Kwote beta terms

• Kwote is a trading name of Janke Breugem, who lives and works in the Netherlands ("we", "us").
• Contact: kwoteapp.za@gmail.com.
• "You" means the company that uses Kwote.
• The person who accepts these terms confirms that they may accept them for the company.

• Kwote is in beta. It is free, and by invitation only.
• We provide it as it is, and we do our best.
• We do not promise that it is free of errors, always available or right for every purpose.
• Features may change.
• We may pause Kwote for maintenance.
• We will never charge you without at least 60 days' written notice. You can leave before any charge starts.
• You or we may end the beta at any time, by email.
• If we end it, you get at least 30 days to download your data, unless misuse or the law makes us act sooner.
• As far as the law allows, we are not liable for loss from using the beta, except loss we cause on purpose or through gross negligence.
• This limit does not affect the standard contractual clauses in Part B.

• Your owners and admins decide who has access, and with which role.
• Each person signs in with their own account, password and authenticator app.
• Don't share sign-ins.
• Tell us straight away if you think an account has been misused.

Use Kwote only for your own lawful quotes and invoices. Don't:

• send spam or unsolicited marketing through it;
• store anything unlawful, or data you have no right to hold;
• try to break, probe or overload Kwote, or reach another company's data;
• resell Kwote, or let people outside your business use your account.

We may suspend access to protect Kwote, other customers or the people whose data is in it. We tell you why.

• Your data stays yours: clients, contacts, documents, letterheads, logo and email history.
• We use it only to run Kwote for you.
• We don't sell it, use it for ads or train AI with it.
• You can export at any time:
  • an owner or admin can download a full backup (Settings, Backup);
  • anyone in your company can export the documents list as a CSV file.
• Kwote keeps a PDF of every document you mark as sent.

• Kwote is a working tool, not your tax archive.
• SARS requires electronic tax records to be kept in South Africa, unless SARS agrees otherwise (Public Notice 787 of 2012, rule 4).
• Kwote stores your data in Germany.
• So download your PDFs and your backup regularly. Keep them in South Africa for as long as SARS requires, normally five years.

• We email you any change at least 30 days before it applies.
• If you don't agree, you may end the beta before then.

• Dutch law applies to these terms.
• The courts of the Netherlands decide disputes.
• You keep every protection that South African law gives you and that a contract cannot exclude, for example under the Consumer Protection Act or the ECT Act.

• We email these terms, with their version date, to your company's owner.
• The owner replies from their own email address: "I accept the Kwote beta terms of 15 October 2026 for [company name]", with their name, their role and the company's address.
• We keep that reply and its date as your signed copy of Parts A and B and of the standard contractual clauses.
• A new version is accepted the same way.

• You are the controller of the data you put in Kwote. Under POPIA you are the responsible party.
• We are your processor. Under POPIA we are your operator.
• Part B covers all of that data, including information about companies, which POPIA also protects.
• Part B is written to meet article 28(3) of the GDPR and sections 19 to 21 of POPIA.

Subject	Hosting and running Kwote for your company
Duration	While you use Kwote, and then until deletion under section 18
Nature	Storing, showing and changing data; making PDFs; sending email through your own mailbox; backups, imports and restores; exports; deletion
Purpose	To let you make, send and keep quotes and invoices
Types of data	Client and contact details (names, care-of names, addresses, site addresses, email addresses, phone numbers, VAT numbers, notes); documents with their lines, notes and status; records of sent emails (recipients, subject, message); saved PDFs; your letterheads (contact name, registration and VAT numbers, address, email, phone, bank details) and logo; your mailbox address and its app password (stored encrypted); your people's names, email addresses and roles, and your activity log (section 20)
Data subjects	Your clients and their contacts, both people and companies; other people named in your documents and emails; your own staff and contact people

• We process your data only on your documented instructions.
• These terms are instructions. So is everything your people do and set in Kwote.
• If the law makes us do something else, we tell you first, unless the law forbids that.
• We tell you if we think an instruction breaks the GDPR or POPIA.

• Only Janke Breugem has access to your data.
• Anyone who helps us later will first be bound to confidentiality.
• We open your data only to run Kwote for you:
  • when your owner turns on support access;
  • when you ask us;
  • when we must do so to keep Kwote running (to restore a backup, for example).
• We never give it to anyone else, unless the law requires it.

