Legal

Data Processing Addendum

Version 1.0 · Last updated 7 October 2026

This addendum sets out how Tacet Ltd processes personal data on behalf of businesses that use Qotery. It forms part of our Terms of Service and needs no separate signature.

1Scope and roles

1.1

This Data Processing Addendum (“DPA”) forms part of the Qotery Terms of Service (the “Terms”) between Tacet Ltd (“Tacet”) and the customer (“you”). It applies when Tacet processes Customer Personal Data on your behalf in providing the Service. Terms defined in the Terms have the same meaning here.

1.2

You are the controller of Customer Personal Data and Tacet is your processor. Annex 1 describes the processing.

2Definitions

Data Protection Law: The UK GDPR and the Data Protection Act 2018 and, where they apply to the processing, the EU GDPR and other data protection laws of the EEA.
Customer Personal Data: Personal data within Customer Data that Tacet processes on your behalf.
Sub-processor: Another processor engaged by Tacet to process Customer Personal Data.
Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
controller, processor, data subject, personal data, processing: Have the meanings given in Data Protection Law.

3Processing on your instructions

3.1

Tacet will process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case Tacet will tell you before processing unless the law prohibits that.

3.2

Your instructions are the Terms, this DPA, your use and configuration of the Service, and any further written instructions we agree. Instructions outside the scope of the Service may be subject to additional fees.

3.3

Tacet will tell you if, in its opinion, an instruction infringes Data Protection Law.

4Confidentiality

4.1

Tacet will ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality.

5Security

5.1

Tacet will implement appropriate technical and organisational measures to protect Customer Personal Data, including those in Annex 2.

5.2

Tacet may update its measures from time to time, provided the overall level of protection is not materially reduced.

6Sub-processors

6.1

You give Tacet general authorisation to engage Sub-processors. The current list is on our sub-processors page.

6.2

Tacet will give at least 14 days’ notice of a new Sub-processor by updating that page and emailing your account administrators. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection in good faith, you may terminate the affected part of the Service by notice, and we will refund the fees you prepaid for the period after termination. That is your sole remedy for the objection.

6.3

Tacet will impose data protection obligations on each Sub-processor that are substantially similar to those in this DPA, and remains responsible to you for its Sub-processors’ performance as Data Protection Law requires.

7International transfers

7.1

You authorise Tacet and its Sub-processors to transfer Customer Personal Data outside the UK and the EEA, provided the transfer is covered by UK adequacy regulations or by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8Assistance

8.1

If Tacet receives a request from a data subject about Customer Personal Data, it will pass the request to you without undue delay and will not respond itself except on your instructions. Taking into account the nature of the processing, Tacet will provide reasonable assistance to help you respond.

8.2

Tacet will provide reasonable assistance with your data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to Tacet.

8.3

Assistance beyond the Service’s standard features is at your cost, at our reasonable rates.

9Personal data breaches

9.1

Tacet will notify you without undue delay after becoming aware of a Personal Data Breach, with the information reasonably available to it, and will provide further information as it becomes available.

9.2

Tacet will take reasonable steps to contain and remedy the breach. Notifying you of a breach is not an admission of fault or liability.

10Deletion and return

10.1

While your account is open you can export your quote requests from the Service. After your subscription ends, Tacet will delete Customer Personal Data within 90 days.

10.2

Copies in rolling backups are deleted when the backups are overwritten in the normal cycle. Tacet may keep Customer Personal Data where the law requires, and will continue to protect it under this DPA.

11Information and audits

11.1

Tacet will make available the information reasonably necessary to demonstrate its compliance with this DPA, including by answering a reasonable written security questionnaire no more than once in any 12 months.

11.2

An on-site audit is available only where a supervisory authority requires it or after a Personal Data Breach affecting your data. It must be conducted at your cost, on at least 30 days’ notice, during business hours, no more than once in any 12 months, by an auditor bound by confidentiality, and so as to minimise disruption to Tacet’s business and its other customers.

12Your obligations

12.1

You are responsible for:

having a lawful basis, and giving any notices needed, for the processing your instructions require;
making sure your instructions comply with Data Protection Law;
not submitting special category, criminal offence or children’s data, except where it is unavoidably contained in business emails you are entitled to process; and
keeping your users’ sign-ins and tokens secure.

13Liability

13.1

Each party’s liability under or in connection with this DPA, including under Data Protection Law, is subject to the limitations and exclusions in the Limitation of liability section of the Terms, and counts towards the limit set out there.

14General

14.1

This DPA lasts for as long as Tacet processes Customer Personal Data. If it conflicts with the Terms on a matter of data protection, this DPA prevails.

14.2

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Questions about it go to privacy@qotery.com.

15Annex 1: Details of the processing

Subject matter

Details: Providing the Service under the Terms.

Duration

Details: The term of the Terms, plus the deletion period in this DPA.

Nature and purpose

Details: Receiving emails you forward, paste or open with the Outlook add-in; storing them; extracting shipment details with AI; checking, pricing and estimating customs costs; drafting replies for your review; and support.

Types of personal data

Details: Names, email addresses, phone numbers, postal addresses, job titles and company details; email content and headers; shipment, goods and value details; and any other personal data contained in the emails you submit.

Data subjects

Details: Your customers, suppliers and other contacts, and your Authorised Users.

Special category data

Details: None intended. See Your obligations.

Frequency

Details: Continuous, while you use the Service.

Item	Details
Subject matter	Providing the Service under the Terms.
Duration	The term of the Terms, plus the deletion period in this DPA.
Nature and purpose	Receiving emails you forward, paste or open with the Outlook add-in; storing them; extracting shipment details with AI; checking, pricing and estimating customs costs; drafting replies for your review; and support.
Types of personal data	Names, email addresses, phone numbers, postal addresses, job titles and company details; email content and headers; shipment, goods and value details; and any other personal data contained in the emails you submit.
Data subjects	Your customers, suppliers and other contacts, and your Authorised Users.
Special category data	None intended. See Your obligations.
Frequency	Continuous, while you use the Service.

16Annex 2: Security measures

Encryption in transit (HTTPS) between users, the Service and its providers.
Encryption at rest by the database provider.
Hosting with established providers in the EU.
Access to production systems limited to authorised personnel who need it.
Sign-in and add-in tokens stored only as cryptographic hashes; payment card details held by Stripe.
Each customer’s data kept separate within the application, with access checked on every request.
Rolling backups, and a process for restoring data.
Logging and monitoring of the Service for errors and misuse.
Data protection terms with each Sub-processor.