Terms and Conditions

Last updated: 27 September 2026

1. About these Terms

These Terms and Conditions (the Terms) govern access to and use of the Quote Forge website and software-as-a-service platform available at https://quoteforge.co.uk, together with its related features and services (collectively, the Services).

The Services are provided by Quote Forge Ltd, trading as Quote Forge, a company incorporated and registered in England and Wales under company number 17350772. Our registered office is C/O Limebase Products, Unit 7, Walronds Park, Isle Brewers, Taunton, Somerset, England, TA3 6QP (Quote Forge, we, us or our).

The Services are supplied exclusively for business use. They are not intended for consumers acting wholly or mainly outside their trade, business, craft or profession.

If you accept these Terms on behalf of a company, partnership, sole-trader business or other organisation, you confirm that you have authority to bind that organisation. In that case, Customer, you and your refer to that organisation. If you operate as a sole trader, those expressions refer to you acting in the course of your business.

By creating an Account, selecting a Subscription, accepting these Terms at registration or checkout, or using the Services, you agree to these Terms. If you do not agree to them, you must not use the Services.

2. Definitions

In these Terms:

• Account means the registered account through which an Authorised User accesses the Services.
• Account Data means personal data and other information that we process for our own Account administration, billing, support, fraud-prevention, security and legal-compliance purposes.
• Authorised User means an individual whom the Customer authorises to use the Services on its behalf.
• Customer Data means information, text, logos, images and other material submitted to, stored in or generated through the Services by or on behalf of the Customer. It includes Customer Personal Data and the content of Quotes, but does not include Account Data or aggregated and anonymised information that cannot identify the Customer or any individual.
• Customer Personal Data means personal data contained in Customer Data that we process on the Customer's behalf.
• Data Protection Laws means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any legislation amending, replacing or supplementing them.
• Fees means the subscription charges and any other charges displayed at checkout or otherwise agreed with the Customer.
• Quote means a quotation created and stored using the Services, from which the Customer may generate a PDF on demand for download.
• Subscription means the Customer's paid monthly or annual right to access the Services.
• Subscription Period means the monthly or annual billing period selected at checkout.
• UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.

The terms controller, processor, data subject, personal data, personal data breach, process and processing have the meanings given to them by Data Protection Laws.

3. Business eligibility and authority

You may create and use an Account only if:

• you are at least 18 years old;
• you are acting for purposes wholly or mainly connected with a trade, business, craft or profession;
• you carry on that trade, business, craft or profession from the United Kingdom, whether as a sole trader or through a company, partnership or other organisation;
• you have legal capacity and, where applicable, authority to bind the Customer; and
• your use of the Services is permitted by applicable law.

The Services are not intended for personal, domestic or household use. We may ask for reasonable information to verify eligibility or authority.

4. Accounts and security

You must provide accurate, current and complete information when creating and maintaining an Account. You are responsible for:

• keeping Account credentials and authentication methods secure and confidential;
• not sharing Account credentials with any other person;
• all activity carried out through the Account, except to the extent caused by our breach of these Terms;
• promptly updating Account information; and
• notifying us without undue delay at info@quoteforge.co.uk if you know or reasonably suspect that an Account has been accessed without authorisation.

You must use any security features we reasonably require. We may require a password reset, sign out active sessions or temporarily restrict access where reasonably necessary to protect the Customer, the Services or other users.

An Account is assigned to the individual who registered it. Login credentials must not be shared with any other person. Unless we expressly provide multi-user functionality, each additional user must have their own Account and, where applicable, Subscription.

5. Licence to use the Services

Subject to payment of the Fees and compliance with these Terms, we grant the Customer a limited, non-exclusive, non-transferable and non-sublicensable right during the applicable free trial or Subscription Period to permit the Authorised User registered to the Account to access and use the Services for the Customer's internal business purposes.

This licence does not transfer ownership of the Services or any underlying software, templates, designs, databases or technology to the Customer.

