Privacy Policy

Last updated: 1 September 2026

1. About this policy

Ouitech Ltd (“Ouitech”, “we”, “us” or “our”) provides cloud software for the audio-visual, technology and trade installation sectors. This policy explains how we handle personal information across our websites and our products, and what rights you have.

Our details are:

• Registered name: Ouitech Ltd, trading as WeTech

• Company number: 12576882

• Registered office: Alderley Park Glasshouse, Congleton Road, Nether Alderley, Macclesfield, Cheshire, SK10 4TF, United Kingdom

• VAT number: 374037596

• Contact for privacy enquiries: info@wetech.cloud

This policy applies to:

• our websites, including wequote.cloud and wetech.cloud;

• the WeQuote platform;

• Snagg, our construction defect and field operations app; and

• our sales, marketing, support, billing and business administration activities.

How our privacy documents fit together. This policy is our principal privacy document. Individual products may also have a shorter, product-specific notice that describes what happens in that product and refers back to this policy for the matters that are the same across everything we do. At present there is one such notice, the WeProject Privacy Notice. Where a product notice and this policy differ in relation to that product, the product notice applies.

Information about our employees, workers and job applicants is handled separately and is not covered by this policy.

2. Who this policy is for

This policy is written for four groups of people.

• Visitors and enquirers. People who visit our websites, request a demonstration, download material or contact us.

• Business Customers and their Authorised Users. A Business Customer is a business or organisation that subscribes to one of our products. An Authorised User is an individual the Business Customer permits to access the product. That may include its employees, directors and contractors, and individuals at other organisations, such as subcontractors, whom the Business Customer chooses to invite into its account.

• End Customers. An End Customer is a customer of a Business Customer who receives quotations, project information or invoices through our software, including through the WeProject portal. If you are an End Customer, the WeProject Privacy Notice describes your position in more detail and should be read first.

• Suppliers, partners and advisers. Individuals at organisations we work with commercially.

3. Our role: when we are a controller and when we are a processor

Data protection law distinguishes between a controller, who decides why and how personal information is processed, and a processor, who processes it on a controller’s instructions. We act in both capacities, and which one applies depends on the activity.

• Our websites, marketing and sales activity — controller.

• Creating and administering Business Customer accounts and Authorised User access — controller.

• Authentication, platform security, fraud and abuse prevention — controller.

• Subscription billing, platform fees and collections — controller.

• Technical, log and diagnostic information generated by our systems — controller.

• Support enquiries and correspondence with us — controller.

• Our own business, accounting, audit and legal records — controller.

• Customer Content, the information a Business Customer puts into the software about its own customers, quotations, projects, documents and invoices — processor, acting for the Business Customer.

What this means in practice. Where we act as a processor, the Business Customer decides why it collects information about its customers, what it collects, how long it keeps it and who it shares it with. We process that information to provide the software and on the Business Customer’s instructions, under a written Data Processing Agreement. We do not use it for our own purposes except as that agreement permits.

If you are an End Customer and you want to know why a business holds information about you, or you want that information corrected or deleted, that business is the right organisation to ask. Its own privacy notice will explain. We will help it respond.

4. Information we process

4.1 Visitors and enquirers

• name, business email address, telephone number, company and job title;

• the content of enquiries, demonstration requests and correspondence;

• marketing preferences and engagement, such as whether an email was opened;

• information about your visit, as described in section 15 on cookies.

4.2 Business Customer accounts and Authorised Users

• name, business email address, telephone number, company, job title and role;

• username, account and user identifiers, permissions and access level;

• authentication information, including password hashes, session data and multi-factor authentication settings;

• subscription, plan, module and usage information;

• billing contact details, invoices, payment records for our own fees, and collections correspondence;

• records of configuration and administrative actions taken in the account.

