Data processing agreement

This data processing agreement is part of the terms of service. It is concluded between the business that uses ubooq, as the controller, and PORTUM VICTORIA, Ćikovići, Novo naselje 36c 51215 Kastav, OIB u postupku dodjele, as the processor, in accordance with Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

Subject matter and duration

The processor processes personal data on the controller's behalf in order to provide the ubooq platform: online booking, the calendar, email notices and the other features in the terms of service. This agreement lasts as long as the contract for the platform, and its obligations apply until the processor has deleted the data as set out in End of processing.

Data subjects and types of data

The data subjects are:

• the controller's customers and people who book on their behalf;
• people on the waiting list;
• the controller's owner and staff.

The following data is processed:

• name, phone number, email address and language;
• appointments: services, staff member, time, price, status, history of changes and notes (the customer's and internal ones);
• waiting-list entries and the notices sent from it;
• Google review requests: when they were sent and whether the link was opened;
• booking protection data: email confirmation by code (the code is stored only as an HMAC) and blocked customers;
• about staff: name, working hours, time off, appointments and the changes they made.

The platform is not meant for special categories of personal data under Article 9 GDPR, such as health data. The controller does not enter such data in notes unless this is necessary and the controller has a legal basis for it. The controller assesses whether the type of service itself (physiotherapy, for example) reveals such data and, if it does, ensures an appropriate legal basis.

The controller's instructions

The processor processes the data only to provide the platform and only on the controller's documented instructions. These instructions are this agreement, the terms of service and the settings the controller chooses in the admin, such as reminders, the waiting list and review requests. If the processor considers an instruction to be unlawful, it informs the controller immediately.

The processor does not use the data for its own purposes, does not sell it and does not use it for advertising. For running and developing the platform it may keep aggregate figures that contain no personal data, such as the number of bookings.

Confidentiality

The processor's personnel with access to the data are bound to confidentiality. They access it only when this is needed to run the platform or for support the controller asks for.

Security of processing

The processor applies these technical and organisational measures (Article 32 GDPR):

• encrypted transfer (HTTPS) on every address of the platform;
• each business's data kept apart: the database itself checks the links between data, so no business can access another's;
• role-based access (owner, staff), always checked on the server;
• passwords stored as argon2id hashes, session and link tokens stored only as hashes, and each session bound to the address it was opened on;
• a limited number of attempts on every public form;
• nightly backups, each kept for 14 days;
• system logs without names, phone numbers or email addresses;
• servers in the European Union.

The processor adapts these measures to the state of the art and to the risks of the processing.

Sub-processors

The controller gives a general authorisation to engage sub-processors. The current sub-processors are:

Sub-processor	Purpose	Place of processing
netcup GmbH	server, database and backups	European Union
Amazon Web Services EMEA SARL (Amazon SES)	sending emails	European Union
Resend, Inc.	sending emails	USA

The processor informs the controller by email at least 30 days in advance of any intended addition or replacement of a sub-processor. The controller may object to the change. If the parties do not agree, the controller may terminate the contract before the change, without a termination fee.

The processor concludes a contract with each sub-processor that imposes the same data protection obligations, and remains liable to the controller for the sub-processor's performance.

Transfers outside the EU

Data is transferred outside the European Economic Area only with the safeguards of Chapter V GDPR, for example under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

Data subjects' rights

The admin lets the controller fulfil data subjects' requests itself:

• access and portability: the customer record and the export of the customer list (CSV);
• rectification: editing the customer record;
• erasure: "Delete personal data" on the customer record permanently deletes the name, contact details and notes, and the appointments remain without them;
• objection to review requests: the unsubscribe link in every request.

If a data subject contacts the processor, the processor forwards the request to the controller without delay and does not answer it itself. In everything else the processor assists the controller to a reasonable extent.

Personal data breaches

The processor notifies the controller without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting the controller's data. The notice contains what is known at that time of the information listed in Article 33(3) GDPR, and the processor adds the rest as soon as it learns it.

Assistance to the controller

The processor assists the controller in meeting its obligations under Articles 32 to 36 GDPR (security of processing, breach notification, data protection impact assessment and prior consultation), taking into account the nature of the processing and the information available to it.

End of processing

Until the contract ends, the controller can export its customers' data under Customers → Export (CSV). After the contract ends, the processor deletes all of the controller's personal data within 30 days, except data the law requires it to keep. The data leaves the backups within the following 14 days.

Audits

On request, the processor gives the controller all information necessary to demonstrate compliance with Article 28 GDPR. The controller, or an auditor it appoints, may carry out an audit with at least 30 days' notice, during working hours and without putting other businesses' data at risk. The controller bears the costs of the audit, unless a material breach of this agreement is found.

Final provisions

Liability is governed by Article 82 GDPR and the liability section of the terms of service. Where a provision of the terms of service conflicts with this agreement, this agreement prevails in matters of data protection. The contact for data protection questions is hello@ubooq.com.