Data Processing Agreement (DPA)

Preamble

This Data Processing Agreement (DPA) forms an integral part of the Terms of Service and governs the processing that the Processor (Mészáros János, sole proprietor, the operator of GrabTheSlot) performs on behalf of the Controller (the Subscriber) within the GrabTheSlot service, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

This DPA enters into force automatically upon acceptance of the Terms of Service for every Subscriber and remains in force for the duration of the subscription.

1. Parties and definitions

• Controller: the Subscriber — the business using GrabTheSlot, which determines the purposes and means of processing its own end-customers' personal data.
• Processor: Mészáros János, sole proprietor, the operator of GrabTheSlot, who processes personal data on behalf of and according to the instructions of the Controller.
• Data subjects: the Controller's end-customers (people who book) and the staff members of the Controller's account.
• Sub-processor: a third party engaged by the Processor to carry out processing tasks (listed in Section 5).

2. Subject matter, nature, purpose and duration

• Subject matter: processing of the personal data of the Controller's end-customers and staff members through the GrabTheSlot booking platform.
• Nature: storage, modification, retrieval, deletion, structured organisation, backup, and anonymised statistical aggregation.
• Purpose: the technical provision of the booking, client management and notification service to the Controller.
• Duration: the subscription term plus the retention and deletion periods defined in Section 8.

3. Categories of data subjects and data

• Identifiers: name, email address, phone number
• Booking data: time, selected service, assigned staff member, price
• Client notes recorded by the Controller
• Log data: IP address, browser, timestamps of booking events (technical purposes)
• Staff data: name, email, role, permissions

The Processor does NOT process: payment card or payment data — these are processed exclusively by Paddle (Merchant of Record), which acts as an independent controller for payment data.

4. Obligations of the Processor (GDPR Art. 28(3))

The Processor undertakes to:

• process personal data only on the Controller's documented instructions, including transfers to third countries;
• ensure that persons authorised to process the data are bound by confidentiality;
• implement the technical and organisational measures required by GDPR Art. 32 (Section 6);
• engage sub-processors only under the general authorisation of Section 5, giving the Controller the opportunity to object to changes;
• assist the Controller in responding to data subject rights requests (GDPR Art. 12–22);
• assist the Controller with its obligations under GDPR Art. 32–36 (security, breach notification, impact assessments);
• at the end of the engagement, return or delete the personal data at the Controller's choice;
• make available the information necessary to demonstrate compliance and allow audits requested by the Controller.

5. Sub-processors

By accepting this DPA, the Controller grants general authorisation for the following sub-processors:

Not sub-processors — the following services are independent controllers, or the Controller’s own contractual partners that the Controller enables; they are listed for transparency:

New sub-processors: the Processor announces any new sub-processor by email at least 30 days before the change takes effect. The Controller may object; if no agreement is reached within a reasonable period, the Controller may terminate the subscription with immediate effect.

6. Security measures (GDPR Art. 32)

• Encryption in transit: all HTTP traffic over TLS 1.2+ (HSTS enabled)
• Encryption at rest: the database and file storage are operated by us on encrypted (AES-256, LUKS2) storage, with the encryption key kept off the server’s disk; payment-provider keys and two-factor secrets are additionally encrypted at application level with AES-256-GCM
• Tenant isolation: every database operation runs on the server and is filtered by the Subscriber’s identifier; the public API keys cannot reach the data tables (row-level access rules plus revoked privileges, checked by an automated test before every release)
• Access control: the interface requires passwords of at least 10 characters, stored as bcrypt hashes; optional two-factor authentication (TOTP) for every user, which the Subscriber can make mandatory for its team; account lockout after repeated wrong codes
• Role-based access (RBAC): separate owner / staff / delegated roles with layered authorisation checks
• Logging and detection: error logs with automatic alerting; a history of booking status changes; platform-administrator interventions (e.g. support access to a Subscriber’s account) are logged
• Server protection: firewall, automatic banning after repeated failed logins, key-only SSH access, automatic security updates and a weekly security check
• Backups: continuous database backup (point-in-time restore to the minute), a full daily backup and a database copy every 6 hours; backups are encrypted before upload and copied within minutes to provider-independent, EU-jurisdiction storage, where they are locked (cannot be deleted or overwritten) and kept for at most 89 days; restorability is verified by a monthly automated test restore
• Updates: automatic operating-system security updates; weekly automated vulnerability checks of software dependencies
• Data minimisation: only data necessary for providing the service is stored
• Internal access restriction: production data is accessible only to the person responsible for operations, through an administrator account protected by two-factor authentication

7. Personal data breaches (GDPR Art. 33)

Upon detecting a personal data breach, the Processor notifies the Controller by email without undue delay, and no later than 24 hours after becoming aware of it, with the information available at that time (further information follows as soon as it becomes available), including the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed. The Controller is responsible for notifying its competent supervisory authority under GDPR Art. 33; the Processor provides all necessary information. Security incidents and vulnerabilities can be reported to [email protected] (see also security.txt).

8. Return and deletion

Upon termination of the subscription, the Controller may export its data; after a grace period allowing reactivation, the Processor deletes the personal data from the live systems; deleted data disappears from backups when their retention ends (7 days for local backups, at most 89 days for the independent, encrypted backups), except where retention is required by EU or member state law (e.g. invoicing records).

9. International transfers

Personal data is stored within the EEA: the database and the application server in Germany, operated by us (Hetzner, Nuremberg), on encrypted (AES-256) storage. Transfers outside the EEA happen only with the safeguards of GDPR Chapter V:

• Cloudflare, Inc. — EU-U.S. Data Privacy Framework (DPF); backup and DNS; the backup is held in EU-jurisdiction storage.
• GitHub, Inc. — EU-U.S. Data Privacy Framework (DPF); release pipeline and schema changes.
• Resend Inc. — EU-U.S. Data Privacy Framework (DPF); email delivery.
• Twilio Inc. — EU-U.S. Data Privacy Framework (DPF) + Binding Corporate Rules (BCR); SMS/WhatsApp delivery; Twilio also applies its approved Binding Corporate Rules (BCR).