Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Requotableand the contractor business that accepts it (“you”, “the Contractor”). It forms part of, and is governed by, our Terms of Service.

“Personal data” and “personal information” are used interchangeably and mean information about an identifiable individual, as defined in PIPEDA. “Customer Data” means the personal information you upload or that is generated in the course of the service.

Documented instructions. Your instructions to us consist of this DPA, the Terms of Service, the configuration you set in your account, and any further written instruction you give us. We process Customer Data only on those instructions, except where the law requires otherwise — in which case we will tell you first, unless the law forbids it. If we believe an instruction breaks the law, we will say so and may decline to carry it out.

You warrant, on every upload and for as long as this agreement lasts, that each of the following is true.

You further warrant that you have not uploaded, and will not upload:

• purchased, rented, licensed, exchanged or co-registered lists;
• scraped or harvested data from websites, directories, marketplaces, social media, permit records or public listings;
• contacts belonging to another business — including one you acquired, a franchise sibling, a partner, or a former employer;
• contacts from a third-party lead marketplace where the person inquired with the marketplace rather than with you by name;
• anyone who has asked you to stop contacting them;
• a quote date that is backdated, guessed at, or fabricated.

You also warrant that you have given your customers the notice PIPEDA requires about how their information is used, and that this DPA is consistent with what you have told them.

We rely on these warranties. The data reaches us as a spreadsheet with no provenance attached, and we cannot verify where any individual contact came from. That reliance is the reason the warranties matter. Breach of any of them is grounds for immediate termination without refund.

Before your first campaign, you complete a consent attestation in your Requotable portal. It is a deliberate, separate action — not a line buried in a longer form.

You are asked to:

1. confirm the date range of the quotes being uploaded — the earliest and latest quote date in your backlog;
2. confirm the number of contacts the upload covers, as far as you know it;
3. attest that every contact in that range personally requested a quote from your business, and that you have a valid CASL basis to contact them about it;
4. accept this DPA, having had the opportunity to read it in full.

Each is a separate checkbox. Nothing is pre-ticked, and the portal is unavailable until they are completed.

Requotable will:

• Process only on your documented instructions, as set out in section 2.
• Use Customer Data for no other purpose. We do not sell it, share it between contractors, use it for advertising, aggregate it into a product, or use it to train AI models. The one platform-wide behaviour is opt-out suppression, described in the Privacy Policy, which exists to protect individuals.
• Keep it confidential. Access is limited to those who need it to run the service, and everyone with access is bound by a duty of confidentiality that survives the end of their involvement.
• Maintain the security measures in section 6, and not materially reduce them during the term.
• Use only the sub-processors listed in section 7, with notice before adding any.
• Assist you with individual requests, security, breach notification, and any privacy assessment you have to carry out.
• Notify you of a breach within the window in section 9.
• Return or delete Customer Data when the service ends, per section 11.
• Tell you if we cannot comply with this DPA, promptly and in writing, so you can act.

These are the technical and organisational measures actually in place, not a target state:

• Encryption in transit (TLS) for all traffic, and encryption at rest for the database.
• No public database surface. Row-level security is enabled on every table with no access policies, so the only credential able to read or write is a server-side service key that is never exposed to a browser.
• Authenticated, role-scoped access.Signed HTTP-only session cookies; a contractor session is confined to the portal; every privileged server action independently re-checks the caller's role.
• Tenant isolation.Every portal query is filtered to the signed-in contractor's own records.
• Password hashing (scrypt) for portal credentials, with login rate limiting.
• Cryptographically verified webhooks for inbound email and SMS, so a third party cannot inject a fabricated reply.
• Fail-closed sending controls: suppression is re-checked immediately before every send and blocks the send if it cannot be verified; sending is refused without a mailing address on file; sends are paced and capped; a kill switch halts an in-flight campaign.
• Auditable event log of sends, failures, opt-outs and administrative actions.
• Secret management.No credentials in source control; all secrets held in the hosting platform's encrypted configuration, with access limited to Requotable's operator.
• Managed infrastructure. Patching, backup and physical security of the underlying platforms are handled by the providers in section 7.

