Data processing agreement

1. 1. Subject and duration

   (1) The subject is the processing of personal data by the processor on behalf of the controller in providing appoint4u under the terms (main contract).(2) The agreement applies for the duration of the main contract, including the free customer account. Its obligations continue until the processor has deleted or returned all of the controller's data.

2. 2. Nature and purpose of processing

   Receiving, storing and answering WhatsApp and Telegram messages with an AI assistant, including converting voice messages to text and spoken replies; appointment booking and management; the online booking page; email notifications; matching appointments with the calendars and booking tools the controller connects, calendar subscription links and webhooks to the controller's own systems; an inbox and accounts for the controller's team; reports and exports for the controller.

3. 3. Types of data and data subjects

   Data subjects are the controller's customers and prospects as well as its staff.Processed data include in particular: name, phone number, for Telegram the Telegram ID and username, email address where given, message contents, transcripts of voice messages, appointment data (service, location, time, staff member), details and notes on the appointment, team notes, the language of communication, busy times from connected calendars (start and end only), absences of staff (type, time and an optional note; no health data), and access and log data of staff.

4. 4. Special categories of data and professional secrecy

   (1) Special categories of personal data (Art. 9 GDPR), in particular health data, are not the subject of processing. They may, however, appear in free-text messages, and for practices the booked service alone may reveal something about a person's health. The controller checks whether it has a legal basis under Art. 9(2) GDPR for this, configures the assistant so that it does not ask for such data and passes such matters to its team, and informs its customers accordingly.(2) If the controller is bound by professional secrecy within the meaning of § 203 StGB (for example a doctor, therapist, lawyer or tax adviser), the processor acts as another person contributing to the controller's professional activity (§ 203(3) sentence 2 StGB). The processor undertakes to keep secret all third-party secrets it learns in doing so and acknowledges that it may be liable to prosecution under § 203(4) StGB if it discloses such a secret without authorisation. It obtains knowledge of such secrets only as far as necessary for the service. It obliges its staff to secrecy in text form, informs them of the criminal consequences of a breach and uses sub-processors only if they are bound to confidentiality (§ 203(4) sentence 2 no. 2 StGB).

5. 5. Instructions

   (1) The processor processes the data only on documented instructions from the controller – including with regard to transfers to third countries – unless it is required to process them by EU or member state law. In that case it informs the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.(2) The instructions follow from this agreement, the terms and the settings the controller makes in its account. Further instructions are given by the business's owners or admins in text form to support@appoint4u.com. Instructions that go beyond the agreed scope of service are treated by both parties as a request to change the service.(3) If the processor considers an instruction to infringe data protection law, it informs the controller without delay. It may suspend execution until the controller confirms or changes the instruction.(4) The processor does not use the data for any purposes of its own and not to train AI models. Evaluation in anonymised or aggregated form is permitted, for example counting AI replies to bill the allowances.

6. 6. Controller's obligations

   (1) The controller is responsible for the lawfulness of the processing, in particular for having a legal basis and informing its customers under Art. 13 and 14 GDPR.(2) It sets the deletion period for conversations in the settings in line with its obligations.(3) It informs the processor without delay if it finds errors or irregularities in the processing.

7. 7. Confidentiality

   The processor only uses people who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR). Access is limited to people who need it for operation, maintenance or support, and only to the extent necessary. The obligation continues after their work ends.

8. 8. Security of processing

   The processor takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may adapt them to technical developments provided the level of protection does not fall; it documents significant changes.

9. 9. Sub-processors

   (1) The controller gives general authorisation to engage sub-processors (Art. 28(2) GDPR). The sub-processors engaged at conclusion are listed in Annex 2 and are deemed approved.(2) The processor informs the controller by email at least four weeks before any intended addition or replacement. The controller may object in text form within that period for an important data protection reason. If the parties find no solution, the controller may terminate the main contract as of the date of the change; the processor refunds fees paid in advance for the period after that pro rata. If a sub-processor fails or security reasons require a quick change, the processor may replace it at shorter notice; the right to object remains.(3) The processor imposes by contract on every sub-processor the same data protection obligations as set out in this agreement, in particular sufficient guarantees for appropriate technical and organisational measures. If a sub-processor fails to fulfil its obligations, the processor remains liable to the controller for the performance of that sub-processor's obligations (Art. 28(4) GDPR).(4) Services the controller chooses itself and uses with its own accounts are not sub-processors: the WhatsApp Business Platform, for which the controller agrees Meta's terms itself; Telegram, if it connects its own Telegram bot; calendars (e.g. Google, Microsoft, Apple), calendar links, booking tools (e.g. Calendly, Cal.com, Acuity) and webhook receivers. The processor sends these services only what the feature switched on by the controller needs: into connected calendars it writes only first name, service, staff member and time; webhook receivers get phone numbers and email addresses only if the controller explicitly switches this on. The controller informs its customers about these services in its privacy notice.

10. 10. Transfers to third countries

    (1) The processor processes the data in the EU, the EEA and the United Kingdom, for which an EU adequacy decision exists. Transfers to other third countries only take place where the requirements of Art. 44 et seq. GDPR are met.(2) The controller instructs the transfers listed in Annex 2: to providers based in the US under the EU-US Data Privacy Framework and the EU standard contractual clauses, and to Google for the AI features. Google processes the data for this through the global endpoint of Vertex AI and chooses the data centre itself; processing may therefore also take place outside the EU, for example in the US.(3) On request the processor provides the relevant documents, such as the standard contractual clauses.

