1. Data Controller & Introduction

Quotik ("we", "us", "our") is the data controller responsible for your personal data. We are committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our Data Protection Officer can be contacted at privacy@quotik.com. We are registered with the Information Commissioner's Office (ICO).

By using Quotik, you agree to the practices described in this policy. This policy applies to both customers seeking quotes and builders using our platform.

2. Data We Collect

We collect the following types of personal data:

• Customer data: Name, email address, phone number, property postcode, job description, and photos you upload of your space.
• Builder data: Business name, contact name, email, phone, service area, postcode, and business bio.
• Usage data: How you interact with the platform, including pages visited and quote requests submitted.
• AI-generated data: Visualisations and cost estimates generated from your uploaded photos and project descriptions.

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent (Article 6(1)(a)): When you provide photos and project details for AI visualisation.
• Contract (Article 6(1)(b)): To facilitate quote requests between customers and builders.
• Legitimate interests (Article 6(1)(f)): To operate, improve, and secure our platform.

4. How We Use Your Data

• To generate AI visualisations and cost estimates for your projects.
• To match customers with suitable local builders based on category and proximity.
• To send quote requests to your selected builders.
• To provide financing options where requested.
• To maintain a two-way review system between customers and builders.
• To communicate with you about your quotes and account.

5. Data Sharing

We share your personal data only as necessary to provide our service:

• With builders: When you request a quote, your name, contact details, project description, and photos are shared with the selected builder(s).
• With financing partners: Only if you choose to explore financing options.
• Service providers: Third parties who help us operate the platform (e.g. cloud storage, AI services), under appropriate data processing agreements.

We never sell your personal data.

6. Data Retention

We retain your personal data only for as long as necessary to provide our services and comply with legal obligations. Quote request data is retained for the duration of active projects and for a reasonable period thereafter for review and dispute resolution purposes. You may request deletion of your data at any time.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Correct any inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing: Limit how we use your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us using the details below.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data in accordance with Article 32 of the UK GDPR, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Role-based access controls limiting data access to authorised personnel only.
• Regular security reviews and vulnerability assessments.
• Secure payment processing through our PCI-compliant payment provider.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR. If the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.

9. International Transfers

Your data may be processed by service providers outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with UK GDPR.

10. Cookies & Tracking Technologies

We use the following categories of cookies:

• Essential cookies: Required for the platform to function (e.g. authentication, session management). These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with the platform so we can improve it. Used only with your consent.
• Marketing cookies: Used to display relevant content and updates. Used only with your consent.

When you first visit Quotik, you will see a cookie consent banner allowing you to accept, reject, or manage your cookie preferences. You can change your preferences at any time by clearing your browser cookies, which will re-display the banner. We do not use cookies for targeted advertising.

This approach complies with the Privacy and Electronic Communications Regulations (PECR), which work alongside the UK GDPR to regulate cookies and similar technologies.

11. Children's Privacy

Quotik is not intended for use by children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting the updated policy on this page and updating the "last updated" date.

13. Contact Us

If you have any questions about this privacy policy or wish to exercise your data protection rights, please contact us at privacy@quotik.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.