4.3 Customer Content (we act as a processor)

Business Customers use our software to run their own businesses. The information they put into it may include:

• names, contact details, addresses, roles and reference numbers of their customers and contacts;

• quotations and proposals, including products, quantities, pricing, discounts, specifications and notes;

• project records, including status, requirements, milestones, schedules, tasks and approvals;

• documents and files, including specifications, drawings, images, site information, contracts and invoices;

• correspondence and comments exchanged through the software;

• invoices and payment status.

We do not decide what a Business Customer puts into this category. Business Customers are responsible for ensuring they have a lawful basis for the information they upload, and for not uploading more than they need.

Our software is not designed or intended for special category information — such as information about health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic or biometric data, or sexual orientation — or for information about criminal offences. Business Customers should not upload such information, and our contractual terms say so.

4.4 Payments

Where a Business Customer enables payments, its End Customers can pay invoices through the software. The Business Customer connects its own Stripe account, and payments settle directly to that account. We do not receive, hold or control those funds.

• Card and bank details are entered directly into Stripe’s payment fields. We do not receive or store full card numbers.

• We record information about the transaction, which may include the payer’s name and email address, the invoice or quotation reference, the amount and currency, the payment method type, the last four digits of a card, the payment status, the date and time, Stripe’s transaction references, and records of failed payments, refunds and disputes.

• We separately record the platform fee payable to us on a transaction. That record is our own information, held in our capacity as controller, because we use it to account to the Business Customer for our fees.

Section 7 explains this in full.

4.5 Technical, log and security information

When our software and websites are used, our systems automatically generate:

• IP address, device information, browser type and operating system;

• login and authentication events, session information and access times;

• pages and features accessed, and actions performed;

• security events, system logs, error reports and diagnostic information.

IP addresses and similar identifiers are personal information under data protection law, and we treat them accordingly. We link them to account and session records, because that is what makes them useful for security.

4.6 Support and communications

Emails, support tickets, messages, call notes, feedback, enquiries and related correspondence, including any information you choose to include in them.

4.7 Snagg

Snagg is used by a subscribing company and the users it invites to record and manage construction defects and site information. Information processed through Snagg may include:

• names, contact details, roles and employers of the users a Business Customer invites, which may include subcontractors and other individuals outside its own organisation;

• site and project records, defect and snag records, locations, status and history;

• photographs and other images taken on site, which may incidentally show people;

• comments, notes and correspondence exchanged in the app.

Only users the Business Customer invites can access its Snagg account. The Business Customer decides who to invite, including whether to invite individuals from other organisations, and is responsible for those decisions and for telling those individuals how it uses their information. As with the WeQuote platform, the Business Customer is the controller of this information and we act as its processor.

4.8 Suppliers, partners and advisers

Business contact details, correspondence, contracts, and payment and invoicing information.

5. Where information comes from

• From you, when you visit our websites, make an enquiry, create or activate an account, use the software, upload a document, respond to a quotation, make a payment or contact support.

• From a Business Customer, when it creates an account for an Authorised User, or provides information about its own customers in order to use the software. Information about End Customers usually reaches us this way, before that person has any account with us.

• From your use of our software, in the form of the technical and log information described in section 4.5.

• From third parties, in limited circumstances: our service providers; Stripe, in relation to payment outcomes; publicly available business sources and business information providers used for sales prospecting; and our professional advisers.

6. Why we process information, and our lawful bases

The list below applies where we act as a controller. Where we act as a processor, the Business Customer is responsible for identifying its own lawful basis.

• Providing our software and making it available to Business Customers and Authorised Users — account, user, authentication and technical information. Lawful basis: contract.

• Creating and administering accounts, permissions and user access — account and user information. Lawful basis: contract; legitimate interests.

• Charging subscriptions and platform fees, invoicing and collections — account, billing and transaction information. Lawful basis: contract; legal obligation for tax and accounting records.

• Facilitating payments between a Business Customer and its End Customers — transaction and technical information. Lawful basis: contract; legitimate interests in operating the payment feature.

• Authenticating users and protecting accounts — account, authentication, technical and security information. Lawful basis: legitimate interests in keeping the platform and its users secure; legal obligation.