The Customer may create and modify Quotes within the Services and may generate, download, print, copy, send and otherwise use PDF versions of its Quotes for its business purposes. Restrictions in these Terms on copying our content do not prevent the Customer from using its Customer Data or generated Quote PDFs in this way.

6. Free trials, Subscriptions and payment

6.1 Free trial

Where offered at checkout, eligible new customers may receive a 30-day free trial. A payment method may be required to begin the trial. Unless the Subscription is cancelled before the trial ends, the selected paid Subscription will begin automatically when the trial expires and the applicable Fee will be charged.

A person or email address may use only one free trial. We may refuse or end a trial where we reasonably believe that the Customer or an Authorised User has previously used a trial, has supplied inaccurate information or is attempting to circumvent trial eligibility controls.

6.2 Billing and renewal

Subscriptions are billed monthly or annually, according to the plan selected at checkout. The Subscription renews automatically for successive Subscription Periods until cancelled.

By starting a Subscription, you authorise our payment provider to charge the payment method supplied at checkout for the Fees due at the beginning of each Subscription Period. You must keep billing and payment information current.

Payment transactions are processed by Stripe or another payment provider identified at checkout. We do not receive or store complete payment-card details. Your use of a payment provider may also be subject to that provider's terms and privacy information.

Fees are stated in pounds sterling. We are not currently registered for VAT and do not add VAT to Subscription Fees. If our VAT status changes, we will update the information shown before payment and on invoices where legally required.

6.3 Failed payments

If a payment is declined, reversed or overdue, we may retry the charge and ask you to update the payment method. Access may be restricted as soon as our payment provider reports that the Subscription is no longer active or trialling, potentially before we give separate notice. Access may resume when the payment issue is resolved and the Subscription returns to a status that provides access. Restriction of access does not remove the obligation to pay Fees already due.

6.4 Cancellation

You may cancel the automatic renewal of a Subscription at any time through the billing portal or Account settings, or by contacting info@quoteforge.co.uk. Cancellation takes effect at the end of the current free-trial or paid Subscription Period, and access will ordinarily continue until then.

Cancelling a Subscription does not automatically delete the Account or Customer Data. If you choose to delete the Account, you must export any information you wish to retain before confirming deletion. Account deletion is intended to be permanent and may not be reversible.

Deleting an Account ends access to the Services immediately and will cancel any active Subscription. Unlike cancelling automatic renewal, Account deletion does not preserve access until the end of the current Subscription Period. Except where required by law or expressly provided in these Terms, Account deletion does not entitle the Customer to a refund.

Account deletion removes the Account's live user-owned application data and files. It does not remove the protected, de-linked free-trial eligibility record described in our Privacy Policy while our one-free-trial restriction remains in use, or records that our payment provider retains for its own payment, fraud-prevention, regulatory or legal purposes.

Except where these Terms expressly state otherwise or the law requires it, Fees already paid are non-refundable and we do not provide credits for part-used Subscription Periods.

6.5 Price changes

We may change Subscription Fees by giving at least 30 days' notice to the email address registered to the Account. A price change will apply no earlier than the Customer's next renewal after the notice period. If you do not agree to the new price, you may cancel before that renewal.

7. Customer responsibilities and acceptable use

The Customer is responsible for its Authorised Users and for ensuring that their use of the Services complies with these Terms.

You must not, and must not permit another person to:

• use the Services unlawfully, fraudulently or in a way that infringes another person's rights;
• submit Customer Data unless the Customer has all permissions, notices and lawful bases required to collect it and provide it to us for processing through the Services;
• include special-category personal data, criminal-offence data, payment-card data, account passwords or other highly sensitive information in a Quote unless we have expressly agreed in writing that the Services may be used for that purpose;
• access or attempt to access another customer's account, Quotes or data without authority;
• probe, scan, test or circumvent the security or authentication of the Services;
• introduce malware, malicious code or material designed to disrupt or damage the Services;
• carry out a denial-of-service attack or impose an unreasonable load on the Services;
• scrape, harvest or systematically extract data from the Services, except through functionality we expressly provide;
• reverse engineer, decompile or disassemble the Services except to the limited extent that applicable law does not permit that restriction;
• copy, resell, sublicense or make the Services available to a third party as a competing or standalone service;
• use the Services to develop or train a competing product using our confidential information or intellectual property; or
• use automated systems to access the Services without our written permission, other than ordinary web-browser use or search-engine indexing that we have not technically restricted.

