Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Syncy Terms and Conditions. It applies under Article 28 of the EU General Data Protection Regulation (GDPR).

1. Subject matter and duration

The Processor provides Syncy: it reads the Controller's appointments from its Google Calendar, keeps the Controller's customer list, and sends SMS appointment reminders with a link to confirm or cancel. This DPA lasts as long as the Controller uses Syncy, and after that until the data is deleted under section 10.

2. Data and data subjects

• Data subjects: the Controller's customers and the Controller's staff who use Syncy.
• Personal data: names, mobile phone numbers, optional email, postal address and notes; appointment times and event titles; reminder status and confirm or cancel answers; staff names, emails and roles.
• Special categories: Syncy is not built to hold special categories of data (Art. 9 GDPR), and the Controller must not enter them in notes or event titles. Depending on the Controller's business, the fact of an appointment alone may reveal such data (for example, that a person receives health care); the Controller assesses this in its DPIA.

3. The Controller's instructions

The Processor processes the data only to provide Syncy as configured by the Controller, and on its other documented instructions. If an instruction appears to break data protection law, the Processor will say so. The Controller confirms that it has a legal basis for the processing and has informed its customers.

Reminders are service messages about a booked appointment. The Controller will keep its SMS template free of marketing and promotional content.

4. Confidentiality

Everyone at the Processor with access to the data is bound by confidentiality, and access is limited to what their work needs.

5. Security

The Processor applies the technical and organisational measures in Annex 1 and keeps them up to date.

6. Sub-processors

The Controller authorises the sub-processors in Annex 2. The Processor will give at least 30 days' notice, by email to the Controller's admins, before adding or replacing one. The Controller may object on reasonable data protection grounds; if the parties can't resolve it, the Controller may end the service without penalty. The Processor imposes the same data protection obligations on every sub-processor and stays responsible for them.

7. Data subject requests

Syncy lets the Controller's staff download everything stored about a customer and delete a customer with their appointment history. The Processor will help with any other request, and will pass on any request it receives directly.

8. Personal data breaches

The Processor will notify the Controller without undue delay and in any case within 24 hours of becoming aware of a personal data breach affecting the Controller's data. The notice will describe what happened, the data and people affected, the likely consequences and the measures taken, and will be updated as more becomes known. This leaves the Controller time to notify its supervisory authority within 72 hours where Article 33 GDPR requires it.

9. Assistance and audits

The Processor will help the Controller with data protection impact assessments and prior consultations, and provides a draft DPIA, a record of processing and a breach plan in Syncy's Office settings. On request it will provide the information needed to show compliance with this DPA, and allow an audit by the Controller or its auditor on 30 days' notice, at most once a year unless a breach or an authority requires more.

10. Deletion at the end of the service

When the service ends, the Controller may first download its customer list. The Processor then deletes the Controller's data. Copies in backups are deleted automatically within 35 days. Data that law requires the Processor to keep is kept only for that purpose.

11. International transfers

The data is stored in the EU. Transfers outside the EU happen only through the sub-processors in Annex 2, under the safeguards listed there.

12. Liability, law and precedence

Liability is as set out in the Terms and Conditions. This DPA is governed by the laws of Greece, and the courts of Greece have exclusive jurisdiction. Where this DPA and the Terms conflict on data protection, this DPA prevails.

Annex 1. Technical and organisational measures

• Encryption in transit (HTTPS with HSTS) and at rest; Google refresh tokens encrypted again with a separate key
• Data stored in the EU (AWS Paris region), with each business's data separated in every database query
• Staff sign in through Google accounts, by invitation only; roles limit bulk export and import to the business's admins
• An activity log of customer data downloads, imports and deletions and of support actions, kept for 730 days
• Logs record identifiers and statuses, not names or phone numbers; error messages that could hold customer data are removed from logs
• Browser security headers (Content Security Policy, frame blocking) on the app and customer pages
• Daily backups kept for 35 days; deletion protection on the database
• Configurable retention: appointment history and customers with no appointments are deleted after the period the Controller sets

Annex 2. Sub-processors