Scanlotz Cloud

Data Processing Addendum

Last updated August 2026 · applies to Scanlotz Cloud and everything served from https://scanlotz.quickbidz.com.

1. Roles

This addendum forms part of the Terms of Service and applies whenever we process personal data on your behalf. For data inside your workspace — your staff records, operator names, customer contacts — you are the controller and we are the processor. For your own account and billing records we are the controller, and our Privacy Policy applies.

2. Scope of processing

  • Subject matter — providing warehouse scanning, inventory, pricing and reporting.
  • Duration — the life of your subscription, plus the 30-day export window.
  • Categories of data subject — your employees and contractors, and any business contacts you record.
  • Categories of data — names, work contact details, login credentials in hashed form, device assignments, and activity records.

3. Our obligations

We process personal data only on your documented instructions, which the Service itself expresses; we keep it confidential and bind our staff to confidentiality; we apply the technical and organisational measures described below; and we assist you with data subject requests, breach notification and impact assessments to the extent you reasonably need.

4. Technical and organisational measures

  • One database file per customer — isolation enforced by the storage boundary, not by a query filter.
  • Credentials stored as hashes; plaintext keys shown exactly once and never logged.
  • Role-based access that fails closed, with account lockout on repeated failed sign-ins.
  • Encryption in transit; secrets encrypted at rest with keys held separately from the data.
  • Support access only under a time-boxed grant with a recorded reason, visible to you in your own console and audit log.
  • Per-customer backups, restorable individually, with integrity checksums.

5. Subprocessors

You authorise us to engage subprocessors for hosting, email delivery, payment processing, and the data sources behind product identification and retail pricing. Each is bound to obligations no less protective than these. Our current list is available on request; we give notice of additions and you may object on reasonable data-protection grounds.

6. International transfers

Data is hosted in the United States. Where a transfer requires a lawful mechanism, we rely on the applicable standard contractual clauses, which are incorporated here by reference.

7. Personal data breach

We notify you without undue delay, and in any case within 72 hours of becoming aware of a breach affecting your data, with what we know about the scope, the likely consequences and what we are doing about it. We keep updating you as we learn more rather than waiting until the picture is complete.

8. Return and deletion

You may export your workspace at any time while your account is live and for 30 days after cancellation. After that we delete the workspace database and its files, including from backups on their normal rotation, and will confirm deletion in writing on request.

9. Audit

On reasonable notice, and no more than once a year unless a regulator requires otherwise, we will answer a written security questionnaire and provide the information you need to verify our compliance with this addendum.

10. Contact

Data protection matters: support@quicklotz.com.

This page is a plain-English statement of how we operate. If you need a countersigned copy or your own paper, write to support@quicklotz.com.