Personal Data Processing Agreement

1. General Provisions

This Personal Data Processing Agreement (the “DPA”) sets out the rules for the processing of personal data by APPOINTIR on behalf of a Platform user, in accordance with Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”).

2. Parties to the Agreement

The Processor is Andrii Harkusha, Wolska 171, 01-258 Warsaw, Poland, operating the APPOINTIR platform (the “Processor”). The Controller is the Platform user who, by using APPOINTIR, determines the purposes and means of processing their clients’ data (the “Controller”).

3. Subject Matter and Duration of Processing

The Processor processes personal data only to the extent necessary to provide APPOINTIR services and for as long as the relevant Platform features are used. After the services end, data is deleted or returned in accordance with the Controller’s instructions, subject to data that must be retained under applicable law.

4. Nature and Purpose of Processing

Processing may include, among other things, collecting, recording, storing, organizing, making data available to the Controller, modifying, restricting and deleting data. The purpose of processing is to enable the use of Platform features, in particular the handling of booking pages, bookings, forms, notifications and other features selected by the Controller.

5. Categories of Data Subjects

The data may relate, among others, to clients making bookings, people registering for events or services, people contacting the user through forms and other persons whose data the Controller decides to process using the Platform.

6. Categories of Personal Data

Depending on the Platform configuration, the data processed may include, among other things, first and last name, email address, phone number, information about a booking, selected service or event, booking date and time, and other information entered by the person making the booking.

7. Additional Form Data

The Controller may create custom form fields and determine the scope of data collected from clients. The Controller is responsible for determining a lawful purpose, legal basis, scope and retention period for data collected through custom form fields.

8. Special Categories of Data

If the Controller uses APPOINTIR forms to collect special categories of data within the meaning of Article 9 GDPR or other data requiring additional protection, the Controller is responsible for ensuring that an appropriate legal basis exists and that all information and other obligations under applicable law are fulfilled.

9. Controller’s Instructions

The Processor processes personal data only on the Controller’s documented instructions, in particular those arising from the use of Platform features, account configuration and this Agreement. If the Processor considers that an instruction infringes the GDPR or other applicable data protection laws, the Processor will inform the Controller.

10. Controller’s Obligations

The Controller is responsible for the lawfulness of data processing, in particular for having an appropriate legal basis, fulfilling information obligations towards data subjects, determining retention periods and ensuring that the scope of data provided is adequate and necessary for the purpose pursued.

11. Confidentiality

The Processor ensures that persons authorized to process personal data are bound by confidentiality obligations or are subject to an appropriate statutory duty of confidentiality.

12. Security of Processing

The Processor applies appropriate technical and organizational measures designed to ensure the security of personal data, taking into account the nature, scope, context and purposes of processing and the risk to the rights and freedoms of natural persons.

13. Personal Data Breaches

If the Processor becomes aware of a personal data breach concerning data processed on behalf of the Controller, the Processor will take appropriate steps to mitigate the effects of the breach and, to the extent required by law and practically possible, inform the Controller without undue delay.

14. Assistance with Data Subject Rights

Taking into account the nature of the processing, the Processor will provide the Controller with appropriate assistance, to the extent technically and organizationally feasible, as necessary to fulfil data subjects’ rights with regard to data processed through the Platform.

15. Assistance with the Controller’s Obligations

Taking into account the nature of the processing and the information available, the Processor will provide the Controller with reasonable assistance regarding obligations relating to processing security, notification of personal data breaches, data protection impact assessments and consultation with the supervisory authority, where these obligations apply to processing carried out using the Platform.

16. Subprocessing

The Controller gives general authorization for the Processor to use sub-processors to the extent necessary to provide APPOINTIR services. The Processor is responsible for ensuring that each sub-processor is subject to appropriate data protection obligations under the GDPR and provides the level of protection required by this Agreement.

17. Sub-processors

Depending on the Platform features used, data may be processed by infrastructure, email, payment, calendar integration and security providers, in particular OVHcloud, Resend, Stripe, Stripe Connect, Google and Cloudflare. The current list of entities and the scope of their services is available in the APPOINTIR List of Subprocessors.

18. Transfers of Data Outside the EEA

If the use of a sub-processor’s services involves the transfer of data outside the European Economic Area, the transfer will be carried out using a mechanism compliant with applicable personal data protection laws.

19. Audits and Information

The Processor will provide the Controller with information necessary to demonstrate compliance with the obligations under Article 28 GDPR and, to a justified extent, allow audits or inspections concerning the processing covered by this Agreement, taking into account the need to protect security, confidentiality and the rights of other clients.

20. Deletion or Return of Data

After the end of services involving data processing, the Processor will, in accordance with the Controller’s decision and subject to legal obligations, delete the personal data or return it to the Controller and delete existing copies.

21. Data Processed by APPOINTIR as Controller

This Agreement applies only to data processed by APPOINTIR on behalf of the Controller. It does not cover data for which APPOINTIR independently determines the purposes and means of processing, such as user account data, subscription data, security data, payment data or data concerning the use of the Platform. In this respect, APPOINTIR may act as an independent data controller.

22. Term

This Agreement remains in force for as long as the Processor processes personal data on behalf of the Controller through the Platform.

23. Final Provisions

Matters not regulated by this Agreement are governed by the GDPR and other applicable personal data protection laws. In the event of a conflict between this Agreement and mandatory legal provisions, the relevant legal provisions prevail.