be to process the Customer Personal Data to the extent necessary to maintain, deliver and develop our Service (and to fulfil our obligations under these Terms), unless otherwise required by law;
5.2 implement appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage of Customer Personal Data;
5.3 ensure that personnel authorised by us to process Customer Personal Data are bound by confidentiality obligations;
5.4 not transfer any Customer Personal Data outside the UK unless appropriate safeguards are in place, such as an adequacy decision or the International Data Transfer Agreement (IDTA);
5.5 assist the Customer, where reasonably possible and at the Customer’s cost, with data subject requests, breach notifications, and data protection impact assessments;
5.6 notify the Customer without undue delay upon becoming aware of a personal data breach involving Customer Personal Data; and
5.7 maintain records to demonstrate compliance with this Clause 5. The Customer may request access to such records once per year.
The Customer acknowledges and agrees that:
6.1 it can delete Customer Personal Data at any time through the Service; and
6.2 unless instructed otherwise, we will retain Customer Personal Data for 30 days after termination of the subscription, to allow the Customer to retrieve data (“Storage Period”). After this period, we may delete the Customer Personal Data or continue storage on request.
Where deletion is requested in writing and technically feasible, we will delete specific Customer Personal Data without undue delay.
The Customer provides general authorisation for us to appoint sub-processors, provided that we shall:
7.1 ensure sub-processors are bound by obligations consistent with this DPA;
7.2 remain responsible for their acts and omissions; and
7.3 inform the Customer of any intended changes concerning sub-processors, giving the Customer an opportunity to object within 14 days of notification.
The Customer provides prior, general authorisation for us to transfer Customer Personal Data outside of the UK where necessary to provide the Service, provided that all such transfers are carried out in compliance with Data Protection Laws and appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.
For any data protection questions or to exercise your rights, contact:
Email: hello@quotem8.ai
Address: Quote M8 Ltd, 3rd Floor, 86–90 Paul Street, London, EC2A 4NE