We may investigate suspected misuse and take proportionate action under section 17.

8. Quotes and Customer responsibility

The Services provide tools that enable Customers to create, store and manage Quotes and generate PDF versions of those Quotes for download. The Customer is responsible for reviewing every Quote before generating, downloading, using or sending its PDF version, including:

• customer and recipient details;
• descriptions, quantities and units;
• prices, costs, mark-ups and discounts;
• tax and VAT treatment;
• calculations, subtotals and totals;
• dates, validity periods, payment terms and contractual wording; and
• any legal or regulatory information required for the Customer's business.

Calculations and formatting produced by the Services depend on the information and settings supplied by the Customer. The Customer must not assume that a Quote is accurate or suitable without checking it.

Quotes are issued by the Customer, not by Quote Forge. We are not a party to any Quote, contract, negotiation, payment or dispute between the Customer and its own customers, prospects, suppliers or other recipients. We do not guarantee that a Quote will be accepted, that it creates an enforceable agreement or that the recipient will make payment.

The Services and any guidance or information we provide do not constitute legal, tax, accounting or other professional advice. The Customer should obtain appropriate professional advice where necessary.

9. Downloaded Quote PDFs

The Services allow the Customer to generate a PDF version of a Quote on demand and download it to the Authorised User's device. The Services do not send PDFs to recipients or create public or recipient-accessible links to Quotes.

Generated PDFs are created on demand and are not retained by Quote Forge as separate stored files. The underlying Quote and Customer Data used to generate the PDF remain stored in the Account until they are deleted in accordance with these Terms and our Privacy Policy.

After a PDF has been downloaded, the Customer is responsible for:

• deciding whether, how and with whom to share it;
• ensuring that each intended recipient is authorised to receive it;
• selecting a delivery method appropriate for the nature and sensitivity of its contents;
• storing and transmitting it securely; and
• deleting or disposing of copies when they are no longer required.

We are not responsible for access, disclosure, loss, forwarding, alteration or other handling of a downloaded PDF by the Customer or a recipient after the PDF has left the Services, except to the extent caused by our breach of these Terms or applicable law.

10. Customer Data and generated outputs

As between the parties, the Customer retains all rights in Customer Data. The Customer grants us a non-exclusive, worldwide and royalty-free licence to host, copy, transmit, display, format and otherwise process Customer Data only to:

• provide, secure, maintain and support the Services;
• follow the Customer's documented instructions;
• prevent or address fraud, misuse, security incidents or technical problems;
• comply with applicable law; and
• exercise our rights and perform our obligations under these Terms.

This licence lasts only for as long as reasonably necessary for those purposes, subject to lawful retention requirements and backup deletion cycles.

We do not acquire ownership of Customer Data. We do not sell Customer Data or use it for advertising or marketing. We disclose Customer Data only as necessary to provide, secure, maintain and support the Services, follow the Customer's documented instructions, use authorised subprocessors, comply with applicable law, or exercise our rights and perform our obligations under these Terms.

The Customer may use the Quotes it generates for its business without further payment beyond the applicable Fees. Any rights in our underlying software, templates, layout systems, branding and technology remain ours or our licensors'.

The Customer must maintain appropriate copies of important final Quotes and business records. Although we use reasonable measures designed to protect the availability and integrity of Customer Data, the Services are not an archival or statutory record-keeping service.

11. Our intellectual property

We and our licensors own all intellectual property rights in the Services, including the software, source code, databases, functionality, interfaces, website design, text, graphics, branding, templates and documentation, excluding Customer Data.

Except for the limited licence in section 5, no rights in the Services are transferred to the Customer. Quote Forge and related names, logos and branding may not be used without our prior written permission.