11. 11. Assistance

    (1) The processor assists the controller with appropriate technical and organisational measures in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) – for example through the export of appointments, conversations and contacts in the account. Requests received directly by the processor are forwarded to the controller without delay.(2) Taking into account the nature of processing and the information available to it, the processor assists the controller with its obligations under Art. 32 to 36 GDPR, in particular with breach notifications and data protection impact assessments.(3) For assistance beyond the functions offered in the service that is not caused by a breach by the processor, the processor may charge reasonable remuneration.

12. 12. Personal data breaches

    The processor informs the controller without undue delay, at the latest within 24 hours of becoming aware, of a personal data breach affecting the controller's data. As far as known, the notice contains the information the controller needs for its own notification under Art. 33 GDPR: the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken and proposed, and a contact person. Information not yet available is provided without undue delay as it becomes available.

13. 13. Deletion and return

    (1) During the term the processor deletes conversations automatically after the period chosen by the controller, and other data on instruction.(2) After the main contract ends, the processor deletes all of the controller's personal data within 30 days unless EU or member state law requires storage. Until then the controller can export the data in the account or request an export (return). Copies in backups are overwritten in the regular cycle and not used until then. On request the processor confirms the deletion in text form.

14. 14. Evidence and audits

    (1) The processor makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR, in particular the current description of the measures in Annex 1 and the list of sub-processors.(2) It allows for and contributes to audits, including inspections, by the controller or an auditor appointed by it who is bound to confidentiality and is not a competitor of the processor. The controller announces audits at least four weeks in advance; they take place during normal business hours without avoidable disruption and – except for a specific cause – at most once per calendar year. The controller bears their costs unless the audit reveals a material breach by the processor.(3) For the data centres of the sub-processors, their current audit reports and certificates suffice.

15. 15. Liability

    Towards data subjects both parties are liable under Art. 82 GDPR. Between the parties the liability rules of the terms apply, insofar as Art. 82(4) and (5) GDPR do not preclude this.

16. 16. Final provisions

    (1) In case of conflict between this agreement and other agreements, this agreement prevails on data protection matters.(2) If the controller's data at the processor are endangered by seizure, confiscation, insolvency proceedings or other measures by third parties, the processor informs the controller without delay and notifies the third parties that the data belong to the controller.(3) Changes to this agreement require text form; changes by the processor follow the procedure in § 16(1) of the terms. Otherwise the final provisions of the terms apply.

17. Annex 1: Technical and organisational measures (Art. 32 GDPR)

    • Physical access control: the application and database run exclusively in data centres of the sub-processors (Annex 2); the processor operates no servers of its own.• System access control: sign-in only with a personal account and a confirmed email address; passwords of at least 12 characters, stored only as a scrypt hash; limits on sign-in attempts; sessions expire after seven days at the latest; session cookies only over HTTPS and not readable by scripts. The application accesses the AI service without permanently stored keys, with short-lived credentials of a service account that may only use the AI service (workload identity federation).• Data access control: roles and permissions per business (owner, admin, manager, team, read only); data exports only for owners and admins; access by the processor's staff only as needed for operation and support.• Separation control: every record belongs to one business, and the application checks membership on every access (tenant separation). The database provider's public data interface is locked (row level security, no rights for anonymous access). Demo and live operation run separately.• Encryption and pseudonymisation: all connections are encrypted with TLS. Credentials for connected services (WhatsApp, Telegram, calendars) are stored encrypted with AES-256-GCM, calendar subscription links and webhook keys only as hashes, IP addresses for abuse protection only as HMAC check values. The database is stored encrypted by the provider.• Transfer control: incoming WhatsApp and Telegram messages, payment events and booking-tool notifications are verified by signature or secret key; outgoing webhooks are signed and only sent to public HTTPS addresses; data exports are logged.• Input control: important changes are recorded with time and acting person in the business's change log.• Availability and resilience: operation with professional hosting and database providers with backups; request limits; automatic retries of failed background tasks.• Data minimisation: conversations are deleted automatically every day once older than the period chosen by the controller (30 days to two years); only busy times are taken from connected calendars; recordings of voice messages are not stored; the AI service receives only the necessary part of the conversation.• Regular review: automated tests of the application, review of the measures on significant changes, a defined procedure for data breaches, careful selection and monitoring of sub-processors.

18. Annex 2: Sub-processors

    • Vercel Inc. – Hosting of website and application; Servers in London (United Kingdom), delivery through Vercel's global network; Based in the US: EU-US Data Privacy Framework and EU standard contractual clauses; EU adequacy decision for the United Kingdom• Supabase Inc. – Database; London (United Kingdom); EU adequacy decision for the United Kingdom; EU standard contractual clauses for access from the US• Google Cloud EMEA Ltd. (Gemini über Vertex AI) – AI replies, transcription of voice messages and speech output; global endpoint: Google data centres worldwide, including the US; EU-US Data Privacy Framework and EU standard contractual clauses; data not used for training• Resend Inc. – Email delivery; United States; EU-US Data Privacy Framework and EU standard contractual clausesStripe processes no data of the controller's customers, only our contract and payment data, and is therefore not a sub-processor.

appoint4u is a service of PLUS TradeCon GmbH. Questions: support@appoint4u.com