The list of providers that process data on behalf of Quot, where the processing takes place and with what safeguards. Up to date and transparent.
Last updated: 16 July 2026 · version v2026-07-16
Quot is the brand under which Donzella di Thomas Donzella (hereinafter also "the Provider"), with registered office at Via S. Francesco D'Assisi 47E, 20073 Opera (MI), P.IVA IT02865930180, provides the app.quotlab.com application in SaaS mode. Quot is a Lyreth product.
To provide the service, the Provider uses certain external providers which, within the limits of their respective services, process personal data on behalf of the Customer as sub-processors pursuant to Article 28(4) of the GDPR.
By accepting the Data Processing Agreement (DPA), the Customer grants general authorisation for the use of the sub-processors listed in the table below. The Provider will inform the Customer, at least 30 days in advance, of any intention to add or replace a sub-processor, so that the Customer can assess the change. Within that period the Customer may object on legitimate and reasonable grounds to the new appointment, by writing to info@quotlab.com.
| Sub-processor | Service | Location of processing | Transfer outside the EU and safeguards | Provider's privacy policy / DPA |
|---|---|---|---|---|
| SiteGround (SiteGround Spain S.L.) |
Hosting of the site and the application, email | European Union | No. Processing takes place on infrastructure located in the European Union. | siteground.com/privacy.htm |
| Stripe (Stripe Payments Europe Ltd.) |
Payments and subscription management | European Union and United States | Yes. Safeguards: EU-US Data Privacy Framework and Standard Contractual Clauses (SCC) of the European Commission. | stripe.com/legal/dpa |
| OpenAPI (OpenAPI S.r.l.) |
Verification of the VAT number and business activity during registration (signup) | Italy | No. Processing takes place in Italy. | openapi.com/privacy-policy |
| Fatture in Cloud (TeamSystem S.p.A.) |
Electronic invoicing | Italy and European Union | No. Processing takes place in Italy and in the European Union. | fattureincloud.it/privacy-policy |
| Cloudflare (Cloudflare, Inc.) |
Anti-bot protection of public forms (Cloudflare Turnstile): verifies that the registration and contact forms are filled in by a person and not by automated software | European Union and United States | Yes. Safeguards: EU-US Data Privacy Framework and Standard Contractual Clauses (SCC) of the European Commission. Turnstile does not use profiling cookies and does not track users across different sites. | cloudflare.com/cloudflare-customer-dpa |
| Plausible (Plausible Insights OÜ) |
Aggregated, cookie-free site traffic statistics (Plausible Analytics) | European Union | No. The data are hosted on servers located in the European Union. Plausible does not use cookies, does not profile visitors and collects only aggregated data. | plausible.io/dpa |
| Apple (Apple Distribution International Ltd.) |
Delivery of push notifications on the iPhone app (Apple Push Notification service, APNs) | European Union and United States | Yes. Safeguards: EU-US Data Privacy Framework and Standard Contractual Clauses (SCC). Only the device token is processed in order to deliver the notification, without the content of the quotes. | apple.com/legal/privacy |
| Google (Google Ireland Ltd., Firebase Cloud Messaging) |
Delivery of push notifications on the Android app (Firebase Cloud Messaging, FCM) | European Union and United States | Yes. Safeguards: EU-US Data Privacy Framework and Standard Contractual Clauses (SCC). Only the device token is processed in order to deliver the notification. | firebase.google.com/support/privacy |
| Anthropic (Anthropic PBC) |
Virtual assistant (chatbot "Lea") on the website: processing of chat messages to generate the reply | United States | Yes. Safeguards: Standard Contractual Clauses (SCC) of the European Commission. Messages are not used to train models. | anthropic.com/legal/privacy |
The site uses neither profiling cookies nor analytics cookies. To measure site usage, Plausible Analytics is active, a cookie-free aggregated statistics tool that does not profile visitors. The typefaces (DM Sans) are hosted directly on our servers (self-hosting), so they are not loaded from third-party services. On the public forms only (sign-up and contacts), Cloudflare Turnstile is active to prevent automated submission by bots: this entails the disclosure of the visitor's IP address to Cloudflare for the sole purpose of anti-abuse security, without profiling.
When the Provider intends to add or replace a sub-processor, it gives the Customer prior notice. The notice is sent to the email address associated with the Customer's account and, at the same time, the list published on this page is updated with the new date and version at the top. To obtain clarifications or request the details of an announced change, write to info@quotlab.com.
From the date of the prior notice, the Customer has a window of 30 days to object to the appointment of the new sub-processor, for legitimate and reasonable reasons related to data protection. The objection must be sent, with reasons, to info@quotlab.com within that term.
Once the 30 days have elapsed without objections, the change is deemed accepted and the new sub-processor may be involved in the processing. In the event of a well-founded objection that cannot reasonably be resolved, the Customer may withdraw from the service limited to the part of the processing concerned, in accordance with the Data Processing Agreement and the Terms of Service.
We may update this list to reflect changes in providers or in the service. The version published on this page, with the date and version number at the top, is the one in force.