Data Processing Addendum

This document is provided in English, which is the binding version.

This addendum applies when QuoteGate AI ("processor") processes personal data on behalf of a customer ("controller") under our Terms of Service. It is designed to meet Article 28 of the EU GDPR and the Israeli Privacy Protection Law and its regulations.

1. Subject and duration

Answering price requests, negotiating within the controller's rules, checking buyer companies, recording deals and sending orders to the controller's systems, for the duration of the contract.

2. Data and people

• People: buyers and their staff, operators of buyer software agents, the controller's staff.
• Data: names, business email addresses and phone numbers, job titles, company details (legal name, registration and VAT numbers, addresses, website), content of price requests, quotes, deals and order data.
• No special categories of data are needed; the controller should not send them.

3. Instructions

We process the data only on the controller's documented instructions: these terms, the controller's configuration, and written requests. We tell the controller if we think an instruction breaks data protection law.

4. Confidentiality and staff

Everyone with access is bound to confidentiality and receives access only as far as their task requires.

5. Security

We apply the measures described on our Security page, including encryption in transit, a database closed to public access, access control and a tamper-evident audit log. We may improve them; we will not reduce the overall level of protection.

6. Subprocessors

The controller authorises the subprocessors listed on our Subprocessors page. We announce new subprocessors by email 30 days in advance; the controller may object on reasonable data protection grounds and, if we cannot resolve the objection, terminate the affected service. We impose the same data protection obligations on every subprocessor and remain responsible for them.

7. Help with rights and duties

We help the controller answer requests from people exercising their rights, and with data protection impact assessments and consultations with authorities, as far as our part of the processing is concerned.

8. Breaches

We notify the controller without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting its data, with the information we have and the measures taken.

9. Deletion and return

When the contract ends we delete the controller's data within 30 days, or return it first if asked, unless the law requires us to keep it.

10. Audits

We make available the information needed to show compliance. The controller may audit once a year with 30 days' notice, at its own cost, through an auditor bound to confidentiality, without disrupting our operations or seeing other customers' data.

11. International transfers

Our database is in the EU. Israel has an EU adequacy decision. For subprocessors in other countries we use EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

12. Order of precedence

If this addendum and the terms conflict about personal data, this addendum prevails. Customers who need a signed copy can ask at hello@quotegateai.com.

Processor: QuoteGate AI, Haifa, Israel.

Last updated: 5 November 2026.