Data Processing Agreement

between

the business that uses the business software, with the details from its legal notice on the platform — as controller, hereinafter the “Customer” —

and

SavePaperwork, owner Andreas Gerum, Höfatsstraße 16, 86163 Augsburg, Germany — as processor, hereinafter the “Provider”. The contact point for instructions and data protection is the email address given in the legal notice.

Preamble

(1) The Provider makes a software-as-a-service platform available to the Customer for running its business, with the functions listed in § 1 (3) according to the product and plan booked. In doing so, it processes personal data on behalf of and on the instructions of the Customer. The Customer is the controller of that processing within the meaning of Art. 4(7) GDPR.

(2) This agreement forms part of the contract for the use of the platform (main contract, GTC). In the event of conflict, it prevails in matters of data protection, including over the GTC rules on deletion after the end of the contract.

(3) The following processing does not fall under this agreement; for it the Provider is a controller itself, and its privacy policy describes it:

1. contract, billing and payment data of the Customer and its users towards the Provider (subscription, add-ons, text message credit);
2. the platform-wide customer account (§ 2 (4));
3. audience measurement and usage analysis on the platform's pages, including the Customer's website, booking page and customer portal and its back office (Annex 3, items 2 and 3);
4. contact, feedback and support requests to the Provider.

The Provider lists this processing in Annex 3 so that the Customer can inform its customers and employees correctly.

§ 1 Subject matter, nature, purpose and duration of the processing

(1) Subject matter: providing and operating the platform and the related processing of personal data for the Customer's management of appointments, customers, vehicles, orders, staff and billing.

(2) Nature: collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission (to the Customer's authorized users, to the data subject and to the parties named in Annexes 2 and 3), alignment, combination, restriction, anonymization and erasure, in each case automated within the platform.

(3) Purpose: solely the provision of the agreed services, to the extent the Customer uses them:

No processing for the Provider's own purposes — in particular advertising, profiling, disclosure to third parties for their purposes and training of AI models — takes place with the data under this agreement. Preamble (3) remains unaffected.

(4) Duration: the term of the main contract. This agreement does not end before the obligations under § 9 have been fulfilled.

§ 2 Data subjects and categories of data

(1) Data subjects

• the Customer's customers: people who book, request or attend an appointment, are in the customer records, bring a vehicle, approve a cost estimate or receive an invoice;
• keepers and drivers of vehicles, where they are not customers themselves;
• the Customer's employees (as a calendar resource, as the person carrying out or checking work, as holder of a staff account);
• applicants;
• reviewers (Google reviews of the business shown on its website);
• third parties whom the Customer records in free text (e.g. companions).

(2) Categories of data — all products

(3) Categories of data — Werkstattsystem only

Time tracking, quality control and work items are employee data relating to performance. Whether and how the Customer evaluates them is its responsibility; the Provider does not evaluate them.

(4) The customer account. A customer account (email, password hash, first and last name, phone, language, profile picture, confirmation and reset identifiers, time of consent to show appointments at practices under “My appointments”) is platform-wide: the same sign-in works at every business, and each customer portal shows only that business's data. The Provider is the controller of the customer account itself (Preamble (3) no. 2). The customer record and the appointments, vehicles, orders and invoices at the Customer are processing on behalf under this agreement. The link between account and customer record is created with the first booking and only for a confirmed email address.

(5) Special categories (Art. 9 GDPR) and data under Art. 10 GDPR

a) Health tier. No field of the platform is meant for customers' health data. For a Customer in a trade under Annex 4 (healthcare practices), however, the mere fact that a person has made an appointment is health data (Art. 9(1) GDPR), as are the service chosen and the treating person. For making appointments, the Customer usually relies on Art. 6(1)(b) in conjunction with Art. 9(2)(h) GDPR; reminders and review requests are not covered by that basis (§ 5 no. 6). For Customers under Annex 4 the following applies, changeable in the booking settings:

