Last updated: September 21, 2026
This Data Processing Agreement ("DPA") supplements the Terms of Service and applies to the extent ProQuote processes personal data on your behalf in connection with the Service. It is intended to address processor obligations under applicable data-protection law, including the EU General Data Protection Regulation and UK GDPR where those laws apply to the relevant processing. This DPA is incorporated into the Terms of Service. If you need a countersigned copy for your records, contact us as described below.
For personal data about your customers, contacts, workers, or other individuals that you submit to ProQuote for your business purposes, you generally act as the controller and ProQuote acts as your processor, except where applicable law assigns the parties different roles for a particular activity. For personal data ProQuote processes for its own account-management, security, billing, analytics, legal, and business purposes, ProQuote acts as a controller as described in our Privacy Policy.
Subject matter and purpose: providing and supporting ProQuote's estimating, invoicing, customer-management, document, payment-workflow, job-administration, and related features that you choose to use.
Duration: for the period in which ProQuote provides the Service and for limited periods afterward as permitted by this DPA, the Terms, the Privacy Policy, or applicable law.
Nature of processing: collection, storage, organization, retrieval, display, calculation, transmission, export, backup, security monitoring, support, and deletion or de-identification as needed to provide the Service.
Depending on your use of ProQuote, processing may involve:
ProQuote is not designed to require special-category or highly sensitive personal data such as health, biometric, precise government-identifier, or similar information. You should avoid entering such information unless it is genuinely necessary for your lawful business purpose and you have determined that you are permitted to process it.
Your use and configuration of the Service constitute your documented instructions to ProQuote for processing covered by this DPA. You are responsible for ensuring that your instructions and processing comply with applicable law, including providing required notices and establishing an appropriate legal basis for collecting, using, storing, and communicating with individuals whose data you enter into ProQuote.
If ProQuote reasonably believes an instruction violates applicable data-protection law, we may inform you and suspend the affected processing to the extent reasonably necessary while the issue is addressed, unless law prohibits us from doing so.
You authorize ProQuote to use sub-processors as reasonably necessary to provide the Service. Current core providers include:
ProQuote will use contractual or other arrangements with sub-processors intended to provide data-protection commitments appropriate to the services they perform. We do not represent that every provider is certified under every framework or that a provider's services will be uninterrupted.
Where applicable law requires advance notice or an opportunity to object to a new sub-processor, ProQuote will provide a reasonable notice mechanism. An objection must be based on reasonable data-protection grounds. If the parties cannot resolve a valid objection, the available remedy may include discontinuing the affected feature or terminating the affected Service as permitted by the Terms and applicable law.
ProQuote and its providers may process data in countries outside the jurisdiction where you or a data subject is located. Where applicable data-protection law requires a transfer mechanism for covered personal data, the parties will rely on an available lawful mechanism appropriate to the transfer, which may include Standard Contractual Clauses, an applicable adequacy decision, or another legally recognized safeguard. The specific mechanism can depend on the provider, destination, and law governing the transfer.
ProQuote maintains technical and organizational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures currently include HTTPS/TLS in transit, password hashing, authentication controls, database access controls, rate limiting on sensitive endpoints, logging, error and uptime monitoring, restricted production access, and backup or recovery mechanisms provided by our infrastructure providers where configured.
Security measures evolve with the Service and threat environment. No system can guarantee absolute security, and this section is a description of safeguards rather than a warranty that a security incident cannot occur.
If ProQuote becomes aware of a personal data breach involving covered personal data for which ProQuote acts as your processor, ProQuote will notify you without undue delay as required by applicable law. We will provide information reasonably available to us that is relevant to your own notification obligations and will reasonably cooperate with investigation and mitigation efforts. Notification of an incident is not an admission of fault or liability.
During the Service term, export and download options are available as described in the product and Terms. Following account deletion or termination, ProQuote is designed to delete or de-identify covered personal data after the applicable grace period, subject to limited retention permitted or required for security, fraud prevention, legal compliance, tax or accounting obligations, dispute handling, backup-cycle completion, or the establishment or defense of legal claims.
Data in backups may remain until the applicable backup rotates out under normal retention cycles, provided it remains protected and is not restored for ordinary business use except as needed for disaster recovery or legal/security purposes.
On reasonable written request, no more than once in a 12-month period unless a specific security incident or regulator requires otherwise, ProQuote will provide information reasonably necessary to demonstrate compliance with the processor obligations in this DPA. We may satisfy a request using existing documentation, questionnaires, summaries, third-party reports, or other reasonable evidence rather than an on-site inspection where those materials are sufficient.
If an audit beyond available documentation is legally required, the parties will agree in advance on reasonable scope, timing, confidentiality, security, and cost arrangements so the audit does not compromise other users' data or the security of the Service.
Unless prohibited by law, ProQuote will direct a request for covered personal data to you when the requester should properly seek the information from you as controller. If ProQuote is legally compelled to disclose covered personal data, we will disclose only the information we reasonably determine is required and will provide notice where legally permitted.
Liability arising from this DPA is subject to the limitations and exclusions in the Terms of Service to the extent permitted by applicable law. If this DPA conflicts with the Terms specifically regarding ProQuote's processing of covered personal data as your processor, this DPA controls for that conflict. Mandatory provisions of applicable data-protection law control where they cannot lawfully be varied by contract.
We may update this DPA to reflect changes in the Service, sub-processors, security practices, or applicable law. The page will state its current last-updated date. Material changes will be communicated where required by applicable law or the Terms.
Questions about this DPA or need a countersigned copy for your records? Contact us or email [email protected].