Vizitino

Data processing agreement (template)

Draft. This text must be reviewed by a lawyer before it is used.

This agreement under Article 28 of the GDPR is part of the Terms of service between the business using Vizitino (the controller) and Слободенюк Андрій Віталійович, м. Бердичів, вул. Крупської, буд. 20 (the processor).

1. Subject and duration

The processor processes personal data of the controller's clients and staff in order to provide the Vizitino service (online booking, notifications, calendar integration, AI assistant). The agreement lasts as long as the controller uses the service.

2. Nature and purpose

Storing and organising bookings, showing free times, sending confirmations and reminders, synchronising with calendars chosen by the controller, answering clients through the AI assistant if enabled, technical support and security.

3. Data and data subjects

  • Data subjects: the controller's clients, staff and users.
  • Data: names, phone numbers, email addresses, booking details (service, time, specialist, status, notes), chat messages, technical data (IP addresses for security).
  • Special categories (for example health data) are not required by the service. The controller should not enter them into free-text fields.

4. Obligations of the processor

The processor:

  • processes the data only on the documented instructions of the controller, which are given by the terms and by the controller's settings in Vizitino;
  • ensures that persons with access are bound by confidentiality;
  • implements the technical and organisational measures in Annex 2;
  • uses sub-processors only as listed in Annex 3, informs the controller of planned changes at least 30 days in advance and lets the controller object;
  • helps the controller respond to data subject requests (access, correction, deletion, export);
  • notifies the controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach;
  • helps the controller with data protection impact assessments where needed;
  • at the end of the service deletes or returns the data, at the controller's choice, unless the law requires storage;
  • makes available the information needed to demonstrate compliance and allows reasonable audits.

5. International transfers

Data is stored in the European Union. Where a sub-processor processes data outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses or an adequacy decision.

Annex 1: Processing details

  • Location of data: European Union (Frankfurt, Germany).
  • Retention: as decided by the controller; AI chat conversations are deleted after 90 days; backups are kept for up to 12 months.

Annex 2: Technical and organisational measures

  • Encryption in transit (TLS) and encryption of sensitive tokens at rest.
  • Separation of each controller's data at database level (row-level security), verified by automated tests.
  • Two-step verification available to every account, required at every sign-in once turned on; passwords stored as secure hashes.
  • Role-based access control and an append-only log of access to personal data.
  • Encrypted daily backups with weekly restore tests.
  • Rate limiting and protection against automated abuse.
  • Regular dependency updates and security monitoring.

Annex 3: Sub-processors

  • Render Services, Inc.: hosting and database, EU region (Frankfurt).
  • Cloudflare, Inc.: network security, content delivery, backup storage (EU jurisdiction).
  • Resend, Inc.: email delivery.
  • Functional Software, Inc. (Sentry): error monitoring, EU region, without personal data.
  • Better Stack, Inc.: uptime monitoring.
  • Google LLC: calendar integration, only if the controller connects Google Calendar.
  • Anthropic PBC: AI assistant, only if the controller enables it.