1. Reminders and review requests are switched off until the Customer switches them on after obtaining its patients' consent. Anyone who has not consented or withdraws consent is marked on the customer record as “no reminders or review requests” and receives none.
2. Reminders by email and text message do not name the service.
3. Completed appointments are deleted after the retention period, not anonymized (§ 9 (4)).
4. No session recording runs on the Customer's website, booking page, customer portal or back office (Annex 3, item 3); cookieless audience measurement (Annex 3, item 2) remains.
5. In the platform-wide customer account, the Customer's appointments appear only if the person has expressly consented there. Consent is stored with its time and can be withdrawn there.
6. The booking form names the Customer as controller and the Provider as the party that manages the appointments on its behalf.

b) Free text. Record, appointment, request, vehicle and defect notes may come to contain details such as allergies, skin sensitivity, pregnancy or medication, and workshop notes details of an accident or criminal proceedings. Whether to record such details is the Customer's decision; it needs its own legal basis for doing so (for Art. 9 GDPR usually explicit consent). The platform offers no field-level special protection: whoever may see a customer record or an appointment also sees its free text.

c) Employee illness. The absence type “illness” and the origin “sick note” record the fact of an illness. The legal basis and access rules are the Customer's responsibility. A diagnosis is not a field and should not be written into the free text.

d) Minors. The platform does not ask for age. Whether the Customer accepts bookings by minors is its decision.

§ 3 Instructions

(1) The Provider processes the data only on documented instructions from the Customer, including with regard to transfers to third countries (§ 7). The basic instruction consists of the main contract, the service description and this agreement.

(2) The settings the Customer makes on the platform count as documented individual instructions, in particular: retention periods for appointments and applications (§ 9 (4) and (5)), reminders and review requests, text message reminders per level, use of the AI assistant (§ 7 (2)) and of the registration lookup (§ 7 (4)), setting up a business mailbox, display of Google reviews, publishing job postings, follow-up reminder per service, service area and travel time for appointments at the customer's.

(3) The Customer gives further instructions in text form to the Provider's contact point. Those entitled to give instructions are the account holder and the persons the business names for this; on the platform, also staff accounts with the role “manager”, to the extent they can change settings.

(4) If the Provider considers an instruction to be unlawful, it informs the Customer without undue delay (Art. 28(3) second subparagraph GDPR) and may suspend its execution until it is confirmed or changed.

§ 4 Obligations of the Provider

The Provider

1. processes the data only in accordance with § 3;
2. commits all persons who have access to the data to confidentiality, unless they are under a statutory obligation of confidentiality;
3. takes the technical and organizational measures under Art. 32 GDPR set out in Annex 1 and keeps them up to date; material deteriorations are excluded;
4. complies with the conditions for sub-processors under § 6;
5. assists the Customer with requests from data subjects (Art. 12 to 22 GDPR). The platform allows the Customer to view, correct and delete customer records, appointments, vehicles and applications. On request, the Provider produces a complete machine-readable export per person as a CSV file within 14 days. If a data subject contacts the Provider, it forwards the request to the Customer without undue delay; if the request concerns the customer account (§ 2 (4)), the Provider answers it itself;
6. assists the Customer with the obligations under Art. 32 to 36 GDPR;
7. notifies the Customer of personal data breaches without undue delay after becoming aware of them, at the latest within 48 hours, with the information under Art. 33(3) GDPR as far as available, and supplements it on an ongoing basis;
8. names Andreas Gerum, reachable via the contact point, as contact person for data protection and, where required by law, a data protection officer;
9. makes available to the Customer all information necessary to demonstrate compliance with these obligations (§ 8);
10. informs the Customer without undue delay of inspections and measures by a supervisory authority, to the extent they concern this agreement, and of requests from authorities for the Customer's data, to the extent this is legally permitted.

§ 4a Professional secrecy (§ 203 German Criminal Code)

(1) Scope. This section applies if the Customer or a person working for it belongs to the persons named in § 203(1) or (2) of the German Criminal Code (StGB) — in particular physicians, dentists, veterinarians and members of a healthcare profession that requires state-regulated training to practice or to use the professional title (e.g. physiotherapy, occupational therapy, speech therapy, podiatry).