If you voluntarily provide suggestions or feedback about the Services, you grant us a perpetual, irrevocable, worldwide, royalty-free right to use that feedback to improve and develop the Services. This does not give us any right to identify the Customer publicly or disclose its Confidential Information.

12. Privacy and data protection

Our Privacy Policy explains how we process personal data for our own purposes, including Account, subscription, support, security and website-usage information.

Where we process Customer Personal Data on the Customer's behalf to provide the Services, the Customer is the controller and we are the processor. Schedule 1 (Data Processing Addendum) forms part of these Terms and applies to that processing.

The Customer remains responsible for its own compliance with Data Protection Laws, including providing privacy information to its customers and other data subjects, establishing a lawful basis for processing, responding to rights requests and deciding what Customer Personal Data is entered into the Services.

13. Confidentiality

Each party (Recipient) must keep confidential all non-public business, technical, financial or other information disclosed by the other party (Discloser) that is identified as confidential or that should reasonably be understood to be confidential (Confidential Information).

Customer Data is the Customer's Confidential Information. Our software, non-public technical information and security information are our Confidential Information.

The Recipient may use Confidential Information only to exercise its rights or perform its obligations under these Terms. It may disclose Confidential Information only:

• to personnel, professional advisers and contractors who need it for that purpose and are bound by confidentiality obligations;
• with the Discloser's written permission; or
• where required by law, a court or a competent regulator, provided that the Recipient gives prior notice where legally permitted.

Confidential Information does not include information that the Recipient can demonstrate was lawfully known without restriction, becomes public through no breach, is received lawfully from a third party without confidentiality obligations, or is independently developed without using the Discloser's Confidential Information.

Each party must use at least reasonable care to protect the other's Confidential Information. This section survives termination for five years, except that obligations relating to trade secrets and personal data continue for as long as the information remains protected as such by law.

14. Third-party services and links

The Services depend on third-party infrastructure and service providers, including hosting, database, authentication and payment services. Our use of processors for Customer Personal Data is governed by Schedule 1.

The Services may link or redirect to third-party websites, including a payment or billing portal. We do not control independent third-party websites and are not responsible for their content or availability. The Customer should review the applicable third party's terms and privacy information.

Nothing in this section removes our responsibility for selecting and managing processors as required by Data Protection Laws or for obligations that cannot lawfully be excluded.

15. Availability, maintenance and changes to the Services

We will provide the Services with reasonable care and skill. However, unless we expressly agree a separate service-level commitment in writing:

• the Services are provided on an as-available basis;
• we do not guarantee uninterrupted, error-free or completely secure operation;
• maintenance, updates, faults and matters outside our reasonable control may cause interruptions; and
• estimates of availability, performance or resolution times are not guarantees.

We may maintain, update and modify the Services to improve functionality or security, comply with law, address technical issues or reflect changes to our business. Where reasonably practicable, we will provide advance notice of planned maintenance likely to cause material disruption and of changes that materially reduce core paid functionality.

We may correct errors in descriptions, pricing or other information. A correction will not retrospectively increase Fees already paid without the Customer's agreement.

16. Warranties and disclaimers

Each party warrants that it has authority to enter into these Terms.

Except as expressly stated in these Terms, and to the fullest extent permitted by law, all implied conditions, warranties and representations are excluded. In particular, we do not warrant that:

• the Services will meet every Customer requirement or be fit for a purpose that has not been expressly agreed in writing;
• every defect or interruption will be corrected immediately;
• Customer Data or settings are accurate; or
• a Quote will be accepted, paid or legally enforceable.

The Customer is responsible for its internet connection, devices, systems and any third-party software required to access the Services.

Nothing in these Terms excludes any term that cannot lawfully be excluded.

17. Suspension and termination

17.1 Suspension

We may suspend all or part of the Customer's access where reasonably necessary because:

• Fees are overdue;
• the Customer or an Authorised User has materially breached these Terms;
• use of the Services creates a material security risk or may harm the Services or another person;
• we reasonably suspect fraud, unlawful activity or unauthorised access;
• suspension is required by law, a court, a regulator or a relevant service provider; or
• emergency maintenance is required.