• Detecting, investigating and preventing fraud, abuse and misuse — technical, security, account and transaction information. Lawful basis: legitimate interests; legal obligation.

• Providing support and responding to enquiries — support, account and technical information. Lawful basis: contract; legitimate interests.

• Keeping the service reliable, including monitoring performance, investigating errors and capacity planning — technical, log and diagnostic information. Lawful basis: legitimate interests in maintaining a functioning service.

• Understanding how features are used, and developing and improving our products — technical, log and usage information, preferably aggregated or anonymised. Lawful basis: legitimate interests in improving our products, balanced against the interests of the individuals concerned.

• Marketing our products to businesses and business contacts — contact, marketing preference and engagement information. Lawful basis: legitimate interests, with an opt-out in every message; consent where the law requires it.

• Placing non-essential cookies and similar technologies — as described in section 15. Lawful basis: consent.

• Complying with legal and regulatory obligations — any relevant information. Lawful basis: legal obligation.

• Establishing, exercising or defending legal claims, and enforcing our agreements — any relevant information. Lawful basis: legitimate interests in protecting our legal position; legal obligation.

• Managing a merger, acquisition, investment or sale of the business — any relevant information. Lawful basis: legitimate interests in conducting corporate transactions.

Where we rely on legitimate interests, we consider our interests against the rights, freedoms and reasonable expectations of the individuals concerned, and we record that assessment. You can ask us for a summary of the assessment for any activity listed above.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it.

7. Payments

Payments made through our software work as follows.

• The Business Customer is the merchant. It connects its own Stripe account to our software. When an End Customer pays an invoice, the payment is made to the Business Customer’s Stripe account and settles directly to the Business Customer. Ouitech does not receive, hold or control customer funds, and is not a party to the contract between a Business Customer and its End Customer. We are not a payment services provider.

• Stripe processes the payment. Card and bank details are entered directly into Stripe’s payment fields and are not received or stored by us. Stripe processes payment information as an independent controller for its own purposes, including fraud prevention, anti-money-laundering and sanctions checks, and regulatory reporting. Stripe does not act on our instructions for those purposes. Stripe’s handling of your information is governed by Stripe’s own privacy policy, available at stripe.com/privacy.

• Our platform fee. We charge the Business Customer a platform fee on transactions processed through our software. That fee is collected by Stripe and paid to us. So while the funds paid by an End Customer for an invoice never pass through our hands, our own fee does reach us through Stripe. We hold the fee record as controller, in order to account to the Business Customer.

• Refunds, disputes and chargebacks. Refunds are issued by the Business Customer from its own Stripe account. Chargebacks and payment disputes are between the End Customer, the Business Customer and Stripe. If you have a question about a payment or want a refund, contact the business that issued the invoice. We can help that business locate the transaction record but we cannot reverse a payment.

8. Service reliability, analytics and product development

We use technical, log and usage information to keep the service working and to make it better: identifying and fixing errors, monitoring performance and capacity, understanding which features are used and how, and deciding what to build next.

Three limits apply.

• We prefer aggregated and anonymised information. Where a purpose can be achieved with information that no longer identifies anyone, we use that instead. Genuinely anonymised information is not personal information and this policy does not restrict our use of it.

• Customer Content is treated differently. Information a Business Customer puts into the software about its own customers and projects is not used to develop or improve our products except where the Data Processing Agreement with that Business Customer expressly permits it, or where the information has been anonymised in accordance with that agreement. This is a contractual commitment, not just a statement of intent.

• Support access is limited. Our personnel access Customer Content only where necessary to provide support, investigate a fault, maintain security or comply with a legal obligation. Access is controlled by role-based permissions and is logged.

9. Artificial intelligence and automated decision-making

Automated decision-making. We do not make decisions about you by automated means alone where those decisions have a legal effect on you or otherwise significantly affect you.

