Data Processing Agreement
Last updated: October 19, 2026
1. Parties
This Data Processing Agreement (the “DPA”) is concluded under Art. 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) between the User of the Termio service who, as the owner of a Business, acts as the controller (the “Controller”), and codevo s. r. o., Business ID (IČO): 57437807, Tax ID (DIČ): 2122728047, registered office Mlynský Sek 16, 941 02 Lipová, Slovak Republic, registered in the Commercial Register of the District Court of Nitra, Section: Sro, Insert No. 68539/N, which acts as the processor (the “Processor”).
2. Conclusion and Relation to the Terms
This DPA is concluded by accepting the Terms of Service at registration and forms an integral part of them. Terms not defined in this DPA have the meaning given in the Terms of Service and the GDPR. In matters of personal data protection, this DPA prevails in the event of a conflict.
3. Subject and Duration
The subject of this DPA is the processing of personal data on behalf of the Controller that the Controller, Team Members or its clients enter into the Service when booking online. This DPA is concluded for the duration of the contractual relationship under the Terms of Service and ends when that relationship ends. Obligations regarding data deletion and confidentiality survive its termination.
4. Nature and Purpose of Processing
The Processor processes personal data solely for the purpose of providing the Service, i.e. online appointment booking and client management: keeping the calendar and bookings, maintaining client records and visit history, sending confirmations, reminders and review requests, managing the waitlist and gift vouchers, writing bookings to Google Calendar if the Controller connects it, and other features the Controller enables in the Service. Processing operations include in particular collection, recording, storage, organisation, retrieval, sending notifications, export, anonymisation and erasure of data.
5. Categories of Personal Data and Data Subjects
Data subjects: the Controller's clients (end customers who book or have booked appointments, are on the waitlist or hold a gift voucher) and the Controller's employees or contractors for whom the Controller creates access or a profile in the Service. Categories of personal data: identification and contact details (first name, last name, email, phone number), booking and visit history (dates, services, prices, booking status, cancellations and no-shows), booking control data set by the Controller (for example blocking a client and a note about it), notes the Controller records about a client, data from custom booking form fields, client ratings and comments, gift voucher data and, for staff, work-related data (position, working hours, absences and a photo if the Controller uploads one). The Service is not intended for processing special categories of personal data under Art. 9 GDPR (for example health data). If the Controller enters such data into the Service, the Controller is responsible for having a legal basis for processing it.
6. Controller's Instructions
The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country. Such instructions are the Terms of Service, this DPA and the settings and actions the Controller performs in the Service. If Union or Member State law requires the Processor to process the data, the Processor will inform the Controller before processing unless that law prohibits it. If, in the Processor's opinion, an instruction infringes the GDPR or other data protection rules, it will inform the Controller immediately.
7. Confidentiality
The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Only persons who need access to operate, support and maintain the Service have access to personal data.
8. Security of Processing
The Processor implements appropriate technical and organisational measures under Art. 32 GDPR, in particular encryption of data in transit (TLS), secure password storage using hashing, logical separation of each Controller's data within the Service, role-based access control, data storage in a data centre in the EU, ongoing security updates and monitoring of errors and incidents. The Processor regularly reviews the measures and adapts them to the state of the art and the risks of the processing.
9. Sub-processors
The Controller gives the Processor a general written authorisation to engage sub-processors. The Processor currently uses: – DigitalOcean, LLC (USA) – hosting of servers and databases in a data centre in Frankfurt am Main (Germany, EU); – Stripe (Ireland and USA) – payments; – Resend (USA) – sending emails; – Cloudflare (USA) – content delivery network (CDN), website protection and custom domains; – Google (USA) – Google sign-in and Google Calendar sync, only if the Controller enables it; – Sentry (USA) – error monitoring. The Processor will inform the Controller by email at least 30 days in advance of any intended addition or replacement of a sub-processor, so that the Controller has the opportunity to object to the change. If the Controller does not agree with the change and the objection cannot be accommodated, the Controller may terminate the contractual relationship without penalty before the change takes effect by deleting the Business; in that case the Processor will refund the pro-rated price paid for the unused period. The Processor imposes on sub-processors the same data protection obligations as set out in this DPA and remains liable to the Controller for their performance.
10. Place of Processing and Transfers Outside the EU
Service data is stored on servers in the EU (DigitalOcean, Frankfurt am Main, Germany). However, some sub-processors – DigitalOcean, Stripe, Resend, Cloudflare, Google and Sentry – are established in the USA or may process data in the USA. Transfers take place on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of standard contractual clauses approved by the European Commission under Art. 46(2)(c) GDPR.
11. Assistance with Data Subject Rights
Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects exercising their rights, in particular the rights of access, rectification, erasure and portability. For this purpose, the Service allows the Controller to edit a client's data, export it to a JSON file and delete it; deletion irreversibly anonymises the client's personal data, including notes, review comments and waitlist entries. If a data subject submits a request directly to the Processor, the Processor will forward it to the Controller without undue delay. The Processor also provides the Controller with reasonable assistance in complying with its obligations under Art. 32 to 36 GDPR.
12. Personal Data Breach
The Processor will notify the Controller of a personal data breach without undue delay after becoming aware of it, by email to the Business owner's email address registered in the Service. The notification contains the information available to the Processor that the Controller needs to meet its obligations under Art. 33 and 34 GDPR, in particular a description of the breach, the categories and approximate number of data records and data subjects concerned, the likely consequences and the measures taken or proposed. Where it is not possible to provide all information at once, the Processor provides it in phases.
13. Deletion and Return of Data
The Controller can export its Business's data at any time in the Service Settings (Data export), by which the Processor returns the data. The Controller ends the contractual relationship by deleting the Business in the Settings. The Processor then permanently deletes all personal data processed on behalf of the Controller after 30 days from the deletion of the Business, unless Union or Member State law requires further storage. If the Processor terminates the contractual relationship, it will allow the Controller to export the data before deletion and will delete it after 30 days from the end of the contractual relationship. Invoices and Subscription records are not data processed on behalf of the Controller; the Processor keeps them as a controller for the period required by accounting and tax laws in accordance with the Privacy Policy. Deleted data cannot be recovered, so we recommend exporting your data before deleting the Business.
14. Demonstrating Compliance and Audits
On request, the Processor will provide the Controller with the information necessary to demonstrate compliance with its obligations under Art. 28 GDPR and will allow for audits, including inspections, conducted by the Controller or an auditor mandated by it who is bound by confidentiality. Audits must be announced reasonably in advance and carried out so as not to disrupt the operation of the Service or the confidentiality of other Users' data. Please send requests to [email protected].
15. Controller's Obligations
The Controller is responsible for the lawfulness of processing the personal data it enters into the Service or collects through the booking page, in particular for having a legal basis, for informing its clients and staff under Art. 13 and 14 GDPR, for the content of notes and custom form fields, and for the permissions it grants to Team Members.
16. Contact
Please send questions about this DPA to [email protected] or to codevo s. r. o., Mlynský Sek 16, 941 02 Lipová, Slovakia.