QuoForm Data Processing Agreement
Draft. Last updated: [OWNER: date].
This agreement forms part of the Terms of Service between [OWNER: legal company name], [OWNER: registered address] (the "Processor") and the merchant who installed QuoForm (the "Controller"). It applies to personal data of the Controller's customers and visitors that the Processor handles through QuoForm. [OWNER: confirm that this wording works for both the EU/UK GDPR and the other laws you want to cover, and add the signature block if you need one.]
1. Subject matter, nature and purpose
- Subject matter and purpose: providing QuoForm: receiving forms and quote requests, storing and answering them, producing quotes and draft orders, sending related email, and the support and security of the service.
- Duration: while QuoForm is installed, plus the deletion periods in section 9.
- Categories of data subjects: the Controller's customers, prospects and other visitors to the Controller's store who use a QuoForm form, quote page, chat, bid or offer; the Controller's own team members.
- Types of personal data: what a data subject enters or uploads (such as name, email address, phone number, postal address, company, VAT number, free text, files and signatures), consent answers, quote and message history, the IP address (stored encrypted) and a hash of the browser identification string. QuoForm is not designed to collect special categories of data; the Controller should not ask for them in a form.
2. Instructions
The Processor handles the data only on the Controller's documented instructions: this agreement, the Terms, the Controller's use of the app's settings and features, and requests the Controller sends through Shopify (for example customer data and erasure requests). If the Processor believes an instruction breaks the law it will say so.
3. Confidentiality
People who can reach the data at the Processor are bound to confidentiality and may reach the data only as their role needs. Support and operations staff see metadata by default; seeing customer data needs a stated reason and a time-limited permission for one store, and each such access is written to an audit log.
4. Security
The Processor applies at least these measures: field-level encryption (AES-256-GCM) of personal data and access tokens, with key rotation; encryption in transit; separation of each store's data with tests that check it; no personal data in logs; malware scanning of uploads and short-lived file links; rate limits and spam controls on public endpoints; strong staff passwords with a mandatory second factor; permission-based staff access with an audit trail that cannot be edited; and separation of test and production data. Backups and restore testing: [OWNER: describe once configured; see docs/security/BACKUPS-AND-RESTORE.md]. See also docs/security/DATA-LOSS-PREVENTION.md.
5. Sub-processors
The Controller gives general authorisation for the Processor to use these sub-processors, each under a written agreement that requires protection equal to this one:
| Sub-processor | Used for | Data | Optional | Location |
|---|---|---|---|---|
| DigitalOcean | Hosting of the app, its database and queue | All app data (shop settings, submissions, quotes, messages), encrypted fields as in SEC-030 | No | [OWNER: region, decided in Q-055] |
| Cloudflare R2 | Storage of uploaded files, quote PDFs and email images | Files uploaded by buyers and generated quote documents | No | see provider settings |
| Resend | Sending and receiving email | Recipient and sender addresses, message content, delivery status | No | see provider settings |
| Cloudflare Turnstile | CAPTCHA on forms the merchant turned it on for | Visitor IP address and the challenge token | Yes, only when used | see provider settings |
| Anthropic | AI features the merchant uses (reply help, form generation, the help assistant) | Text the merchant sends to an AI feature; fields marked sensitive are removed first | Yes, only when used | see provider settings |
| OpenAI | AI features, only when the platform routes a feature to it (M15-R001) | As for Anthropic | Yes, only when used | see provider settings |
| Groq | AI features, only when the platform routes a feature to it (M15-R001) | As for Anthropic | Yes, only when used | see provider settings |
| OpenRouter | AI features, only when the platform routes a feature to it (M15-R001) | As for Anthropic | Yes, only when used | see provider settings |
| GlitchTip | Error tracking | Error reports with ids and codes only, no personal data (SEC-060) | No | see provider settings |
| Google reCAPTCHA | CAPTCHA on forms, only when the merchant chooses it with the merchant's own keys | Visitor IP address and browser signals sent by the visitor's browser to the provider | Yes, only when used | see provider settings |
| hCaptcha | CAPTCHA on forms, only when the merchant chooses it with the merchant's own keys | Visitor IP address and the challenge token | Yes, only when used | see provider settings |
| Browser push services | Notifications to team members who turn them on | A push subscription (endpoint and keys) and the notification text | Yes, only when used | provider's own |
Integrations a merchant chooses to connect, such as CRMs, Google Sheets, Dropbox, Google Drive, Slack and Zapier, are the merchant's own processors and not ours.
Shopify Inc. provides the platform the app runs on. [OWNER: confirm how Shopify is described here: as a separate controller or as a platform provider.]
The Processor will tell the Controller in the app or by email [OWNER: notice period, for example 30 days] before it adds or replaces a sub-processor. The Controller may object on reasonable data protection grounds within that period; if the parties cannot agree, the Controller may stop using the affected feature or uninstall. Services the Controller itself connects (its CRM, its own webhooks, its own SMTP) are the Controller's own processors, not the Processor's.
6. Helping the Controller with data subject requests
The app lets the Controller export all data, export or delete one customer's data by email, and set the retention period. Shopify's customer data request and erasure webhooks are handled automatically (target 24 hours, at most 30 days). If a data subject writes to the Processor directly, the Processor will pass the request on to the Controller and will not answer it itself unless told to.
7. Personal data breaches
The Processor will tell the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with what is known: what happened, the data and data subjects involved, likely effects, and the steps taken or proposed. [OWNER: confirm any fixed notice period you want to commit to.]
8. Assistance and audits
The Processor will give the Controller information reasonably needed to show compliance with this agreement and will help with data protection impact assessments and consultations with authorities to the extent they relate to QuoForm. Audit requests go to [OWNER: contact]; they are met first by documentation and security descriptions. [OWNER: audit terms and any audit certificate held; none exists today.]
9. Return and deletion
During use the Controller can export and delete data in the app. After uninstall, the Processor deletes the store's data 48 hours after Shopify reports the uninstall, and in any case within 30 days. Records of payments are kept without personal data. Copies in backups are deleted when the backups expire ([OWNER: backup retention]). The Processor may keep what the law requires it to keep.
10. International transfers
[OWNER: where the data is processed, and the transfer mechanism used (for example standard contractual clauses) once hosting and provider regions are confirmed.]
11. Liability and order of precedence
[OWNER: liability, governed by the Terms of Service. If this agreement and the Terms conflict on the handling of personal data, this agreement prevails.]
12. Contacts
Processor: [OWNER: name, address, privacy email, DPO if any]. Controller: the contact email of the store, as held in QuoForm.