QuoteNod Data Breach Policy (v2026-10-01)

QuoteNod Ltd is a company registered in England and Wales, company number 17446525, registered office 124 City Road, London, EC1V 2NX, and registered with the Information Commissioner's Office (ICO) under reference ZC242574. This policy sets out what we do when data is lost, exposed or damaged, and what a trader using QuoteNod must do if it happens to them. It is written for the UK GDPR and the Data Protection Act 2018.

1. Introduction

A data breach is serious whether or not it involves personal data, and whether it is suspected or confirmed. Handled quickly it can often be contained; handled slowly it rarely can. This policy exists so that everybody knows, in advance, who to tell, what to do first, who needs to be notified, and how we stop it happening again.

Who holds what. For trader accounts — email, password, business details, billing — QuoteNod is the controller. For the details traders enter about their own customers — names, contact details, addresses, signatures, quotes and payments — the trader is the controller and QuoteNod is their processor. Both roles carry duties when something goes wrong, and this policy covers both.

2. Scope of policy

This policy applies to all data QuoteNod holds or processes, in any form: in the QuoteNod service and its database, in stored documents and signatures, in email, on any device or paper used to run the business, and in the hands of our sub-processors. It applies to everybody who works on QuoteNod, whether employed, contracted or volunteering, and it sets out what every trader who uses QuoteNod must do (section 4).

3. Data breaches

A data breach is any event that leads to data being lost, destroyed, altered, disclosed or accessed without authority, or made unavailable when it should be available — whether by accident or on purpose. A personal data breach is one that involves personal data. Examples include:

- the loss or theft of data, or of a phone, laptop, memory stick or paper records holding it;
- somebody getting into an account or a system they should not — including by guessing, stealing or tricking somebody out of a password;
- data sent to the wrong person, or a document or link shared with the wrong customer;
- data changed or deleted without authority, or by mistake;
- a system failure, fire, flood or power loss that leaves data unavailable or damaged;
- malicious software, or an attack on the service;
- human error of any kind that exposes data.

If you are not sure whether something is a breach, treat it as one and report it.

4. Internal reporting

Within QuoteNod. Anybody working on QuoteNod who suspects or discovers a breach reports it straight away to the director of QuoteNod Ltd responsible for data protection, who leads the response. Reporting is expected, never punished; delaying or hiding a breach is what does the damage.

If you are a trader and you have a data breach — what you must do. If you suspect or discover a breach that involves your QuoteNod account or anything in it — for example somebody else has signed in to your account, a phone or laptop signed in to QuoteNod has been lost or stolen, you have sent a customer's documents to the wrong person, or you have been tricked into giving out your password or a code — you must:

- Tell QuoteNod immediately by email to contact@quotenod.co.uk with the subject DATA BREACH — [your QuoteNod User ID] (for example: DATA BREACH — #3422). Your User ID is shown on your Account page. Do not wait until you have all the facts: send what you know now and follow up.
- Say in your email: what happened; when it happened and when you found out; which customers, quotes or documents may be affected, and roughly how many; what you have done about it so far; and a telephone number we can reach you on.
- Contain it at once: change your QuoteNod password, turn on two-factor authentication, sign out of any device you no longer control, and remove access from anybody who should not have it. If a device or records were stolen, report it to the police and keep the crime reference.
- Keep the evidence: do not delete emails, messages or records connected with the breach.
- Meet your own duties as controller. You are responsible for deciding whether your customers' data breach must be reported to the ICO — within 72 hours of becoming aware of it where it is likely to put people at risk — and whether the customers themselves must be told. We will give you the information and help you need to decide, and to do it.
- Work with us while it is investigated, and tell us if you learn anything new.

If the breach is ours. If a breach at QuoteNod affects your customers' data, we will tell you without undue delay, and in any event within 48 hours of confirming it — our aim is 24 — with what happened, what data and which customers are affected, what we have done, and what we recommend you do, so that you can meet your own duties.

5. Initial management and recording

As soon as a breach is reported, the person leading the response:

- contains it — stops any continuing loss or access, for example by revoking sessions, resetting credentials, taking a system offline or recalling misdirected information;
- establishes the facts — what happened, when, how it was found, and what data and systems are involved;
- recovers what can be recovered, from backups or by other means;
- considers who must be told at once — including the police where equipment or records have been stolen or a crime is suspected, and the trader concerned where their customers' data is involved;
- records it in QuoteNod's Data Breach Register from the first report, and keeps that record up to date through every later step.

6. Investigation and assessment

Once it is contained, the breach is investigated and its risk assessed, promptly and in more depth:

- what data is involved, and how sensitive it is — signatures, addresses, payment records and anything in a special category carry greater risk;
- how much data, how many records, and how many people are affected, and who they are — traders, their customers, or others;
- whether the data was protected, for example encrypted, and whether it can be recovered or has been;
- what has happened, or could happen, to the people affected — identity fraud, financial loss, distress, damage to reputation, loss of confidentiality — and how likely and how serious that is;
- what caused the breach, and whether the cause has been removed.

The findings, and the reasoning behind each conclusion, are written into the Data Breach Register.

7. Notification

The ICO. Where QuoteNod is the controller and a personal data breach is likely to result in a risk to people's rights and freedoms, we report it to the ICO within 72 hours of becoming aware of it. If we do not yet have every detail, we report what we know and add the rest as we learn it.

The people affected. Where the risk to them is high, we tell the people affected directly and without undue delay, in plain language: what happened, what it means for them, what we have done, what they can do to protect themselves, and who to contact.

Traders. Where QuoteNod is the processor, we tell the trader — the controller — without undue delay and within 48 hours of confirming the breach, and give them what they need to report to the ICO and to tell their customers where they must.

Others. Where it would help limit the harm, we may also tell the police, banks or card issuers, Stripe or GoCardless, our insurers, or other organisations involved.

When nobody needs to be told. Some breaches do not have to be reported to anybody — for example where the data was securely encrypted and the key was not affected. A decision not to notify is always recorded in the Data Breach Register, with the reasons. When in doubt, we notify, and take advice from the ICO or a data protection lawyer.

8. Evaluation and response

Once the breach is resolved and everybody who needed to be told has been, we review it: what caused it, how well the response worked, and what would stop it happening again. That can mean changes to the service, to security settings, to how access is given and removed, to our sub-processors, to training, or to this policy. The review, the actions agreed and who is responsible for each are recorded in the Data Breach Register and followed through.

9. Policy review and implementation

This policy is owned by the director of QuoteNod Ltd responsible for data protection. It takes effect on 1 October 2026, is reviewed at least once a year and after every significant breach, and is published here so that traders can see it at any time. Related documents: the Privacy Notice, the Terms of Service (section 18), the Sub-processors list and the GDPR page.

Questions about this policy: contact@quotenod.co.uk. To report a breach, use the subject line in section 4.