Data Processing Agreement

The Processor processes personal data solely on behalf of, and in accordance with the written (including electronic) instructions of, the Controller, for the purpose of detecting open slots and contacting and rebooking End Clients (the Service). This agreement applies for the duration of the main agreement between the parties and terminates automatically upon its termination, without prejudice to section 10.

Nature: automated processing of contact and appointment data to send and handle recovery messages.

Purpose: refilling freed-up appointments on behalf of the Controller.

• Categories of data: name, phone number, email address, appointment history (service, time, value), consent/opt-out status, content of message exchanges to the extent needed to handle an appointment.
• Explicitly EXCLUDED: special categories of personal data under Article 9 GDPR, including health data. The Processor is not built to process these, and the Controller does not supply them.
• Data subjects: the Controller's own customers who have or have had an appointment and for whom consent/a legal basis exists to be contacted.

The Processor only processes data based on documented instructions from the Controller, unless required to do so by Union or Member State law; in that case, the Processor informs the Controller before processing, unless that law prohibits such information on important grounds of public interest. The functionality of the Service (which fields are required, which channels are used, the limits in section 6 of the terms of service) constitutes a pre-given instruction.

The Processor ensures that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality, and have access only to the data necessary for their task.

The Processor implements appropriate technical and organisational measures, including: encryption of data in transit (TLS) and at rest; access control on a need-to-know basis; cryptographic verification of webhook and API traffic to prevent spoofing; logging of actions on sensitive data; separate development and production environments; and a procedure for detecting and handling security incidents.

The Controller gives the Processor general authorisation to engage the following sub-processors:

• Twilio Inc., sending SMS and (later) voice calls. Processed outside the EU; Standard Contractual Clauses apply.
• Meta Platforms Ireland Ltd., sending WhatsApp messages via the WhatsApp Business Cloud API.
• Supabase Inc., database hosting, EU region.
• Vercel Inc., hosting of the application and website, global edge network; Standard Contractual Clauses apply for non-EU nodes.
• Stripe Payments Europe, Ltd., processing payments between Revenaro and the Customer (not payments from End Clients to the Customer).

Should the Processor wish to add or replace a sub-processor, it will inform the Controller at least 14 days in advance. Within that period, the Controller may raise a reasoned objection on concrete data-protection grounds; the parties will then discuss a solution in good faith. The Processor remains liable to the Controller for each sub-processor's compliance with its obligations, as required by Article 28(4) GDPR.

The Processor assists the Controller, through appropriate technical and organisational measures, in fulfilling its obligation to respond to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection). An opt-out via 'STOP' is processed automatically and immediately by the Processor, regardless of which channel it arrives through.

The Processor assists the Controller, taking into account the nature of the processing and the information available to the Processor, in complying with obligations relating to data protection impact assessments and prior consultation of the supervisory authority.

Should the Processor become aware of a personal data breach, it will notify the Controller without undue delay and in any event within 48 hours, with the information then available on the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed.

The Processor makes available to the Controller all information reasonably necessary to demonstrate compliance with the obligations of Article 28 GDPR, and allows for and contributes to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable prior notice and in a manner that does not unreasonably disrupt the Processor's operations or the security of its other customers.

At the end of the processing services, the Processor deletes all personal data, or returns it to the Controller at the Controller's request, and deletes existing copies, unless Union or Member State law requires storage of the data. This takes place within the periods described in section 5 of the privacy policy.

To the extent sub-processors process data outside the EU/EEA (see section 6), this is done on the basis of the European Commission's Standard Contractual Clauses or an equivalent recognised transfer mechanism, supplemented where necessary by appropriate technical measures.

The liability arrangements of the main agreement (terms of service, section 8) apply correspondingly to this data processing agreement.

This data processing agreement is governed by Belgian law, as is the main agreement.