Draft - pending review
Data Processing Agreement
This agreement is between the trader who subscribes to Quote Rescue Engine (the controller) and Prosper AI Systems (the processor). It is made to meet UK GDPR Article 28. It covers personal data about the controller’s customers that the controller stores in the app.
Who we are
Prosper AI Systems is a sole trader business. It is not a registered company. The business is based at Venture Towers, Portsmouth, PO1 5DL. You can contact us at info@prosperaisystems.co.uk.
Subject matter and duration
The subject matter is hosting and operating Quote Rescue Engine so the controller can keep customer and quote records and prepare follow-ups. It lasts for as long as the controller has an account, and afterwards until the personal data is deleted or returned, as set out below.
Nature and purpose
The nature of the processing is storage, retrieval, display, editing, export, and preparation of follow-up drafts. The purpose is to let the controller follow up their own quotations. Prosper AI Systems does not use this personal data to market its own services.
In the current release, messages are opened in the controller’s own email. The code contains an email sender, SendSets, but the live send route does not call it. See Sub-processors.
Personal data and data subjects
The personal data is what the controller enters: names, contact details, quote details, notes, and follow-up history. The data subjects are the controller’s customers and any other people the controller chooses to record.
Documented instructions
Prosper AI Systems processes that personal data only on the controller’s documented instructions. Using the app is an instruction: adding a record, editing it, exporting it, or preparing a draft. A written instruction can also be sent to info@prosperaisystems.co.uk. If UK law requires processing without those instructions, Prosper AI Systems will tell the controller first, unless the law forbids that notice.
Confidentiality
People authorised to handle this personal data do so under a duty of confidence.
Security
The current build includes these measures:
- Sign-in by email. The session is stored by the Supabase client in the browser.
- Row-level security on the application tables, so an authenticated account reads and writes the rows it owns.
- The site is served by the host over HTTPS, with security headers that block framing, set a referrer policy, and set a content security policy.
- The public demo uses fictional records in the browser. It is separate from a customer account.
This list describes the current build. It is not a certification.
Sub-processors
Prosper AI Systems uses the sub-processors below for personal data in the app. A region is stated where the repository records it. Otherwise the region is to be confirmed.
- Supabase — database and authentication hosting. The records in this project name the pooler host aws-0-eu-west-2.pooler.supabase.com, which is eu-west-2 (London). Confirm that region against the live project.
- Netlify — application hosting and serverless functions. Region: to be confirmed.
- SendSets — an email-delivery adapter is in the code, aimed at api.sendsetsapi.com. In this release the live send route returns before any provider call, and the scheduler does not send through it. Region: to be confirmed.
Account email can be sent through a custom SMTP setting inside Supabase, for info@prosperaisystems.co.uk. The project records do not name a separate SMTP company, so none is listed.
The checkout that takes the controller’s own subscription is described in the privacy draft. It is not listed here as a sub-processor of the controller’s customer records.
New sub-processors
Prosper AI Systems will give the controller prior notice before adding or replacing a sub-processor. The controller may object in writing to info@prosperaisystems.co.uk before the change takes effect. If the objection is not resolved, the controller may end the subscription.
International transfers
Where a sub-processor processes personal data outside the UK, Prosper AI Systems will use a transfer tool that UK GDPR recognises. Where it applies, that tool is the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. A region marked “to be confirmed” is not yet a completed transfer assessment.
Rights requests
Prosper AI Systems will assist the controller with requests from data subjects, including access, correction, deletion, restriction, portability and objection, taking account of the nature of the processing. A signed-in account can export its records from the app. Other requests can be sent to info@prosperaisystems.co.uk.
Personal data breaches
Prosper AI Systems will notify the controller of a personal data breach without undue delay after becoming aware of it, and will help with the information the controller needs for its own duties.
Deletion or return
When the account ends, Prosper AI Systems will, at the controller’s choice, delete the personal data or return it, and will delete remaining copies, unless UK law requires storage. Proposed: within 30 days of the account ending or of a written request. That period is proposed. It is not yet a settled retention rule.
Audits
The controller may ask for information reasonably needed to show compliance with this agreement, and may audit on reasonable written notice, in a way that does not disrupt other customers. Written answers and relevant records may be used so that other customers’ data is not opened.
Liability
Liability under this agreement is the liability set out in the Terms of Service. Those terms do not exclude liability that cannot be excluded under UK law. If this agreement and the Terms differ on a point about this processing, this agreement applies to that point.