Data processing agreement

How Quoflow handles personal information in your workspace on your behalf: instructions, security, sub-processors and breaches.

This agreement forms part of the Terms of service between Quoflow Limited and the customer. It sets out how Quoflow handles personal information in customer data on the customer’s behalf. If it conflicts with the terms, this agreement applies to the handling of personal information.

1. Roles

The customer controls customer data and decides why and how it is used. Quoflow processes it only on the customer’s behalf, as the customer’s agent under section 11 of the Privacy Act 2020 and, where those laws apply, as a processor.

2. Instructions

  • Quoflow processes customer data only to provide the service, in line with the terms, this agreement and the customer’s documented instructions, including settings chosen in the app.
  • Quoflow does not process customer data for its own purposes, sell it, or use one customer’s data to improve another customer’s results.
  • If Quoflow believes an instruction breaks the law, it will tell the customer.
  • If the law requires Quoflow to process customer data in another way, it will tell the customer first unless the law prevents it.

3. Confidentiality of personnel

Quoflow only allows people to access customer data when they need it to provide, secure or support the service, and only if they are bound by confidentiality obligations.

4. Security measures

Quoflow maintains reasonable technical and organisational measures to protect customer data, including:

  • TLS encryption for all data in transit, with HTTPS everywhere and HSTS;
  • AES-256 encryption of mailbox and system credentials;
  • passwords stored only as bcrypt hashes;
  • strict tenant isolation, keeping every workspace separate;
  • secure, same-site session cookies;
  • read-only mailbox access by default, with optional folder filing only when the customer’s Microsoft admin approves the Mail.ReadWrite permission;
  • no automatic sending, deleting or ordering, and emails are never marked as read;
  • an AI spending limit for each workspace, set by its admins;
  • API keys that can be read-only, are shown once and can be revoked at any time;
  • AI requests sent with storage turned off where the provider allows it.

5. Sub-processors

  • The customer authorises Quoflow to use its sub-processors. A current list is provided to customers on request.
  • Quoflow will impose data protection obligations on each sub-processor that are no less protective than this agreement, and remains responsible for their performance.
  • Quoflow will give at least 30 days’ notice before adding or replacing a sub-processor, by email to the customer’s account contact.
  • The customer may object on reasonable data protection grounds within that period. The parties will discuss the concern in good faith. If it cannot be resolved, the customer may end the affected part of the service and receive a refund of prepaid fees for the unused period.

6. Help with requests from individuals

If someone asks to access or correct their personal information in customer data, Quoflow will pass the request to the customer without undue delay and will not respond to it directly unless the customer asks. Quoflow will provide reasonable help, through the app or otherwise, so the customer can respond within the time the law requires.

7. Breach notification

  • Quoflow will tell the customer without undue delay, and within 72 hours, after becoming aware of a privacy breach affecting customer data.
  • The notice will describe what happened, the information and people likely affected, the steps taken, and a contact person. Where details are not yet known, Quoflow will provide them as they become available.
  • Quoflow will help the customer assess whether the breach is notifiable and meet its obligations to notify the Privacy Commissioner and affected people.

8. Deletion or return

At the end of the service, the customer can export its data. Quoflow will delete customer data within 90 days of account closure unless the law requires it to keep some of it. Backups roll off on their normal cycle. On request before closure, Quoflow will return customer data in a commonly used format.

9. Audit information

On reasonable request, and no more than once a year unless there has been a breach or a regulator requires it, Quoflow will provide information reasonably needed to show that it meets this agreement, such as written answers to security questionnaires and a description of its controls. Information provided is Quoflow’s confidential information.

10. Overseas transfers

Quoflow and its sub-processors store and process customer data in Japan and the United States, as set out in the list of sub-processors provided to customers. Quoflow only uses providers that are subject to comparable safeguards, or bound by contractual protections, so that customer data is protected in a way comparable to the Privacy Act 2020.

11. If the GDPR or UK GDPR applies

Quoflow is built for New Zealand businesses. If a customer is subject to the EU General Data Protection Regulation or the UK GDPR, this agreement is intended to cover the basic processor terms those laws require, including processing only on documented instructions, confidentiality, security, conditions for sub-processors, help with individuals’ rights and breach notification, deletion or return, and audit information.

Where those laws require an approved transfer mechanism for data sent outside the EU or UK, the parties will put one in place on request, such as standard contractual clauses. Quoflow does not hold any GDPR certification.

12. Contact

Questions about this agreement, or requests for a signed copy, go to our Privacy Officer.

Last updated 12 October 2026