The automatic access restriction described in section 6.3 may apply before separate notice when our payment provider reports that the Subscription no longer has a status that provides access. In other cases, where reasonably possible and lawful, we will explain the reason, limit the suspension to what is necessary and give the Customer an opportunity to remedy the issue. We will restore access when the reason for suspension has been resolved and, where relevant, the Subscription has returned to a status that provides access.

17.2 Termination for breach

Either party may terminate these Terms immediately by written notice if the other party:

• commits a material breach that cannot be remedied;
• fails to remedy a material breach capable of remedy within 14 days after written notice; or
• to the extent that the terminating party is legally entitled to do so, becomes insolvent, ceases trading or enters an analogous insolvency process, except for a solvent restructuring.

We may terminate immediately for serious unlawful or fraudulent use, a deliberate security attack, or conduct creating a substantial risk of harm.

17.3 Discontinuation by us

We may discontinue the Services for business or technical reasons by giving at least 30 days' notice where reasonably practicable. If we end a paid Subscription before the end of a prepaid Subscription Period for reasons unrelated to the Customer's breach, we will refund Fees attributable to the unused period.

17.4 Effect of termination

On termination or expiry:

• the Customer's right to use the Services ends;
• Fees accrued before termination remain payable;
• each party must stop using the other's Confidential Information except where retention is legally required; and
• Customer Personal Data will be returned or deleted in accordance with Schedule 1.

Sections which by their nature are intended to continue will survive, including provisions concerning intellectual property, confidentiality, accrued payment obligations, liability, indemnities, data protection, disputes and general interpretation.

18. Limitation of liability

18.1 Liability that is not limited

Nothing in these Terms excludes or limits either party's liability for:

• death or personal injury caused by its negligence;
• fraud or fraudulent misrepresentation;
• the Customer's obligation to pay Fees properly due;
• any other liability that cannot lawfully be excluded or limited.

18.2 Excluded losses

Subject to section 18.1, neither party will be liable to the other for any indirect or consequential loss.

Subject to section 18.1, we will not be liable for loss of profit, revenue, anticipated savings, business opportunity, goodwill or reputation, except to the extent that such loss forms part of a third-party claim for which we are liable under these Terms.

18.3 Matters outside our responsibility

Subject to section 18.1, we are not liable to the extent that a loss is caused by:

• inaccurate, incomplete or unlawful Customer Data;
• the Customer's failure to review a Quote as required by section 8;
• the Customer's or a recipient's storage, disclosure, forwarding, alteration, loss or other handling of a downloaded Quote PDF after it has left the Services;
• use of the Services contrary to these Terms or our reasonable instructions;
• systems, devices, internet connections or third-party services outside our reasonable control; or
• failure by the Customer to take reasonable steps to mitigate the loss.

18.4 Liability cap

Subject to section 18.1, our total aggregate liability arising out of or in connection with the Services and these Terms, whether in contract, tort (including negligence), breach of statutory duty or otherwise, will not exceed the greater of:

• £100; and
• the Fees paid or payable by the Customer for the Services during the 12 months immediately preceding the event giving rise to the first claim.

Claims arising from the same or related events will be treated as one claim for the purpose of this cap.

The parties agree that this section reflects a reasonable allocation of risk having regard to the Fees, the nature of the Services and the Customer's ability to maintain its own records and insurance.

19. Customer indemnity

The Customer will indemnify Quote Forge against losses, liabilities and reasonable legal costs finally awarded by a court or agreed in a settlement arising from a third-party claim that:

• Customer Data, or our authorised processing of it, infringes that third party's intellectual property, privacy or data-protection rights;
• the Customer's unlawful or fraudulent use of the Services has caused harm to the third party; or
• results from the Customer's material breach of sections 7, 8, 9 or 12.

The indemnity does not apply to the extent that the claim was caused by our breach of these Terms, negligence, wilful misconduct or processing outside the Customer's lawful documented instructions.

