Data Processing Agreement — QuietStaff Ltd

This Data Processing Addendum (the “DPA”) is between the business that uses QuietDesk (the “Firm”, “you” or “your”) and QuietStaff Ltd (“QuietStaff”, “we” or “us”), a company registered in England and Wales, company number 17171308, whose registered office is 66 Paul Street, London EC2A 4NE.

For the personal data covered by this DPA, you are the controller and we are the processor. “Data Protection Law” means the UK GDPR and the Data Protection Act 2018. “Personal data”, “controller”, “processor” and “personal data breach” have the meanings given in the UK GDPR.

What this DPA covers. QuietDesk is our service for answering and following up enquiries for a heating or plumbing firm. It takes enquiries through website chat, a web form and forwarded email, offers visit slots that you confirm, drafts quotes from your price sheet for you to approve, and follows up with enquirers who have not replied. This DPA covers the personal data of your customers and enquirers that we process for you in providing QuietDesk, and the personal data of your staff who sign in to it.

How it fits with our other documents. This DPA sits alongside our Terms. Our Privacy Policy explains how we handle personal data as a controller for our own purposes, which this DPA does not cover. If this DPA and the Terms conflict on the processing of personal data covered by this DPA, this DPA applies.

• Subject matter. Answering and following up enquiries for your heating or plumbing business through QuietDesk.
• Duration. For as long as you have an active QuietDesk plan, and afterwards only for the time needed to return or delete the data as set out in the Return and deletion section.
• Nature of the processing. Receiving enquiries (a new chat, a submitted enquiry form or a forwarded enquiry email); storing them and the replies; drafting replies with an AI model; sending email on your behalf, together with alerts and lead summaries to you; offering visit slots that you confirm; and drafting quotes from your price sheet for you to approve.
• Purpose. To provide QuietDesk to you: to answer your customers' and enquirers' questions, to follow up their enquiries, and to pass leads, alerts and drafts to you so that you can decide what happens next.

The table sets out the types of personal data we process for you and whose data they are. Enquirers write their own messages, so what a message contains is for the enquirer to decide.

We treat the hashed values in the last row as personal data. This table does not cover the billing details of your business for your QuietDesk plan, which are described in the Sub-processors section.

We will:

1. Act on your instructions. Process the personal data only on your documented instructions. These are this DPA, your use and configuration of QuietDesk (including the knowledge text and price sheet you give it), and any further written instructions we agree. That includes instructions on transfers of personal data outside the UK, which are covered in the International transfers section. If the law requires us to process the personal data in another way, we will tell you of that requirement before we process, unless the law prohibits us from telling you.
2. Use it for no other purpose. Not use the personal data for any purpose of our own, or for any purpose other than providing QuietDesk to you.
3. Keep it confidential. Make sure that every person we authorise to process the personal data has committed to confidentiality or is under a statutory duty of confidentiality.
4. Tell you about unlawful instructions. Tell you immediately if, in our opinion, an instruction from you infringes Data Protection Law.
5. Comply with the law. Comply with the obligations that Data Protection Law places on us as a processor.

Our other duties as processor are set out in the sections on Sub-processors, Security, Assisting you with data subject requests, Breaches, Audit, and Return and deletion.

As controller you are responsible for the personal data you pass to QuietDesk and for the instructions you give us. In particular, you will:

1. have a lawful basis under Data Protection Law for passing the personal data of your customers and enquirers to us and for having it processed as described in this DPA;
2. tell your customers and enquirers, in your own privacy information, that you use an AI assistant to answer their enquiries and that their personal data is processed for you by QuietStaff and its sub-processors;
3. give us accurate and lawful instructions, including accurate knowledge text and an accurate price sheet, and keep the email address on your account up to date, because sign-in codes are sent to it; and
4. review and approve each quote that QuietDesk drafts and confirm each visit before it is relied on, and check AI outputs before you rely on them, because our Terms explain that AI outputs can be wrong.

You give us general written authorisation to use sub-processors to provide QuietDesk. The sub-processors we use for QuietDesk are:

• Anthropic (Claude API, called directly): writes replies to chat and email messages.
• Resend: sends QuietDesk's emails.
• Stripe: billing and Checkout.
• Cloudflare: hosting, the database and short-lived storage, receiving forwarded enquiry email, and the Turnstile browser check.

The QuietDesk section of our sub-processor list names the same four, with more detail.

New sub-processors. Before we add or replace a sub-processor for QuietDesk, we will tell you by email to the address on your account at least 30 days before the change takes effect, and we will update the list. You can object on reasonable data protection grounds by writing to privacy@quietstaff.com within that time. We will discuss your objection with you in good faith. If we cannot resolve it, you can cancel QuietDesk as the Terms describe.

Their obligations. We will put each sub-processor under a written contract that imposes the same data protection obligations as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures, as Article 28(4) of the UK GDPR requires.