(2) Participating person. The Provider participates in the Customer's professional activity within the meaning of § 203(3) second sentence StGB. It undertakes to keep secret all third-party secrets that become known to it in the course of or on the occasion of its work for the Customer, also after the end of this agreement. It is aware that under § 203(4) first sentence StGB it commits a criminal offence if it discloses such a secret without authorization.

(3) Knowledge only where necessary. The Provider obtains knowledge of third-party secrets only to the extent necessary to fulfil this agreement, for example for a fix the Customer has requested.

(4) Own personnel. The Provider commits every person who is given access to the data to secrecy in text form before they start, and informs them of the criminal liability under § 203(4) StGB.

(5) Sub-processors. Where the Provider engages sub-processors (§ 6, Annex 2), it ensures that they are bound to secrecy and in turn bind their personnel and further subcontractors (§ 203(4) second sentence no. 2 StGB). Under their contracts, the hosting provider (Annex 2, items 1 and 2) and the text message provider (item 3) use only persons who are committed to confidentiality. No patient data is held in the object storage (item 4). The AI assistant (items 5 to 7) is not available to Customers under paragraph (1).

(6) Notification. If the Provider has reason to believe that a secret has been disclosed without authorization, it informs the Customer without undue delay; § 4 no. 7 applies accordingly.

§ 5 Obligations of the Customer

The Customer

1. is responsible for the lawfulness of the processing, in particular for a legal basis for email and text message reminders, service and inspection reminders, review requests, follow-up reminders and the recording of free text under § 2 (5);
2. informs its customers, employees and applicants under Art. 13 and 14 GDPR, including about the recipients in Annexes 2 and 3 and, if it uses the registration lookup, that vehicle details come from a public register;
3. sets the retention periods on the platform (§ 9 (4) and (5)) that match its deletion policy; as long as it sets no period for appointments, they remain stored — except for Customers under Annex 4 (§ 9 (4));
4. assigns staff accounts and roles on a need-to-know basis and revokes them when people leave;
5. notifies the Provider without undue delay of errors or irregularities it finds when checking the results;
6. obtains — under Annex 4 only — its patients' consent for reminders by email or text message and for review requests, and can demonstrate it. The platform does not ask for it in the online booking; it sends reminders and review requests only once the Customer switches them on in the booking settings. A template for consent at reception is in its back office (Configuration, section “Details for your imprint”). The Customer marks anyone who has not consented or withdraws consent on the customer record;
7. transfers — under Annex 4 only — content that must be documented into its treatment records. The platform's calendar, customer record and free text are not treatment records;
8. names — under Annex 4 only — the Provider as a recipient in its privacy information and offers a way to an appointment other than online booking, for example by phone. A template for this text is in its back office (Configuration, section “Details for your imprint”).

§ 6 Sub-processors (Art. 28(2) and (4) GDPR)

(1) General authorization. The Customer authorizes the sub-processors listed in Annex 2 and gives general written authorization for further ones. The Provider informs the Customer of any intended addition or replacement at least 30 days in advance in text form, by email to the account address and by a notice on the platform.

(2) Objection. Within that period, the Customer may object for an important reason under data protection law. If no solution is found, it may terminate the main contract extraordinarily for the service concerned, with effect from the time of the change; fees paid in advance for the period after that are refunded pro rata.

(3) Flow-down. The Provider contractually imposes on every sub-processor essentially the same data protection obligations as this agreement, in particular sufficient guarantees for appropriate technical and organizational measures. It is liable to the Customer for their fulfilment.

(4) Services the Provider uses as ancillary services (e.g. telecommunications, post) and the parties listed in Annex 3, which receive data as controllers in their own right or as a public data source, are not sub-processors.

