Data Processing Addendum
This Addendum forms part of the Terms of Service between you (“Contractor”) and [[COMPANY]] (“CoatEngine”). It applies whenever you use the Service to process personal data about someone other than yourself. If the Terms and this Addendum conflict on data protection, this Addendum governs.
Why this exists. When you enter your customer's name, phone, email and address, or your worker's name and pay rate, you are handing us personal data about a person who has no relationship with us and never agreed to anything. This document sets out who is answerable for that data and what we will and will not do with it.
1. Roles
You are the controller. We are the processor. You decide what personal data to enter about your End Clients and workers, why, and for how long. We process it only to provide the Service to you.
For your own account data — your name, your email, your billing record — we are the controller, and our Privacy Policy governs.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Providing painting estimation and quoting software |
| Duration | For as long as you hold an account, plus any retention described in Section 8 |
| Nature and purpose | Storing, organising, calculating on, rendering into documents, and transmitting the data you enter |
| Categories of data subject | Your End Clients; your workers and subcontractors; anyone you invite as a team sub-account |
| Categories of personal data | Names, email addresses, phone numbers, postal and job-site addresses, pay rates, quote view and response records including IP address |
| Special category data | None. The Service has no field for it and you must not enter any |
3. Your obligations
You warrant that:
- you have a lawful basis to collect the personal data you enter and to have us process it;
- you have given the required privacy notices to the people it concerns;
- your instructions to us will not cause either of us to break the law;
- you will not enter special category data, government identifiers, financial account numbers, health information, or data about children;
- you will send a quote link only to the End Client it concerns, and treat it as confidential.
4. Our obligations
We will:
- process personal data only on your documented instructions — your use of the Service being the primary instruction — unless the law requires otherwise, in which case we will tell you first unless prohibited;
- never sell it, never use it for advertising, and never use it to train machine learning models;
- not use it for our own purposes, beyond generating aggregate, non-identifying operational statistics;
- ensure everyone we authorise to access it is bound by confidentiality;
- maintain the security measures described in Section 6;
- assist you, so far as we reasonably can, with data subject requests, breach notifications, and impact assessments.
5. Subprocessors
You authorise us to use these subprocessors:
| Subprocessor | Purpose | Location |
|---|---|---|
| Hostinger | Server hosting and outbound email | [[HOSTING_REGION]] |
| Stripe, Inc. | Subscription billing and payment links | United States |
| Google LLC | Web font delivery (receives visitor IP addresses only) | United States |
We remain responsible for our subprocessors' performance. We will update this list before adding one, and you may object on reasonable data protection grounds; if we cannot resolve your objection, you may cancel your subscription without penalty for the remainder of the term.
6. Security measures
We maintain the measures described in our Privacy Policy, which at the date of this Addendum include: encryption in transit; hashed passwords; per-account data isolation enforced by automated test; rate limiting on authentication and document generation; an unprivileged containerised runtime under a memory limit; a document renderer with no outbound network access; cryptographic verification of payment webhooks; and regular dependency vulnerability scanning.
We review these measures and may change them, provided we do not materially reduce the level of protection.
7. Data subject requests and breaches
Requests. If an End Client or worker contacts us directly, we will not answer on your behalf. We will tell them to contact you and, where we can identify your account, forward the request to you. Most requests you can satisfy yourself in the application, since you can view, edit and delete these records directly.
Breaches. We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data, with the information we have at the time, and will keep you updated as we learn more. Notifying the people affected and any regulator is your responsibility as controller.
8. Deletion and return
You can delete client, worker, project and quote records yourself at any time, and deletion is immediate in the live system.
On termination, your data is retained rather than deleted, so that you can resubscribe. To have it erased, email support@coatengine.com from the address on your account. We will delete it within 30 days, except for what the law requires us to keep and copies in backups, which are overwritten on their normal 30-day cycle. Export anything you need first; deletion is irreversible.
9. International transfers
The Service is operated from the United States and data is stored there. If you are subject to a law restricting international transfers, you are responsible for determining whether your use of the Service is permitted, and for putting any required transfer mechanism in place with us before you enter data governed by it.
10. Audit
On reasonable written request, no more than once a year, we will provide the information reasonably necessary to demonstrate our compliance with this Addendum. Where an on-site inspection is legally required, the parties will agree its scope, timing and cost in advance, and it must not compromise the confidentiality or security of other customers' data.
11. Liability
Liability under this Addendum is subject to the limitations and exclusions in the Terms of Service.
Contact
[[COMPANY]]
[[ADDRESS]]
support@coatengine.com
Terms of Service · Privacy Policy · Data Processing Addendum