Requotable is a small operation. We hold no SOC 2 or ISO 27001 certification and do not represent that we do. We will tell you honestly what we have if you need to complete a vendor assessment.

You authorise Requotable to engage the following sub-processors. Each is bound by terms no less protective than this DPA in respect of the data they handle.

Changes. We will give you at least 30 days' written notice before adding or replacing a sub-processor. If you reasonably object on data-protection grounds within that period, we will work with you on an alternative; if there is none, you may terminate the affected service without penalty and receive a pro-rated refund for any period paid for and not delivered.

We remain responsible to you for our sub-processors' performance of their data-protection obligations.

If an individual contacts Requotable directly with an access, correction, withdrawal-of-consent or deletion request, we will:

• act immediately on an opt-out without waiting for you, and suppress them permanently — this one we do not defer;
• forward everything else to you without undue delay, and tell the individual which contractor holds their information;
• assist you in responding within the 30-day timeframe PIPEDA sets, at no extra cost — retrieving the records we hold, correcting them on your instruction, or deleting them on your instruction.

Requests must be met by you as the accountable organization. We will not respond substantively on your behalf unless you ask us to in writing.

On becoming aware of a breach of security safeguards affecting Customer Data, Requotable will notify you without undue delay and in any event within 72 hours, by email to the address on your account and by any other means we have.

The notice will include, to the extent known:

• what happened and when we became aware of it;
• the categories of data and the approximate number of individuals;
• the likely consequences;
• what we have done to contain it and what we propose next;
• a contact point for further information.

Where the full picture is not available within the window, we will send what we have and follow up rather than delay the notice. We will assist you with your own obligations to report to the Office of the Privacy Commissioner of Canada and to notify affected individuals, keep a record of every breach as PIPEDA requires, and not obstruct or delay your notification to anyone affected.

Customer Data is stored and processed in the United States. Every sub-processor in section 7 operates there.

PIPEDA treats a transfer to a service provider as a use, not a disclosure, and permits it provided the transferring organization uses contractual means to give the information a comparable level of protection. This DPA is that contractual means. While the data is in the United States it is subject to lawful access by United States authorities.

As the accountable organization, you are responsible for telling your customers that their information may be processed outside Canada. Our Privacy Policy states it plainly and you are welcome to point to it.

• On request, at any time, we will export your Customer Data to you in a machine-readable format.
• On termination, we delete your Customer Data — leads, messages, and associated logs — within 30 days. If you want an export, ask before the service ends or within that window.
• On your instruction during the term, we will delete specific records, for example to satisfy an individual's deletion request.

Deletion is carried out by us against the database on request. There is no self-serve delete in the product today. We will confirm to you in writing when it is done.

On reasonable written request, and no more than once a year unless a breach or a regulator requires otherwise, we will provide the information you reasonably need to demonstrate compliance with this DPA — the security measures in place, the current sub-processor list, and the categories of data we hold for you.

We do not currently offer on-site audits or penetration testing by customers. If a regulator with authority over you requires access, we will cooperate.

The limitation of liability in section 11 of the Terms of Service applies to this DPA, and liability under both is counted together against a single cap — not separately.

Your indemnity in section 12 of the Terms of Service is not subject to that cap and applies in full to any claim arising from a breach of the warranties in section 3.

When you accept this DPA in your portal, Requotable records:

The record is kept for as long as the agreement matters and is available to you on request. If we materially change this DPA, we bump the version, notify you, and ask you to accept the new one — your previous acceptance is retained, not overwritten.

• Order of precedence. Where this DPA and the Terms of Service conflict on the handling of personal information, this DPA governs. On everything else, the Terms govern.
• Governing law. Ontario, Canada, with the courts of Ontario, Canada having exclusive jurisdiction.
• Term. This DPA takes effect on acceptance and continues for as long as we process Customer Data for you. Sections 3, 11 and 13 survive.
• Severability. If a provision is unenforceable, the rest stands.
• Contact. Anything under this DPA — including breach notices, deletion requests and individual requests — goes to hello@requotable.ai.