AI features. Our software does not currently include features that use artificial intelligence or machine learning. If we introduce them, the following will apply:

• the feature is described in the product, and its use is controlled by the Business Customer;

• output produced by an AI feature is a suggestion, not a decision, and should be reviewed by a person before it is relied on;

• we do not use Customer Content to train general-purpose or third-party AI models unless the relevant Business Customer has expressly agreed to that in writing under its Data Processing Agreement;

• where an AI feature is provided using a third-party model provider, that provider is engaged as a sub-processor and is listed in our sub-processor list.

10. How we share information

• The relevant Business Customer and its Authorised Users. Information submitted or generated through our software is available to the Business Customer whose account it belongs to, and to the users it authorises. This includes records of actions taken in the software, such as when a quotation was viewed, responded to or approved.

• Service providers acting as our sub-processors. We use third parties to help operate our software, covering cloud hosting and infrastructure, databases, authentication, security, email delivery, monitoring, analytics, customer support tooling and backups. They act on our instructions under written contracts that impose confidentiality and security obligations and restrict what they may do with the information. Our current sub-processors are listed at wequote.cloud/sub-processors — see Annex C.

• Stripe. As described in section 7, Stripe acts as an independent controller in relation to payment information, not as our sub-processor.

• Accounting and other integrations the customer connects. A Business Customer can connect its WeQuote account to its own third-party services, such as Xero or QuickBooks Online. Where it does, information is transferred to that service on the Business Customer’s instruction and to an account the Business Customer controls. Those providers act for the Business Customer, not for us, and are not our sub-processors. The Business Customer’s agreement with that provider governs what happens to the information once it arrives.

• Professional advisers. Lawyers, accountants, auditors, insurers and similar advisers, where reasonably necessary.

• Public authorities. Courts, regulators, law enforcement and other authorities, where required or permitted by law.

• Corporate transactions. Where reasonably necessary in connection with a merger, acquisition, restructuring, investment or sale of all or part of our business, subject to appropriate confidentiality arrangements.

11. We do not sell personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising or targeted advertising.

To be specific, and using the meanings given to these terms by United States state privacy laws:

• we do not disclose personal information to a third party for monetary or other valuable consideration;

• we do not disclose personal information for cross-context behavioural advertising, whether or not for payment;

• we do not permit our service providers to use information they process for us for their own purposes, including their own advertising or model development, and our contracts with them say so;

• we do not use or disclose sensitive personal information for the purpose of inferring characteristics about anyone.

We do not serve third-party advertising in our software.

12. International transfers

We are based in the United Kingdom, and the WeQuote platform is hosted in the United Kingdom, on Amazon Web Services infrastructure in the London region. Backups are also held in the United Kingdom.

Some of the supporting services we use may process information outside the United Kingdom. Where that is the case, the country is identified against the relevant provider in our sub-processor list.

Where information protected by UK or EU data protection law is transferred to a country that is not covered by adequacy regulations, we put in place a lawful transfer mechanism. Depending on the circumstances this may be:

• UK adequacy regulations, or an EU adequacy decision;

• the UK International Data Transfer Agreement;

• the UK Addendum to the European Commission’s standard contractual clauses;

• the European Commission’s standard contractual clauses; or

• another lawful transfer mechanism.

We also apply technical and organisational safeguards, such as encryption in transit, access controls and contractual restrictions on onward transfer. You can ask us for information about the mechanism applying to a particular transfer.

13. How long we keep information

We keep personal information only for as long as we need it. The periods below are our standard retention periods. They may be shorter or longer in an individual case where the law requires it, where information is needed for a legal claim, or where a Business Customer has instructed otherwise in relation to Customer Content.

• Website enquiry and demonstration request records — 24 months from the last contact.

• Marketing contact records — until you object or unsubscribe, then a suppression record only.

• Business Customer account and Authorised User records — for the term of the subscription, then 6 years.

• Customer Content — for the term of the subscription. Deleted or returned within 30 days of the end of the subscription, unless the Business Customer instructs otherwise or the law requires us to keep it.

• Quotation, approval and acceptance records — for the term of the subscription, then 6 years, because these records evidence commercial transactions.

• Payment and platform fee records — 6 years from the end of the relevant tax year.

