Data processing agreement

Your practice is the controller of the personal data it stores in QuickManager about its clients and staff. QuickManager is the processor: we process that data only to provide the service, and only on your documented instructions, which are these terms and the way you use the app.

Client details (such as names, contact details, tax references, dates of birth and National Insurance numbers), client documents, supplier logins, tasks, notes and time records, and your staff's names and email addresses. We process it for as long as your practice has an account.

• Keep your data confidential, and make sure anyone with access is bound by confidentiality.
• Keep each practice's data separate, encrypt connections, and encrypt National Insurance numbers and stored passwords. Only your admins can reveal those, and every reveal is logged.
• Not look at your client data except where you ask us to, or where the law requires it.
• Help you respond to requests from people exercising their data rights, and with security and impact assessments.
• Tell you without undue delay, and within 48 hours where possible, if we become aware of a personal data breach.
• Delete or return your data when your account ends, unless the law requires us to keep it.
• Give you the information you reasonably need to show you're meeting your own obligations.

You authorise us to use the following sub-processors. We'll give you notice before adding or replacing one, so you can object.

Your client data is stored in Ireland, which the UK recognises as adequate. Where a sub-processor handles data outside the UK or EU (for example Anthropic, if you use the assistant), we rely on the UK's adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Addendum.