Data Processing Agreement

Last updated: 21 September 2026 · v3.0

1. About this agreement

This Data Processing Agreement ("DPA") governs the processing of personal data by AirQuote on behalf of the company using the platform, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018.

The DPA forms an integral part of the Terms of Service and is concluded automatically between the parties at the moment the company's representative accepts the Terms and creates the account. It applies whenever the company uploads to the platform data that may contain personal data (for example aerial images of a property or the end customer's details).

2. Parties and roles

  • Controller – the company using the platform (the account holder). The company determines the purposes and means of the processing (for example measuring a roof in order to prepare a quote) and is responsible for the legal basis on which the data is collected.
  • Processor – SC CC Digital Solutions SRL, registered office: str. Pădurii nr. 6, Sat Drăgoiești, Comuna Drăgoiești, Suceava County, Romania; Trade Register no. J2025011387003; tax identification number (CUI) 51307493; email contact@airquote.ro ("AirQuote"), which operates the platform at airquote.ro, airquote.eu, app.airquote.ro and app.airquote.eu and processes the data exclusively on behalf of and on the documented instructions of the Controller.

3. Subject matter, nature and purpose of the processing

AirQuote processes the data provided by the Controller exclusively in order to deliver the service: photogrammetric processing of images, generation of 3D models and point clouds, measurement tools, bill of materials calculation, quote generation — together with the related storage and technical support.

The duration of the processing corresponds to the term of the contract (the active subscription) and the retention periods described in the Privacy Policy: project data (images, 3D models, measurements, the signed homeowner consent) is kept for 24 months from creation while the subscription is active, and for 90 days after cancellation.

4. Categories of data and data subjects

Categories of data subjects: the Controller's end customers (the homeowners of the properties measured) and, where applicable, their representatives.

Categories of data: name, phone number, property address, GPS coordinates, signature, aerial images of the property and the resulting 3D models, as well as any other data the Controller chooses to upload.

5. Obligations of AirQuote (the processor)

In accordance with Article 28(3) GDPR, AirQuote:

  • processes the data only on the documented instructions of the Controller (including this DPA and the use of the platform), including with regard to transfers to third countries, unless required to do otherwise by EU or member state law to which AirQuote is subject; if AirQuote considers that an instruction infringes the GDPR or other EU or member state data protection law, it informs the Controller immediately;
  • ensures that the persons authorized to process the data have committed themselves to confidentiality;
  • implements appropriate technical and organizational security measures (Article 32) — see section 8;
  • complies with the conditions for engaging sub-processors (section 6);
  • assists the Controller, as far as possible, in responding to data subject requests (access, rectification, erasure, objection, etc.);
  • assists the Controller in ensuring compliance with its obligations regarding security, breach notification and data protection impact assessments (DPIA);
  • upon termination of the service, deletes or returns the data in accordance with section 11;
  • makes available to the Controller the information necessary to demonstrate compliance with its obligations and allows for reasonable audits (section 7);
  • does not use the data for its own purposes — in particular, it does not use the images to train its own AI models.

6. Sub-processors

The Controller authorizes AirQuote to use sub-processors in order to deliver the service. AirQuote engages each sub-processor under written terms that bind it to data protection obligations, and remains liable to the Controller for the performance of the sub-processor's obligations. The current sub-processors and recipients are:

  • Supabase (US company, data in the EU – Frankfurt) – database and authentication
  • Cloudflare R2 (data in the EU – Eastern Europe) – storage of images and processed results, CDN
  • Vercel (functions in the EU – Frankfurt) – hosting of the website and the application
  • Railway (EU – Amsterdam) – photogrammetry processing servers
  • WebODM Lightning, operated by UAV4GEO (US) – backup photogrammetry processing, used only when AirQuote's own capacity is busy; the images are transmitted for processing and are not retained by the provider after completion; the transfer outside the EEA takes place under the provider's terms
  • Resend (US) – transactional emails (confirmations, subscription notifications)
  • Stripe (US/Ireland) – payment processing; Stripe acts as an independent controller for card data, and AirQuote does not store card data
  • Meta Platforms (Ireland/US) – Meta Pixel on the marketing website and at sign-up, only with consent, for ad measurement

AirQuote will inform the Controller in advance of any intended addition or replacement of a sub-processor, giving the Controller the opportunity to object on reasonable, documented grounds. The up-to-date list of sub-processors is also published in the Privacy Policy.

7. Audits and demonstrating compliance

Upon the Controller's reasonable written request, AirQuote makes available the information necessary to demonstrate compliance with the obligations set out in this DPA and contributes to audits, including inspections, conducted by the Controller or by an auditor mandated by the Controller, within reasonable limits and without affecting the security of other customers' data.

8. Security

AirQuote applies appropriate technical and organizational measures, including: encryption in transit (HTTPS/TLS), token-based authentication (JWT), role-based access control and separation of data between companies, passwords stored securely (bcrypt, through Supabase Auth), payments processed through Stripe (PCI DSS Level 1) and restricted access to project files. AirQuote does not store card data.

9. Data location and international transfers

The data is stored and processed in the European Union: the database and authentication (Supabase) in Frankfurt, files (Cloudflare R2) in Eastern Europe, the processing servers (Railway) in Amsterdam and the hosting of the applications (Vercel) in Frankfurt.

Some sub-processors may process data outside the European Economic Area: Stripe, Resend, Google and Meta — on the basis of the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework where the provider is certified; WebODM Lightning — under the provider's terms, as described in section 6.

10. Breach notification

In the event of a personal data breach affecting the Controller's data, AirQuote notifies the Controller without undue delay after becoming aware of it and provides the relevant information to enable the Controller to meet its notification obligations under Articles 33 and 34 GDPR towards the competent supervisory authority (in Romania, the ANSPDCP – www.dataprotection.ro – or the supervisory authority of the EU member state where the Controller is established) and, where applicable, towards the data subjects.

11. Termination and deletion of data

Upon termination of the service, AirQuote deletes or, at the Controller's choice, returns the personal data, in accordance with the retention periods set out in the Privacy Policy: the Controller can export its projects and data from the platform within 90 days of termination, after which the data is deleted, unless the law requires it to be kept (for example invoices and accounting records, which are kept for 10 years).

12. Final provisions

This DPA supplements the Terms of Service. In the event of any inconsistency regarding the processing of personal data, the provisions of this DPA prevail. Material changes to this DPA are communicated by email at least 30 days before they take effect; continued use of the service after that date constitutes acceptance.

This DPA is governed by Romanian law. The parties will first seek to resolve any dispute amicably; failing that, the dispute is submitted to the competent courts at AirQuote's registered office (Suceava, Romania).

This DPA is available in Romanian and English. For contracts concluded through airquote.ro the Romanian version prevails; for contracts concluded through airquote.eu the English version prevails.

Contact

For any matter related to data processing: contact@airquote.ro. AirQuote has not appointed a data protection officer; requests are handled directly by the company.