• Invoices, accounting and tax records — 6 years from the end of the relevant tax year.

• Support tickets and correspondence — 36 months from closure.

• Security event and audit logs — 12 months.

• System, application and error logs — 90 days.

• Website analytics information — 14 months.

• Backups — overwritten within 7 days.

Backups. After information is deleted from our live systems it may remain in backups until those backups are overwritten or expire in the ordinary cycle. We do not restore backups in order to reinstate deleted information except where we are required to.

14. Security

We use technical and organisational measures designed to protect personal information. Depending on the system, these include:

• access controls and role-based permissions, applied on the principle of least privilege;

• account authentication, including support for multi-factor authentication;

• encryption of information both in transit and at rest;

• infrastructure and network security controls;

• system monitoring, security logging and alerting;

• regular backups;

• vulnerability management and patching;

• documented incident response procedures;

• confidentiality obligations and security training for our personnel;

• security requirements in our contracts with sub-processors.

Access to Customer Content by our personnel is restricted to those who need it, and is logged.

Security incidents. If a personal data breach affects Customer Content, we notify the affected Business Customer without undue delay, in accordance with our Data Processing Agreement, and support it in meeting its own notification obligations. Where we are the controller, we notify the Information Commissioner’s Office and affected individuals where the law requires.

No system connected to the internet can be guaranteed to be completely secure. You are responsible for keeping your password and login credentials confidential and for the security of the devices you use.

15. Cookies and similar technologies

A cookie is a small file placed on your device when you visit a website. We use cookies on our websites, and a small number inside our software.

• Strictly necessary cookies. These are needed for the service to work — signing you in, keeping your session active, remembering your choices within a session, and protecting against attacks. They do not require your consent, and the service will not work properly without them.

• Analytics cookies. We use Google Analytics on our websites to understand how many people visit and which pages they use. These cookies are set only if you consent. Google Analytics involves information being processed by Google, and section 12 and our sub-processor list explain how that is handled.

• Advertising cookies. We do not use advertising or cross-site tracking cookies, and we do not serve third-party advertising on our websites or in our software.

• Cookies in our software. The WeQuote platform and the WeProject portal use only strictly necessary cookies. We do not run analytics or advertising cookies inside them.

Your choices. When you first visit one of our websites, we ask whether you accept cookies that are not strictly necessary. You can change your choice at any time, and withdrawing your consent is as easy as giving it. Our cookie settings also list the specific cookies in each category and how long each one lasts.

You can also control cookies through your browser settings, though blocking strictly necessary cookies will stop the service working.

16. Your rights

Where we act as a controller, you have the following rights in relation to your personal information.

• Access — to be told whether we hold information about you and to receive a copy of it.

• Rectification — to have inaccurate information corrected and incomplete information completed.

• Erasure — to have information deleted, where there is no good reason for us to continue holding it.

• Restriction — to ask us to limit how we use your information in certain circumstances, for example while we check whether it is accurate.

• Objection — to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing, which we will always stop.

• Portability — to receive information you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another organisation, where processing is based on consent or contract and is carried out by automated means.

• Withdrawal of consent — to withdraw consent at any time where we rely on it.

• Not to be subject to solely automated decisions that have a legal or similarly significant effect on you. As set out in section 9, we do not make such decisions.

How to exercise a right. Contact us using the details in section 19. We may need to verify your identity before we act, and we will ask only for information reasonably necessary to do that. We respond within one month. If your request is complex, or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

If we are a processor. If your information is Customer Content, the Business Customer is the controller and you should direct your request to it. If you contact us instead, we will tell you promptly and, where we can identify the relevant Business Customer, pass the request to it. We are not permitted to act on the request ourselves without that Business Customer’s instruction.

Complaints. If you are unhappy with how we have handled your information, please tell us first — we would rather fix it. You also have the right to complain to a data protection regulator. Annex A explains how.

Residents of certain United States states have additional or differently framed rights. Annex B explains those.

