QuoteLoopData processing agreement
Last updated: 14 October 2026
This data processing agreement ("DPA") is between the merchant who installs QuoteLoop ("you", the controller) and TechnoCity ("we", the processor). It forms part of our terms of service and applies to personal data about your customers that QuoteLoop processes for you. You accept it by installing the app. If you need a signed copy, email shane@technocity.lk.
1. What we process
| Subject matter | Providing QuoteLoop: making, storing, sending and tracking quotes, and matching them to orders. |
|---|---|
| Duration | While the app is installed, then until deletion as set out in section 8. |
| Data subjects | Your customers and prospective customers who request or receive a quote; your staff who use the app. |
| Personal data | Name, company, email, phone, tax ID, billing and shipping address, notes, Shopify customer ID, items quoted (including options such as engravings), quote activity (created, emailed, opened, viewed, ordered), emails sent, follow-up notes; staff user IDs in the access log. |
| Special categories | None intended. Don't ask customers for sensitive data in quote notes. |
2. Your instructions
We process the data only to provide QuoteLoop, following your documented instructions: these terms, this DPA and the settings you choose in the app. We'll tell you if we believe an instruction breaks data protection law. We won't sell the data, use it for our own purposes, or combine it with data from other stores.
3. Your responsibilities
You're responsible for having a lawful basis to collect your customers' data and email them, for telling them how you use it (for example in your store's privacy policy), and for the accuracy of what you add.
4. Confidentiality
Everyone at TechnoCity who can access the data is bound to keep it confidential and accesses it only when needed to run or support the app.
5. Security
We keep appropriate technical and organisational measures in place, including:
- Encryption in transit (HTTPS) and at rest (database storage)
- Access limited to the people who run QuoteLoop, with two-factor authentication
- Secrets kept only in our hosting provider's secret store, never in code
- No shoppers' personal details in application logs
- An access log of staff viewing quotes, downloading PDFs and exporting data
- Automatic erasure of personal details two years after a quote expires
- Database backups with point-in-time recovery
More detail is on our security page.
6. Sub-processors
You authorise us to use the sub-processors listed in our privacy policy (Shopify, Fly.io, Neon, Resend and Cloudflare). We have data protection terms with each that are at least as protective as this DPA, and we remain responsible for them. We'll update the list at least 14 days before adding or replacing a sub-processor that handles personal data, and tell you by email; you may object, and if we can't resolve it you may stop using the app.
7. International transfers
Data is stored in Singapore and may be processed in other countries where our sub-processors operate. Where the law requires it, transfers are covered by the EU Standard Contractual Clauses (and the UK addendum) or another valid transfer mechanism.
8. Deletion
- Personal details in quotes are erased automatically two years after the quote expires.
- When a customer asks you to erase their data and Shopify notifies us, we delete that customer's quotes and emails.
- 48 hours after you uninstall, we delete all data for your store. Backups are overwritten within 30 days.
- You can ask us to delete or return data at any time.
9. Helping you
We'll help you answer your customers' requests to access, correct, delete or export their data, and with data protection impact assessments where reasonable. Most requests can be handled in the app: search by email to find a customer's quotes, and export them as CSV.
10. Personal data breaches
If we become aware of a breach affecting your data, we'll notify you and Shopify without undue delay, and within 72 hours, with what we know: what happened, the data and people affected, and what we're doing about it. We'll keep you updated and help you meet your own notification duties.
11. Audits
We'll make available the information reasonably needed to show we comply with this DPA, and answer reasonable security questionnaires once a year, or after a breach.
12. Order of precedence
If this DPA conflicts with the terms of service, this DPA wins for anything about personal data.
Contact
Questions about this DPA: shane@technocity.lk.