Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between [to be completed], [to be completed] ("Processor", "we") and the business that uses Rezdock ("Controller", "you"). It applies whenever we process personal data on your behalf, and meets the requirements of Article 28 of the GDPR.

1. Subject, duration, nature and purpose

• Subject: running Rezdock for you: online bookings, your calendar, client records, booking e-mails and reminders.
• Duration: as long as you use Rezdock, and until the data is deleted under section 10.
• Nature: storing, organising, displaying, sending e-mails, exporting and deleting.
• Purpose: only to provide the service to you as described in the Terms.

2. Data and data subjects

• Data subjects: your clients and people who book with you; your team members.
• Personal data: names, e-mail addresses, phone numbers, addresses (for visits at the client's place), booking details and history, notes, answers to your booking questions, IP addresses and times of booking requests, e-mail delivery status.
• Special categories: Rezdock is not designed for special categories of data (such as health data). Do not ask for them in your booking questions unless you have a legal basis and take responsibility for it.

3. Your instructions

We process the data only on your documented instructions: these Terms, this DPA, and what you do in Rezdock. If we believe an instruction breaks data protection law, we tell you. If the law requires us to process data otherwise, we tell you first unless the law forbids it.

4. Confidentiality

Everyone at Rezdock who can access personal data is bound to confidentiality and accesses it only when needed for the service or for support you asked for.

5. Security

We take the technical and organisational measures in Annex 1 and keep them up to date with the state of the art.

6. Support access

Our support may sign in to your account to help you, only for a stated reason, for at most 30 minutes at a time. Every such session and every action in it is recorded in the audit log you can ask us for.

7. Sub-processors

You authorise the sub-processors listed in Annex 2. We bind each by a written contract with the same data protection obligations as this DPA, and we remain responsible for them. We tell you by e-mail at least 30 days before adding or replacing a sub-processor; if you object on reasonable data protection grounds and we cannot resolve it, you may cancel and get a refund for the unused part of your current period.

8. Helping you

Taking into account the nature of the processing, we help you to:

• answer requests from data subjects (Rezdock lets you export a client's data and anonymise a client yourself);
• meet your obligations on security, breach notification, impact assessments and prior consultation.

9. Personal data breaches

We notify you without undue delay, and no later than 48 hours after we become aware of a personal data breach affecting your data, with the information we have then (what happened, data and people affected, likely consequences, measures taken), and keep you updated.

10. Deletion and return

When your account is closed, you can export your data for 30 days; after that we delete it, including from active systems, unless the law requires us to keep it. Backups are overwritten within 35 days.

11. Audits

We make available the information needed to show compliance with this DPA. Once a year, or after a breach, you may audit our compliance yourself or through an independent auditor bound to confidentiality, with 30 days' notice and at your cost, in a way that does not affect other customers or reveal their data.

12. Transfers outside the EEA

We transfer personal data outside the European Economic Area only with appropriate safeguards (European Commission Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework).

13. Liability and order of precedence

Liability under this DPA follows the Terms. If this DPA conflicts with the Terms on data protection, this DPA prevails.

Effective from November 7, 2026.

Annex 1: Technical and organisational measures

• Separation: every business's data is stored with its business ID and every query is limited to the business signed in; tests check that one business can never see another's data.
• Access: team roles (owner, reception, staff) limit what each person sees; platform staff need a platform role and two-factor authentication; support sign-ins are time-limited and logged.
• Authentication: passwords are hashed (bcrypt), optional two-factor authentication and passkeys, rate-limited sign-in, recorded sign-ins.
• Encryption: all connections use HTTPS (TLS); sessions and two-factor secrets are encrypted.
• Logging: an insert-only audit log records administrative and security-relevant actions.
• Input protection: validation of all input, protection against cross-site request forgery and cross-site scripting, a content security policy, rate limits and a bot check on public booking forms.
• Availability: daily backups kept off the server, with regular restore tests; monitoring of errors and uptime.
• Data minimisation: clients inactive for 24 months are anonymised automatically; sign-in records are deleted after 12 months.

Annex 2: Sub-processors