Our responsibility. We remain fully responsible to you for how each sub-processor performs its data protection obligations.

We transfer personal data outside the UK only on your documented instructions, which include your use of QuietDesk as this DPA describes, and only where a lawful route under Chapter V of the UK GDPR applies.

Anthropic, Resend, Stripe and Cloudflare, our sub-processors for QuietDesk, are US-headquartered, so using QuietDesk can involve transfers to the United States. For each of them, the transfer mechanism we rely on and the region where your data is processed are not yet confirmed. We do not claim a mechanism we have not confirmed.

When we confirm the mechanism and region for a sub-processor, we will show it in the QuietDesk section of our sub-processor list. You can ask for a copy of the safeguards we rely on by writing to privacy@quietstaff.com.

We take the measures that Article 32 of the UK GDPR requires of a processor, appropriate to the risk of the processing. These are the measures QuietDesk uses at present:

• Separation of firms' data. Every record carries a client identifier, and all access to data goes through an accessor limited to one client. An isolation test covers this separation.
• Controlled sign-in. Owners sign in with a six-digit code sent to the email address on the client record. We store only hashes of the code and of the email address for sign-in.
• Bot checks. A Cloudflare Turnstile check runs at the start of a new website chat conversation.
• Audit log. An append-only audit log records AI suggestions, outbound messages and alerts.
• Hosting. QuietDesk runs on Cloudflare (Workers, the D1 database and the KV store).

If someone asks you to exercise a right over personal data we process for you, such as access, correction or deletion, you decide how to respond as controller. On your instruction we will help you, by appropriate technical and organisational measures, to find, provide a copy of, correct or delete the personal data we hold for you about that individual. The records for one person can be held in more than one place, such as enquiry, message and outbound email records, and we will look in each of them.

If a request reaches us directly, we will not respond to the individual on the substance. We will pass it to you without undue delay and, where we can, tell the individual that we have done so. To ask for our help, or to pass a request to us, write to privacy@quietstaff.com.

If we become aware of a personal data breach affecting personal data we process for you, we will tell you without undue delay, by email to the address on your account. As far as we have the information, and in stages if it is not all available at once, we will tell you:

• what happened, including the categories and approximate number of individuals and records concerned;
• the likely consequences;
• what we have done or propose to do to deal with the breach and limit its effects; and
• our contact point, which is privacy@quietstaff.com.

You decide whether to notify the Information Commissioner's Office and the individuals affected. Taking into account the nature of the processing and the information we hold, we will help you to meet your obligations under Articles 32 to 36 of the UK GDPR, which cover security, breach notification, data protection impact assessments and prior consultation. We will use the records we keep, including our append-only audit log, to establish what happened.

We will make available to you the information needed to show that we comply with this DPA and with Article 28 of the UK GDPR. We will also allow and contribute to audits, including inspections, carried out by you or by an auditor you appoint.

So that audits are practical, they will be:

• requested in writing to privacy@quietstaff.com;
• arranged on reasonable notice, with the timing and scope agreed with us in advance;
• limited to the processing we carry out for you, and kept confidential by everyone involved; and
• carried out so as not to disrupt the service or give access to any other firm's data, which we keep separate from yours.

While you use QuietDesk. A scheduled job deletes the records of an enquiry 12 months after the last activity on it. Stored extracts of email text are removed after 30 days.

When your plan ends. The same 12-month deletion continues to run on the records of your enquiries. If you want them deleted sooner, write to privacy@quietstaff.com and we will delete them within 30 days of your request, except for the audit trail described below and anything UK law requires us to keep.

Return. QuietDesk does not yet have a way to export your data. If you want your data returned rather than deleted, tell us before your plan ends and we will agree with you how and when we give you a copy, before we delete it.

What the 12-month deletion does not remove. Unless you ask us to delete them as above:

• an enquiry with an accepted quote, and its records, is kept with no end date;
• a record of each incoming message (a hashed form of the sender's identity, the message reference and the outcome) is kept with no end date;
• the record of a customer's message passed to you by email that is not linked to an enquiry keeps the customer's name and email address, although the text of the message is removed after 30 days;
• the email address of anyone who unsubscribes from your emails stays on your firm's unsubscribe list with no end date, so that the opt-out keeps working.

The audit trail. QuietDesk keeps an audit trail that cannot be changed or deleted, including on your request. Where it refers to an enquiry, that enquiry is cleared instead of deleted: its details and the customer's contact details are removed. Some audit entries still hold a customer's name with the time of a visit slot that was held, and text QuietDesk suggested for the enquiry, such as the job or the postcode. At present we keep the audit trail with no end date.

For questions about this DPA or about how we process personal data for you, write to privacy@quietstaff.com. For anything else, write to contact@quietstaff.com.

QuietStaff Ltd, registered in England and Wales, company number 17171308. Registered office: 66 Paul Street, London EC2A 4NE.

Read this DPA with our Terms, our Privacy Policy and our sub-processors page.