We must notify the Customer reasonably promptly of an indemnified claim, provide reasonable cooperation at the Customer's cost and allow the Customer to control the defence and settlement. The Customer must not settle a claim in a way that admits fault by us, imposes an obligation on us or fails to provide us with an unconditional release without our prior written consent, which will not be unreasonably withheld.

20. Force majeure

Neither party will be liable for delay or failure to perform an obligation, other than an obligation to pay money already due, where caused by an event beyond its reasonable control. Such events may include natural disasters, epidemic or pandemic, war, terrorism, civil disorder, industrial disputes not limited to the affected party's workforce, government action, widespread utility or telecommunications failure, or failure of critical third-party infrastructure despite reasonable continuity measures.

The affected party must notify the other where reasonably practicable, take reasonable steps to reduce the effect and resume performance as soon as reasonably possible.

If a force-majeure event materially prevents the Services for more than 30 consecutive days, either party may terminate the affected Subscription by written notice. We will refund prepaid Fees attributable to any period after termination.

21. Changes to these Terms

We may update these Terms from time to time. We will update the "Last updated" date and will give at least 30 days' advance notice of a material change by email to the address registered to the Account.

A change may take effect sooner where reasonably necessary to comply with law, a court order or a regulatory requirement, address an urgent security issue or enable optional new functionality requested by the Customer. We will give as much notice as reasonably practicable in those circumstances.

If a notified change materially and adversely affects the Customer, the Customer may cancel the affected Subscription before the change takes effect by contacting us. Where the change would take effect during a prepaid Subscription Period and the Customer terminates for that reason, we will refund Fees attributable to the unused period after termination.

Continued use after the effective date constitutes acceptance of the updated Terms. Changes do not retrospectively alter rights or liabilities that arose before their effective date.

22. Complaints, disputes and governing law

If a dispute or complaint arises, either party should give the other written details and allow a reasonable opportunity to resolve it through good-faith discussions. The parties will consider mediation or another form of alternative dispute resolution where proportionate and mutually agreed.

Nothing in this section prevents either party from seeking urgent interim or injunctive relief, taking action to protect intellectual property or confidential information, or commencing proceedings where required to preserve a limitation period.

These Terms and any non-contractual obligations arising out of or connected with them are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction to settle any dispute or claim arising out of or connected with the Services or these Terms.

23. General provisions

23.1 Notices

We may send contractual notices to the email address registered to the Account. The Customer must keep that address current. Notices to us must be sent to info@quoteforge.co.uk, unless these Terms specify another method.

An email is treated as received on the next business day after sending, provided that the sender does not receive a delivery-failure notification. This section does not govern formal service of court proceedings.

23.2 Assignment

The Customer may not assign or transfer these Terms without our prior written consent, which will not be unreasonably withheld. We may assign these Terms to an affiliate or as part of a genuine merger, reorganisation, financing, sale of shares, business or assets, provided that the assignment does not materially reduce the Customer's rights.

23.3 No partnership or agency

Nothing in these Terms creates a partnership, joint venture, employment relationship or agency between the parties. Neither party may bind the other except as expressly stated.

23.4 No third-party rights

Unless expressly stated otherwise, a person who is not a party to these Terms has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce them.

23.5 Waiver

A delay or failure to exercise a right does not waive that right. A waiver is effective only if it is in writing and applies only to the circumstances for which it is given.

23.6 Severability

If a provision is held invalid or unenforceable, it will be modified to the minimum extent necessary to make it valid and enforceable or, if that is not possible, removed. The remaining provisions will continue in effect.

23.7 Entire agreement and priority

These Terms, the Subscription details shown at checkout and Schedule 1 constitute the entire agreement concerning the Services and replace previous discussions or statements about them. Neither party excludes liability for fraud or fraudulent misrepresentation.

If there is a conflict, the Subscription details shown at checkout take priority for plan-specific Fees and billing details, Schedule 1 takes priority for processing Customer Personal Data, and these Terms apply in all other respects.

Our Privacy Policy is a privacy notice explaining our processing activities; it is not intended to create contractual rights beyond those required by applicable law.