§ 7 Place of processing, third countries, particular recipients

(1) Core processing. The application, database, files and email run at a hosting provider in Germany (Annex 2, items 1 and 2, data center in Frankfurt am Main), which backs up data and emails daily. Application attachments and website, gallery and review images are held by an object storage provider in Frankfurt am Main whose group is headquartered in the United States (Annex 2, item 4). The Customer chooses the video service of an online appointment; the Provider transmits nothing to it and only shows the Customer's link in emails and the customer portal.

(2) Transfers to third countries. A transfer to a country outside the EU and the EEA takes place only for the AI assistant, on the basis of Art. 44 et seq. GDPR:

• An AI assistant is available in the Salon Wizard back office; its scope depends on the plan. Where possible, the assistant answers an input from fixed rules without any third party. Only an input that no fixed rule answers is sent for classification to the model provider under Annex 2, item 5. If that provider does not answer, its use reaches a cost or rate limit or no access is set up for it, the assistant answers the input from fixed rules; no other provider is asked. The provider processes in the United States.
• What is sent is the input in masked form, the interface language, the date, the open area and, following a list shown beforehand, identifiers without names. Data looked up (customer records, appointments, absences, revenue), contact details from the database and earlier inputs and answers are not sent.
• Masked means: before sending, the Provider replaces email addresses, phone numbers and the names the Customer keeps on the platform (staff, staff accounts, customers and their confirmed customer accounts, names from appointments and appointment requests of the last 90 days and from future appointments, applicants) in the input with placeholders. If that fails, the input is sent to no provider. Masking is not anonymization: names the Customer does not keep, nicknames, inflected or misspelled names, names that are also everyday words, very short parts of names, phone numbers written with dots or with fewer than eight digits and anything else a person writes into the input are sent unchanged. The Customer instructs its authorized persons not to enter health data or other special categories of personal data into the assistant.
• The basis for the transfer is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where a provider is certified under the EU-U.S. Data Privacy Framework, the adequacy decision for it (Art. 45 GDPR), in each case as set out in Annex 2.
• The Provider itself stores counters, costs and times for the assistant per business and per user, neither inputs nor answers.

The text message provider is used through its EU platform; no transfer to a third country takes place.

(3) No other transfers to third countries take place. Future ones take place only under § 6 (1) and Art. 44 et seq. GDPR.

(4) Registration lookup (Werkstattsystem only, Dutch registration numbers only). If the Customer uses the lookup in the vehicle form or the nightly check of inspection dates, the Provider sends only the registration number to the open vehicle register of the Dutch vehicle authority and adds the vehicle details to the vehicle record. There is no contract with the register; it is a data source and recipient within the meaning of Annex 3.

(5) Card payment through the Customer's Stripe account (only businesses established in Germany). If the Customer connects its own Stripe account and an authorized person starts a card payment, the Provider sends, on that instruction, to the Customer's payment provider the amount, currency, the service description with the booking number and internal identifiers, and for a payment made up of line items also the description, quantity and unit price of each item — not the customer's name, email address or phone number. The description of a custom item is the Customer's free text; it enters no customer details there. The customer gives the card to the payment provider directly. The Provider receives back the outcome of the payment and the card details listed in § 2 (2). The payment provider is the Customer's contractual partner and not a sub-processor of the Provider; the money goes directly to the Customer's account (Annex 3, item 10). For a paid card payment the Provider creates a receipt; if the customer booked with a customer account with a confirmed email address, the Provider sends the receipt there unless the customer has opted out.

(6) Recipients without processing on behalf (including web analytics, maps, geocoding, fonts in emails) are listed in Annex 3.

§ 8 Evidence and audits

(1) The Provider demonstrates compliance with this agreement primarily through the current description of the technical and organizational measures (Annex 1), evidence from the sub-processors and, where available, certificates (Art. 28(3)(h) GDPR).

(2) If that is not sufficient, the Customer may carry out audits, including on site, itself or through an auditor bound to confidentiality, after giving 14 days' notice, during business hours and without disproportionate disruption of operations. Sub-processors' data centers are audited through their evidence.

(3) Each party bears its own costs. For each further audit in the same calendar year, the Provider may charge its documented effort.

