Data Processing Agreement

1. Roles

This agreement is entered into between the business customer ("Controller") and F9.contact ("Processor"). The Controller determines the purposes and means of processing the personal data of its own clients and staff; the Processor processes that personal data only on the Controller's documented instructions, as set out in this agreement and the platform's configuration.

2. Subject matter and duration

The Processor processes personal data on behalf of the Controller for the duration of the subscription and any post-termination retention period, solely to deliver the F9.contact service.

3. Nature and purpose of processing

Processing comprises the storage, organisation, retrieval, transmission and erasure of personal data through booking, client-records, scheduling, point-of-sale and compliance features.

4. Categories of data and data subjects

• Data subjects: the Controller's clients, staff and workers.
• Categories: contact details, appointment and transaction history, preferences, optional profile photos and, where the Controller uses clinical features, intake-questionnaire answers that may include special-category health data.

5. Controller and processor obligations

The Controller is responsible for the lawfulness of the data it enters and for having a valid lawful basis for processing. The Processor will process only on documented instructions, ensure persons authorised to process are bound by confidentiality, and assist the Controller in meeting its obligations under Articles 32 to 36.

6. Technical and organisational measures (Art. 32)

The Processor implements measures appropriate to the risk, including:

• Encryption of stored personal data (AES-256-GCM): every record is locked with a key of its own, and that key is in turn locked with a master key.
• Separate master keys for the businesses' contact details, for each business's staff and its own records about its clients, and for clients' own accounts, so that the key protecting a client's account is independent of the keys protecting each business's own data.
• Search by fingerprint: details used to find a record, such as an email address, are looked up through a one-way fingerprint made with a secret key, so an email address is never stored in readable form.
• Each business's data kept apart from every other business's, EU-sovereign hosting, a log of access to data to which entries can only be added, never changed, and links to media files that cannot be forged and stop working after a short time.

The Privacy Policy records two deliberate exceptions concerning a business's clients, and this agreement records the same. A client's date of birth, where the Controller records one, is stored unencrypted, apart from the rest of the record, because its only use is to be searched, compared and sorted by date, which encrypted values cannot be; it is the only detail about the client themselves kept that way, and it sits under the same access controls and EU-sovereign hosting as every other record. The Controller's own operational records about its clients — for example when a client last visited, or which services and professional they prefer — are ordinary business records held unencrypted as the Controller's records; they are not part of the encrypted client record.

One further exception concerns the Controller's staff. A professional's public profile — the display name, which the platform fills with the professional's first name when the record is created unless the Controller sets another, the short biography and the photo — exists to be shown on the Controller's public booking page, and is therefore stored unencrypted wherever it is set, whether or not the Controller currently shows that professional on that page. A professional's full name, email address and telephone number stay under the encryption described above.

7. Sub-processing

The Controller gives the Processor general authorisation to engage sub-processors. The sub-processors engaged at the date of this version are listed in Annex 1. Each is bound by a written agreement imposing data-protection obligations equivalent to those in this agreement, and is selected for EU data residency where personal data is involved. The Processor remains responsible to the Controller for the performance of each sub-processor.

The Processor will inform the Controller of any intended addition or replacement of a sub-processor before it takes effect, by publishing a new version of this agreement with an updated Annex 1 and notifying the Controller by email, giving the Controller the opportunity to object.

8. Assisting with data-subject rights

The platform provides self-service tooling that helps the Controller meet data-subject requests, including data portability (Art. 20) through export archives prepared in the background, and erasure (Art. 17) through destruction of the key that unlocks the data (cryptographic erasure). When a client closes their account, the key to the name, contact details and photo held on their account is destroyed 30 days after they confirm the closure, and the unencrypted date of birth is deleted outright in the same operation. The Controller's own record of that client, such as its notes and the allergies it recorded, is kept, locked with the Controller's own key, because it is the Controller's record; only the Controller's note of how the client found it and the client's notification choices are cleared. When the Controller deletes a client from its client list, the client is hidden at once, and 365 days later the key to the Controller's notes and allergies about that client is destroyed.

9. Personal-data breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, and will provide the information the Controller needs to meet its own notification obligations.

10. Return and deletion

On termination, and subject to statutory retention obligations such as Croatian fiscal-record law, the Processor will delete personal data through the platform's retention process. Erasure is cryptographic: after termination, normally when the cooling-off period ends, the Controller's master key is destroyed, so all personal data locked with it — that of the Controller's staff, its bookings and its records about its clients — can never be read again, and the key to the details of the Controller's contact person is destroyed with it. The records the law requires to be kept, such as invoices, are kept for the period the law sets, with the details the law requires them to carry. Data held unencrypted by design is handled as follows: the date of birth is deleted outright in the same operation, with the same effect for the data subject; the Controller's own operational records about a client are not part of erasure and are cleared by the platform's retention process described in this section, not by key destruction; a professional's public profile (see Section 6) is deleted outright in the same operation as the key destruction.

11. Audits

The Processor will make available the information necessary to demonstrate compliance with this agreement and will contribute to audits conducted by the Controller or an auditor mandated by the Controller, subject to reasonable confidentiality and security safeguards.

12. Effect

This agreement forms part of the Terms of Service. In the event of conflict on data-protection matters, this agreement prevails.

Annex 1 — Sub-processors

The sub-processors the Processor engages to deliver the service, as at the date of this version.

Sub-processor	What it does	Personal data involved	Where
Hetzner Online GmbH (Germany)	Hosts the servers and the database the service runs on	All personal data held in the service	European Union
Scaleway SAS (France)	Stores files, and delivers the emails the service sends	Photos and documents attached to client records, signed consent documents and export archives; the recipient's address and the content of each email	Amsterdam, Netherlands (files); Paris, France (email)
Backblaze, Inc. (United States)	Stores backups	Backup copies of the data above	Amsterdam, Netherlands, in the provider's EU region, on encrypted disks. The provider is established in the United States; its data processing agreement incorporates the EU standard contractual clauses
Google Ireland Limited (Ireland)	Delivers push notifications to the mobile app (Firebase Cloud Messaging)	The device's push token, and the title and text of each notification, which may name a client or an appointment	European Union and United States. Google LLC is certified under the EU–US Data Privacy Framework. Notifications to Apple devices are passed on through Apple's push notification service

Not sub-processors. The following process personal data in connection with the service, but not on the Controller's behalf under this agreement:

• Stripe processes the Controller's own subscription payments to F9.contact. F9.contact is the controller of that data; see the Privacy Policy.
• A payment-terminal or accounting provider the Controller connects with its own account (for example Viva) acts for the Controller under the Controller's own agreement with that provider.
• Google, where a user chooses to sign in with a Google account or to connect a Google calendar, acts for that user.
• The tax authority receives fiscal data because the law requires it.