• Kwote runs on AWS in Frankfurt, Germany (eu-central-1), over HTTPS only.
• Everyone signs in through Amazon Cognito with a password of at least 12 characters and an authenticator app.
• A sign-in ends after 4 hours without use, or 12 hours in all.
• On a device a person marks as their own, a sign-in ends after 14 days without use, or 30 days in all.
• These need a sign-in from the last 15 minutes:
  • changing bank details, quote terms or mailbox settings;
  • inviting or removing people, and changing roles;
  • backups, imports and restores.
• Each company has its own database.
• Every request checks the person's role in that company.
• Mailbox passwords and sign-in tokens are stored encrypted.
• Off-site backups run every night. They are encrypted at rest and stored in Frankfurt.
• The server itself cannot overwrite or delete the off-site backups.
• Only Janke Breugem can reach the server: by SSH key from addresses we allow, or through the AWS console.
• Security updates install automatically.
• We review these measures at least once a year and after any incident.

You allow us to use these sub-processors:

Sub-processor	Where	What for
Amazon Web Services (AWS)	Frankfurt, Germany (eu-central-1)	The server, backups, sign-in (Amazon Cognito) and invitation emails
Google (Gmail)	May be outside the EU	Our support mailbox: only what you email us

• Please don't email us your clients' details: our free Gmail mailbox comes without data processing terms.
• To show us a problem, describe it, or turn on support access.
• AWS is bound by its own data processing terms, with duties like those in Part B.
• We email you at least 30 days before we add or replace a sub-processor. You may object.
• If we cannot solve your objection, you may end the beta after exporting your data.

• Your clients may ask you to see, correct or delete their information.
• You can do most of that in Kwote: edit a client, delete a contact or a draft, export.
• Where Kwote has no button for it yet, we do it for you promptly when you ask.
• If someone asks us directly, we pass the request to you and don't answer it ourselves.
• Where it is reasonable, we help you with security questions, breach reports and impact assessments.

• We tell you without undue delay, and in any case immediately once we have reasonable grounds to believe that someone has accessed or taken your data without permission.
• We tell you what happened, which data and people are affected, what we have done and what you should do.
• We send more as we learn it.
• You then report it to the Information Regulator and tell your clients, as POPIA s22 requires. We help you with it.

• Download your backup first.
• Within 30 days after the end, we delete your company's data from the server and from our own computers.
• Copies in backups expire by themselves:
  • server snapshots after 7 days;
  • daily copies, and copies made before an update, after 35 days;
  • monthly copies after 400 days (about 13 months).
• Off-site copies are gone for good 7 days after that.
• Until then, we keep them safe and use them only to restore Kwote.
• If you prefer your data returned rather than deleted, your backup file is the returned copy.
• On request, we confirm the deletion in writing.

• On request, we give you the information you need to show that your data is handled lawfully: these terms, a description of our security and our records.
• You, or an auditor you choose who is bound to confidentiality, may also check how we meet Part B.
• Give us 30 days' notice for that check.
• You pay your own costs.

• We keep your data in the EU. It leaves the EU only:
  • when we make it available to you: in Kwote, in your downloads, and in emails you send through your own mailbox;
  • in anything you email to our Gmail mailbox (section 15).
• For those transfers, the EU standard contractual clauses for transfers from a processor to a controller are part of these terms: Commission Implementing Decision (EU) 2021/914, Module Four. The annex below gives the details.
• If the clauses conflict with these terms, the clauses win.
• Showing your owners and admins your people's names, roles and your activity log is also processing for you under Part B.
• We are bound by the GDPR and by Part B. Both give protection substantially similar to POPIA's, including limits on passing data on.
• You can use this in your own assessment under POPIA section 72(1)(a).

• You confirm that you may collect and use the data you put in Kwote.
• You tell your clients how you use it (POPIA s18).
• Don't put special personal information in Kwote (health, religion, criminal records and the like), or information about children. Kwote is not built for it.
• Keep your mailbox settings, and the list of people with access, up to date.

• Clause 7 (docking clause): not used.
• Clause 11: no independent dispute resolution body.
• Clause 17: the law of the Netherlands.
• Clause 18: the courts of the Netherlands.

	Data exporter	Data importer
Name	Janke Breugem, trading as Kwote	The company that accepts these terms, as named in its acceptance email
Country	The Netherlands	South Africa
Contact	kwoteapp.za@gmail.com	The owner who accepts: name, role, email and the company's address, as in the acceptance email
Activities	Provides Kwote and hosts the importer's data	Makes, sends and keeps quotes and invoices with Kwote
Role	Processor	Controller
Signature and date	The acceptance email (section 9)	The acceptance email (section 9)

• Data subjects and personal data: as in section 11.
• Sensitive data: none (section 21).
• Frequency: continuous, whenever the importer's people use Kwote.
• Nature: making data available to the importer's people in Kwote and in downloads (PDFs, CSV and backup files), and emails sent through the importer's own mailbox.
• Purpose: to provide Kwote to the importer.
• Retention: as in section 18.

The Autoriteit Persoonsgegevens, the Netherlands.