How we handle personal data

OpenQuotes is a trading name of OPENQUOTES SOFTWARE LTD, a company registered in England and Wales, company number 17489082. Our registered office is 9 Anson Villas, Paull, Hull, East Riding of Yorkshire, HU12 8AJ. We are registered with the Information Commissioner’s Office (ICO), reference ZC262486.

For anything on this page, contact us at [email protected] or on 07872 050 350.

There are two kinds of personal data in OpenQuotes, and the law treats them differently.

• Data about you as a user — your sign-in details and how you use your account. We decide how this is used, so we are the controller.
• Data your business keeps in OpenQuotes — your customers, suppliers and the people you work with. Your business decides what goes in and why, so your business is the controller. We hold it and process it only on your instructions, so we are the processor. Our terms of business set out what we will and won’t do with it.

If you are a customer of a business that uses OpenQuotes and you have a question about your details, ask that business first. We will help them answer you.

About you, as a user

• Your username and email address (for people who were invited, the username is the email address), and the businesses you belong to, with your role in each.
• Your password, stored only in scrambled form (a “hash”) that cannot be turned back into the password.
• Your second sign-in step: the public part of your passkey and any name you gave it, or your authenticator app set-up (encrypted), and when each was last used. Your recovery codes are stored scrambled (hashed).
• A record of each device you are signed in on, and of any password reset requests.
• A security log: sign-ins, including failed attempts and the name that was typed, and security changes such as adding a passkey. Each entry has the time, the device’s internet (IP) address and its browser details.
• Invitations: the email address invited, who sent the invitation and the role offered.
• Emails you send us, such as questions, security reports and complaints, and our replies.

If your business is our customer

• Your business’s billing contact, the price we agreed, our invoices to you and your payments. We keep these for six years, as company and tax law require.

For your business

• Your business details: name, address, VAT number, the bank account shown on your invoices, your logo and your website.
• Customers and suppliers: names, company names, addresses, email addresses, phone numbers, company and VAT numbers, and any notes you add.
• Jobs, including site addresses and notes; quotes, invoices, credit notes, bills and payments, including billing addresses and line descriptions.
• Bank statements you import: the payee text, account names and numbers, and the other details on each line.
• Files you upload, such as photos and supplier invoices, with their original file names. Photos keep any details your phone saved in them, such as where and when the photo was taken.
• Your VAT returns: the figures sent, HMRC’s reference numbers, and who made the declaration.
• A history of changes: what was changed, its value before and after, and who changed it.
• Records of the emails OpenQuotes sends for you, such as when a quote was delivered.
• When your customer opens or answers a quote: when they opened it, their answer and any note they wrote, when they gave it, and the internet (IP) address and browser it came from.

OpenQuotes doesn’t hold payroll or wage details, or your customers’ or suppliers’ bank details.

We don’t ask for sensitive information, such as someone’s health. Please don’t put it in notes or uploads unless the job needs it.

• From you, when you set up your account and use OpenQuotes.
• From the person who invited you: your email address and the role they offered you.
• From other people in your business, who add customers, suppliers, jobs and records.
• From HMRC, when you connect: whether your VAT number checks out, which VAT periods are open, and HMRC’s receipt for each return you send.
• From your customers, when they open or answer a quote you sent them.
• Automatically, when you use OpenQuotes: the security log and the record of the devices you are signed in on.

We don’t send marketing emails. The only emails OpenQuotes sends are the ones the service needs, such as invitations, password resets, the quotes and invoices you send, and alerts when a customer answers a quote. If we ever want to send marketing, we will ask you first.

Only when someone in your business works with HMRC through OpenQuotes. Fraud prevention details go with every request OpenQuotes makes to HMRC’s VAT service for you: checking your VAT number after you connect, checking which VAT periods are open, checking a return already sent, and sending a return. We send:

• The return itself, when you send one: your VAT number, the VAT period and the nine figures.
• Fraud prevention details, which HMRC require from all software. These are: the device’s public IP address and when it was seen; a connection port number; a random identifier for the device, stored in your browser; the browser’s identifying text; the screen’s size, scaling and colour depth; the window size; the time zone; your OpenQuotes user number and the username you sign in with; for each second sign-in step you have used, its kind, when you last used it and a reference for it; and the name and version of OpenQuotes and the addresses of our servers.

We don’t keep a copy of the fraud prevention details; they are put together fresh for each request. HMRC use them to protect taxpayers from fraud. Their own privacy notice explains what they do with them.

We use a small number of providers to run OpenQuotes. They only use your data to provide their service to us, under written agreements.

We don’t sell personal data, and we don’t share it with advertisers. We would only give it to anyone else if the law required us to.

If OpenQuotes is ever sold or merged with another company, your data would pass to the new owner, who would have to keep to this notice.

How we protect it is explained on our Security page.

Your business records are stored in Frankfurt, Germany, and your uploaded files in Cloudflare storage restricted to the European Union. Both are encrypted. Our own encrypted backup copies are kept in the UK.

Our providers are US companies, and some of their support and operations happen in the United States. Emails we send for you go through Resend, which keeps delivery records in the United States. Where data goes to the United States, it is protected by safeguards that UK data protection law accepts: the UK Extension to the EU–US Data Privacy Framework, or the UK’s standard contract terms.

• While you use OpenQuotes: for as long as your account is open.
• After you leave: six years. Businesses must keep VAT records for six years, so we keep yours, unless you ask us in writing to delete them sooner. We will send you a copy of them if you ask at any time in that period.
• After six years: we delete them.
• The security log is kept for the same period.
• Our backup copies are kept for 6 months, then deleted. So something deleted from OpenQuotes can stay in a backup copy for up to 6 months before it is gone everywhere.

Things you delete in OpenQuotes, such as a contact, are hidden but stay part of your records, because accounting records must not disappear.

While you use OpenQuotes you can download your own copies at any time: your profit and loss and balance sheet as PDF, Excel or CSV, with the transactions behind them; your whole ledger as Excel; and each quote and invoice as a PDF.

You can ask us to:

• show you the personal data we hold about you;
• correct anything that is wrong;
• give you a copy to take elsewhere;
• delete it, or limit how we use it;
• object to how we use it, where we rely on our legitimate interest.

We don’t make decisions about you by automated means alone.

Email [email protected]. We will reply within one month. It is free.

One limit: if the data is part of a business’s tax records, the business may have to keep it for six years. In that case we will explain what we can and cannot delete, and why.

The Information Commissioner’s Office explains your rights in plain English on its Your data matters pages. Its UK GDPR guidance and resources explain the law for businesses.

This website doesn’t set cookies and doesn’t track you.

The OpenQuotes app sets no cookies either. It keeps a few items in your browser’s storage: your sign-in key; a copy of your username, email address and businesses; which business you last used; and the device identifier HMRC require. Logging out removes everything except the device identifier, which HMRC expect to stay the same for each device. These items are essential for the app to work, so we don’t ask for consent. There is no advertising or tracking.

Tell us first, by email to [email protected]. We will acknowledge your complaint within 30 days and deal with it as quickly as we can.

If you are not happy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

If we change how we handle personal data, we will update this page and the date at the top. If a change affects you, we will tell you by email before it takes effect.