Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the installer business using InstallerQuote ("the Controller") and Hyusein Rashid ("the Processor").

It forms part of the Terms of Service and applies whenever the Processor processes personal data on the Controller's behalf. It is made under Article 28(3) of Regulation (EU) 2016/679 (GDPR).

It takes effect when the Controller accepts the Terms of Service and continues for as long as the Processor processes personal data for the Controller. No signature is required, but the Processor will sign a copy on request.

Where this DPA conflicts with the Terms of Service in respect of personal data, this DPA prevails.

2. Subject matter and purpose

Subject matter: provision of the InstallerQuote solar quotation service.

Nature and purpose: hosting and storing the Controller's business records; generating quotations, PDF documents and public proposal pages; sending quotation emails to recipients the Controller selects; recording proposal responses.

Duration: for as long as the Controller's account is open, plus the deletion period in section 10.

The Processor processes personal data only on the Controller's documented instructions. The Controller's use of the Service constitutes those instructions. If the Processor believes an instruction breaches data protection law, it will inform the Controller and may suspend that processing.

3. Categories of data subject

• the Controller's own customers and prospective customers, typically homeowners
• contacts recorded by the Controller against a customer record
• recipients of quotation emails sent by the Controller
• individuals who open or respond to a public proposal link

4. Categories of personal data

• identity data: name
• contact data: email address, telephone number, postal and installation address
• transaction data: quotations, line items, prices, system sizing inputs and results, notes recorded against a customer or quotation
• correspondence data: quotation email recipient, subject and delivery status
• response data: name and email supplied when accepting a proposal, any reason given when declining, and the times a proposal link was opened

The Processor does not require and asks the Controller not to enter special categories of personal data under Article 9, nor data relating to criminal convictions under Article 10.

5. Obligations of the Processor

The Processor will:

• process personal data only on the Controller's documented instructions, including for transfers to a third country, unless required otherwise by law, in which case it will inform the Controller unless that law prohibits it
• ensure that persons authorised to process the personal data are bound by an appropriate duty of confidentiality
• implement the technical and organisational measures set out in the Annex, as required by Article 32
• respect the conditions in section 6 for engaging another processor
• assist the Controller, by appropriate technical and organisational measures and so far as possible, in responding to requests to exercise data subject rights
• assist the Controller in complying with Articles 32 to 36, taking into account the nature of processing and the information available to it
• delete or return personal data at the end of the engagement, as set out in section 10
• make available the information necessary to demonstrate compliance with Article 28, and allow and contribute to audits as set out in section 9

6. Sub-processors

The Controller gives general authorisation for the Processor to engage the sub-processors listed below. Each is bound by data protection obligations no less protective than this DPA, and the Processor remains fully liable for their performance.

• Cloudflare, Inc. — Application hosting, database storage (D1), and transactional email delivery. Location: United States, with processing in the EU where available.
• Clerk, Inc. — User authentication and session management for installer accounts. Location: United States.

The Processor will give the Controller at least 30 days' notice before adding or replacing a sub-processor. If the Controller objects on reasonable data protection grounds within that period, the parties will discuss in good faith; if no resolution is reached, the Controller may terminate the affected part of the Service without penalty.

7. Security

The Processor implements the measures described in the Annex to this DPA, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to individuals.

The Processor may update these measures provided the level of protection is not reduced.

8. Personal data breach

The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's personal data.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, and the measures taken or proposed.

The Processor will not notify a supervisory authority or data subject on the Controller's behalf unless the Controller instructs it to, or the law requires it.

9. Audit

The Processor will make available the information reasonably necessary to demonstrate compliance with Article 28, including responding to a reasonable security questionnaire.

The Controller may audit the Processor no more than once in any 12-month period, on at least 30 days' written notice, during business hours, without unreasonable disruption, and subject to confidentiality. The Controller bears its own costs. An additional audit may be carried out following a personal data breach affecting the Controller.

10. Deletion and return

The Controller may export or delete personal data at any time through the Service, and may request assistance at any time.

On termination the Processor will, at the Controller's choice, delete or return the personal data, and delete existing copies, within 90 days, unless law requires it to keep them.

The Controller acknowledges that a quotation shared as a proposal retains an immutable snapshot of the document sent, preserved as a record of what a recipient was shown. On deletion of the account these snapshots are deleted with the rest of the Controller's data.

Backups are overwritten on their ordinary cycle; personal data in a backup remains subject to this DPA until it is overwritten.

11. International transfers

Where the Processor or a sub-processor transfers personal data outside the European Economic Area, that transfer is made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, together with any supplementary measures the transfer requires.

12. Liability and governing law

The limitations of liability in the Terms of Service apply to claims under this DPA to the extent permitted by law. Nothing in this DPA limits a data subject's rights, or either party's liability to a supervisory authority.

This DPA is governed by the law of Bulgaria, subject to the mandatory application of the GDPR.

Annex — Technical and organisational measures (Article 32)

Tenant isolation. Every stored record is keyed to an organisation. The organisation is resolved from the authenticated session on the server and never taken from the request, and the database schema enforces the association through composite primary and foreign keys.

Access control. Authentication is delegated to a specialist provider; the Processor never receives or stores passwords. Authorisation is re-checked on the server for every request and every page, not only in the interface. Roles limit what a member of an organisation may read and change.

Encryption. Data is encrypted in transit using TLS. Data at rest is encrypted by the hosting provider. Strict transport security is enforced, and the application refuses to downgrade to an unencrypted connection.

Input validation. Every write is validated against an explicit schema with bounded field sizes, and financial totals are recalculated on the server rather than trusted from the client.

Public proposal links. Tokens are 32 bytes from a cryptographic random source, transmitted once and stored only as a SHA-256 hash. The raw token is never logged or persisted. Public endpoints are rate limited per source address.

Abuse limits. Write operations are rate limited per user, and the limiter fails closed in production rather than allowing unlimited requests.

Logging. Operational logs record identifiers and outcomes, not personal data, tokens or credentials. Significant account actions are recorded in an audit trail.

Availability. Data is stored on managed infrastructure with provider-operated redundancy and backup.

Change management. Changes are version controlled and pass automated type checking, linting and a regression suite that includes dedicated tenant-isolation and authorisation tests before release.