Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the business using Calmfill (the "controller", "you") and Matej Machajda, Ustie nad Priehradou 23 Trstená 02801 SLOVAKIA (the "processor", "we"). It applies whenever we process personal data on your behalf, and meets the requirements of Article 28 of the GDPR. If it conflicts with the Terms on data protection, this DPA prevails.

• Subject matter and purpose: providing the Calmfill booking service: booking pages, availability, calendars, customer records, and booking confirmation, reminder and change emails.
• Nature: collection through the booking page, storage, organisation, display to you and your team, sending emails, and erasure.
• Duration: for as long as you use the service, plus the deletion periods in section 9.
• Data subjects: your customers and people who book through your booking page; your team members.
• Personal data: names, email addresses, phone numbers, appointment details and history, notes entered by customers or by you, and email delivery records. No special categories of data are intended to be processed.

We process personal data only on your documented instructions. Your instructions are these terms, your settings, and the actions you and your team take in the service. We will tell you if we believe an instruction infringes data protection law. We may process data otherwise only where EU or member state law requires it, and will inform you unless that law prohibits it.

Everyone we authorise to access personal data is bound by confidentiality and accesses it only as needed to run and support the service.

We maintain appropriate technical and organisational measures under Article 32 GDPR, including:

• encryption in transit (HTTPS) and storage with providers that encrypt data at rest;
• separation of each business's data, with role-based access checked on every request;
• salted scrypt password hashing, expiring sessions, and rate limiting of sign-in, booking and email endpoints;
• a change history of bookings, and automatic erasure of customer details after your retention period;
• regular backups by our database provider, and limiting our own access to what support and operation require.

You authorise us to use the sub-processors listed in our Privacy Policy (Netlify for hosting, Neon for the database, Resend for email). We impose data protection obligations on each of them that are no less protective than this DPA, and remain responsible for them. We will notify you by email at least 14 days before adding or replacing a sub-processor; if you object on reasonable data protection grounds, you may end the agreement and delete your data before the change takes effect.

Where a sub-processor processes personal data outside the European Economic Area, we ensure the transfer is covered by the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as applicable.

The service lets you view, correct, export and delete customer data so you can answer data subject requests yourself. If a request reaches us, we will forward it to you without delay. Taking into account the nature of the processing, we will reasonably help you with security, data protection impact assessments and consultations with authorities.

We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties.

You can export your customer data at any time. When you delete customers, your business or your account, the data is erased from our live database immediately, and from backups as they roll over within 30 days, unless the law requires us to keep it.

We will make available the information needed to demonstrate compliance with this DPA and allow for audits, including inspections by you or an auditor you mandate who is bound by confidentiality, on reasonable written notice, normally no more than once a year and at your cost, unless a breach or an authority requires otherwise.

Contact for data protection matters: xtfmathew@gmail.com.