24. Contact us

Questions, complaints and notices concerning these Terms may be sent to:

Quote Forge Ltd
Email: info@quoteforge.co.uk
Registered office: C/O Limebase Products, Unit 7, Walronds Park, Isle Brewers, Taunton, Somerset, England, TA3 6QP
Company number: 17350772
Registered in England and Wales

Schedule 1: Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (DPA) applies where Quote Forge processes Customer Personal Data on behalf of the Customer in connection with the Services.

For that processing, the Customer is the controller and Quote Forge is the processor. Each party must comply with the obligations that Data Protection Laws impose on it in that role.

The Customer's use and configuration of the Services, together with its instructions submitted through the Account or in writing, constitute documented instructions to us. We will process Customer Personal Data only on those documented instructions unless UK law requires otherwise. If legally permitted, we will inform the Customer before carrying out processing required by law.

If we determine the purposes and means of processing particular personal data for our own Account administration, billing, fraud prevention, security, support or legal-compliance purposes, we act as an independent controller for that processing as explained in our Privacy Policy.

2. Details of the processing

The processing covered by this DPA is described as follows:

• Subject matter: Providing the Quote Forge quotation creation, storage and management Services, including generating PDF versions of Quotes on demand for the Customer to download.
• Duration: The period during which we provide the Services and any limited retention or backup period permitted by these Terms, this DPA or applicable law.
• Nature and purpose: Receiving, recording, organising, structuring, storing, retrieving, displaying, transmitting, securing, supporting, deleting, generating downloadable PDFs from, and otherwise processing Customer Personal Data to provide and maintain the Services.
• Types of personal data: Names, business or customer contact details, email addresses, telephone numbers, postal addresses, quote references, descriptions of requested work, line items, prices and other personal data that the Customer chooses to include in Customer Data.
• Categories of data subjects: The Customer's customers and prospective customers; their employees, representatives and contacts; and any other individuals whose information the Customer chooses to include in a Quote, including, where applicable, the Customer's own employees, contractors or suppliers.

The Services are not designed for special-category personal data, criminal-offence data, payment-card data, passwords or similarly sensitive information. The Customer must not submit such information unless we have agreed appropriate additional safeguards in writing.

3. Customer obligations

The Customer must:

• ensure that its instructions and processing of Customer Personal Data comply with Data Protection Laws;
• have a lawful basis for the collection, use and disclosure of Customer Personal Data;
• provide all required privacy information to data subjects;
• ensure that Customer Personal Data is adequate, relevant, accurate and limited to what is necessary;
• take appropriate steps to store, transmit and share downloaded Quote PDFs securely, having regard to the nature and sensitivity of the personal data they contain;
• respond to data-subject requests and regulatory enquiries for which it is responsible; and
• notify us if an instruction would require processing that is outside the agreed scope.

We will notify the Customer if, in our reasonable opinion, an instruction infringes Data Protection Laws, unless prohibited from doing so. We may suspend the affected processing while the parties address the issue.

4. Confidentiality

We will ensure that persons authorised to process Customer Personal Data are subject to an appropriate contractual or statutory duty of confidentiality and access it only where necessary for their role.

5. Security

Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to individuals, we will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Those measures will include, as appropriate to the risk:

• access controls and authentication measures;
• encryption in transit and encryption at rest where supported by the relevant infrastructure;
• measures designed to maintain the confidentiality, integrity, availability and resilience of systems;
• procedures for identifying, investigating and responding to security incidents;
• resilience and recovery arrangements appropriate to the Services, recognising that database backups and file-storage systems have separate recovery arrangements; and
• periodic review of the effectiveness of relevant safeguards.

The Customer acknowledges that no online service can guarantee absolute security and that security is a shared responsibility. This does not reduce our obligations under Data Protection Laws.

6. Subprocessors

The Customer gives us general written authorisation to engage subprocessors to provide the Services. Our current subprocessors for Customer Personal Data include:

• Supabase, Inc. — authentication, database and file-storage infrastructure;
• Vercel Inc. — application hosting and delivery infrastructure;
• Microsoft Corporation — business email and support communications where those communications contain Customer Personal Data; and
• Functional Software, Inc. (Sentry) — application monitoring, error diagnosis, user-submitted problem reports and consented Session Replay where those features process Customer Personal Data.