17. Children

Our software is a business tool. It is not directed at children and is not intended for use by anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

18. Changes to this policy

We update this policy when our processing changes, or when the law does. The date at the top shows when it was last changed.

Where a change materially affects how we use your personal information or your rights, we will give notice before it takes effect — by email to Business Customer account contacts, by notice in the software, or by a prominent notice on our website, as appropriate. Previous versions are available on request.

19. How to contact us

For any privacy question, or to exercise a right:

• info@wetech.cloud

• Ouitech Ltd, Alderley Park Glasshouse, Congleton Road, Nether Alderley, Macclesfield, Cheshire, SK10 4TF, United Kingdom

We have not appointed a statutory Data Protection Officer, as we are not required to. Responsibility for data protection at Ouitech Ltd rests with Jennie Cave, Director.

Annex A — United Kingdom and European Union

United Kingdom. Where UK data protection law applies, our processing is governed by the UK GDPR and the Data Protection Act 2018.

You can complain to the Information Commissioner’s Office:

• Website: ico.org.uk

• Helpline: 0303 123 1113

• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

European Union. Where we process information about people in the European Union in connection with offering our services to them, EU GDPR applies in addition.

You can complain to the supervisory authority in the EU or EEA country where you live or work, or where the issue arose.

Annex B — United States

This annex applies to residents of United States states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas and others as they take effect.

Our role. Where we process information on behalf of a Business Customer, we act as a service provider or processor under those laws, and the Business Customer is the business or controller. We use that information only to provide the service and for the limited purposes those laws permit, and not for our own commercial purposes.

Categories of information. Sections 4 and 5 describe the categories of personal information we collect and their sources. Section 6 describes the purposes. Section 10 describes the categories of recipient.

Sale and sharing. As set out in section 11, we do not sell personal information and we do not share it for cross-context behavioural advertising.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes beyond those permitted without an option to limit, and we do not use it to infer characteristics.

Your rights. Subject to your state’s law, you may have the right to:

• know what personal information we have collected, the sources, the purposes and the recipients;

• access a copy of your personal information, in a portable format where technically feasible;

• correct inaccurate personal information;

• delete personal information;

• opt out of sale, sharing or targeted advertising — we do not carry out these activities;

• limit the use of sensitive personal information;

• not be discriminated against for exercising a right; and

• appeal a refusal.

How to exercise a right. Contact us at info@wetech.cloud. We will verify your identity before acting. We respond within 45 days, and may extend by a further 45 days where reasonably necessary, telling you if we do.

Authorised agents. You may use an authorised agent. We will ask for proof of the agent’s authority and may ask you to confirm it directly.

Appeals. If we refuse your request, you may appeal by writing to the same address, marked for the attention of a privacy appeal. We will respond within 45 days, explaining our decision and how to contact your state Attorney General if you remain dissatisfied.

Requests concerning a Business Customer’s information. If your request concerns information a business holds about you in our software, direct it to that business. Section 16 explains why.

Annex C — Sub-processors

We use a small number of third-party providers to operate our software. The current list, showing each provider, what it does and where it processes information, is published at wequote.cloud/sub-processors.

At the date of this policy those providers are:

• Amazon Web Services — cloud hosting, database, storage and backups for the WeQuote platform, the WeProject portal and Snagg. Processed in the United Kingdom (London region).

• Amazon Web Services (Amazon SES) — sending emails from our software, such as invitations, notifications and password resets. Processed in the United Kingdom.

• Google (Google Analytics) — measuring visits to our websites. Not used inside the WeQuote platform, the WeProject portal or Snagg. Processed in the European Union and United States.

• Google (Google Workspace) — hosting our business email and shared files, including support correspondence. Processed in the European Union and United States.

We give Business Customers at least 30 days’ notice before a new or replacement sub-processor begins processing their data, so that they have an opportunity to object.

Not sub-processors. Stripe acts as an independent controller in relation to payment information, as explained in section 7. Accounting and other services a Business Customer connects to its own account, such as Xero or QuickBooks Online, act for that Business Customer rather than for us, as explained in section 10.