We will ensure that each subprocessor is bound by written data-protection obligations that provide an equivalent level of protection for Customer Personal Data as required by Data Protection Laws. We remain responsible for a subprocessor's performance of those obligations to the extent required by applicable law.

We will give at least 30 days' notice by email before appointing or replacing a subprocessor that will process Customer Personal Data, where reasonably practicable. The Customer may object during that period on reasonable, documented data-protection grounds. The parties will work in good faith to resolve the objection. If no reasonable solution is available, either party may terminate the affected Services, and we will refund prepaid Fees attributable to the unused period after termination.

7. International transfers

We will not make a restricted transfer of Customer Personal Data outside the United Kingdom unless the transfer is permitted by Data Protection Laws. Where required, we will use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another legally recognised safeguard.

We will enter into and maintain any transfer safeguards for which we are responsible.

8. Assistance with data-subject rights

Taking into account the nature of the processing, we will provide reasonable assistance through appropriate technical and organisational measures to help the Customer respond to requests by data subjects exercising their rights.

If we receive a request relating primarily to Customer Personal Data for which the Customer is responsible, we will refer the requester to the Customer where appropriate and notify the Customer unless prohibited by law. We will not respond substantively on the Customer's behalf unless instructed or legally required.

9. Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

As information becomes available, the notification will include details reasonably necessary to help the Customer meet its obligations, such as the nature of the breach, affected data and individuals, likely consequences, measures taken or proposed, and an appropriate contact point. We may provide information in stages where it is not all available at the same time.

We will take reasonable steps to contain, investigate and mitigate the breach. Our notification or cooperation is not an admission of fault or liability.

The Customer is responsible for deciding whether notice must be given to the Information Commissioner's Office, another regulator or affected data subjects, except where Data Protection Laws place that obligation directly on us.

10. Further assistance

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance with the Customer's obligations concerning:

• security of processing;
• personal data breach assessment and notification;
• data protection impact assessments; and
• prior consultation with a supervisory authority.

Where assistance is unusually extensive or arises from the Customer's breach of this DPA or Data Protection Laws, we may charge reasonable costs agreed in advance. We will not charge for assistance required because of our breach.

11. Return and deletion

During the Subscription, the Customer may access and export Customer Data using functionality made available through the Services.

On termination, expiry or the Customer's written request, and at the Customer's choice, we will delete or return Customer Personal Data, unless UK law requires continued storage. The Customer must make its choice and request any return before deleting its Account or within any period we specify in a termination notice. If the Customer makes no choice, it instructs us to delete the Customer Personal Data in accordance with our standard deletion process.

Deletion from provider backups may not be immediate where backup arrangements apply. Customer Personal Data retained temporarily in a protected backup will be put beyond ordinary use and deleted through the applicable backup cycle, unless the law requires retention. Database backups and file-storage systems are separate, and we do not promise that a database backup can restore an uploaded file or that either system can restore information deleted from the other.

12. Information and audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR.

The Customer may audit our compliance, itself or through an independent auditor bound by confidentiality, subject to the following reasonable safeguards:

• the Customer must first review relevant information, certifications or reports that we make available;
• an on-site or more intrusive audit may be requested only where that information is insufficient, a material incident has occurred or a competent regulator requires it;
• the Customer must give reasonable advance notice and avoid unnecessary disruption, unless an incident or regulator requires urgency;
• audits will ordinarily occur no more than once in any 12-month period; and
• the Customer will bear its audit costs unless the audit identifies our material breach of this DPA.

We will inform the Customer if, in our opinion, an audit instruction infringes Data Protection Laws.

13. DPA liability and termination

The liability limitations in section 18 of the Terms apply to this DPA, except to the extent that Data Protection Laws prohibit that limitation.

This DPA terminates when we have completed deletion or return of Customer Personal Data, but provisions intended to protect retained personal data continue for as long as we hold it.