§ 9 Retention, deletion and return

(1) After the end of the contract the Provider deletes or returns all data under this agreement, at the Customer's choice, and deletes existing copies unless there is a legal obligation to store them (Art. 28(3)(g) GDPR). On request it provides an export within 30 days of the end of the contract and deletes the data within a further 30 days; backups follow with the hosting provider's rotation. On request it confirms the deletion in text form.

(2) Immediate deletion by the Customer. If the Customer removes the product in its account, the uploaded files are deleted immediately and permanently, and with the product its settings and business data. On request the Provider produces an export as a CSV file within 14 days; invoices and reports, among others, can be downloaded individually.

(3) Retention under commercial and tax law is the Customer's responsibility. Books, records and accounting vouchers are subject to § 147 of the German Fiscal Code (AO). The Provider is not the Customer's statutory archive; before a deletion under paragraph (1) or (2), the Customer secures the records it must keep itself.

(4) Retention period for appointments. The Customer can set a period of 90 to 3,650 days; without a setting it is off. A daily run clears, for completed appointments whose end lies further back than the period, the free text and the contact details given at booking as well as the address of appointments at the customer's, and records the time. Date, service, staff member, price, booking number and the link to the customer record are kept. The same run clears the comment, reason for refusal and contact details of answered appointment requests once the period since the answer has passed, and removes the phone number for those appointments from the text message log. An open request is never touched. For Customers under Annex 4 a period of five years applies without a setting of their own; when it has passed, the run deletes the completed appointment together with the answered request for it instead of anonymizing it, and first removes the phone number from the text message log. The date of the last attended appointment remains on the customer record. Entries on a course's waiting list are deleted once its start has passed.

(5) Retention period for applications. 180 days by default, adjustable from 30 to 365 days. Applications with a final status are deleted together with their attachments when the period has passed.

(6) No automatic period applies to customer records, vehicles, orders, cost estimates, time tracking, tire storage, text message logs and absences. They remain stored until the Customer deletes them or the contract ends.

(7) Backups are deleted in the hosting provider's regular rotation (Annex 1).

§ 10 Liability, changes, final provisions

(1) Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability rules of the main contract apply to the extent Art. 82 GDPR does not preclude this.

(2) The Provider may change this agreement where legislation, case law, supervisory authorities or a change of the services require it. It announces changes in the same way as changes to the GTC (GTC § 11 (1) and (2)); § 6 applies to new sub-processors. Other changes require text form.

(3) If a provision is invalid, the rest of the agreement remains valid.

(4) German law applies. The place of jurisdiction is Augsburg, to the extent permitted. For a Customer in the United Kingdom, references to the GDPR are references to the UK GDPR.

(5) The German version is binding. This English version is a translation.

Annex 1 — Technical and organizational measures (Art. 32 GDPR)

The hosting provider's measures are taken from its data processing agreement. The Provider itself operates no servers.

1. Confidentiality

• Physical access to the servers (hosting provider, data center in Frankfurt am Main): electronic access control system with logging, high-security fence, control room staffed around the clock, security staff, video surveillance of entrances and exits, organizationally separate granting of access rights.
• Access to the application: passwords are stored only as hashes. Owner and operator accounts can sign in with a second factor or a passkey. All sign-ins are protected by a proof-of-work captcha; the public booking forms limit requests per IP address and per email address. Session cookies are only transmitted encrypted; staff and customer accounts stay signed in for at most seven days. After five wrong passwords within a minute, signing in is blocked for a short time.
• Access within the application: all business data belongs to one business, and every query is bound to it. Operators and owners, staff and customers sign in to separate areas. Staff accounts have the roles staff member, reception or manager, each limited to assigned locations; only managers see colleagues' reasons for illness. The platform-wide customer account shows only each business's own data; the cross-business list “My appointments” shows appointments at practices only after the person's consent.
• Separation: automated tests run on separate, empty databases. Inputs into the AI assistant go to the model provider only in masked form (§ 7 (2)).
• Personnel: every person who is given access to the data at the Provider is first committed to confidentiality and secrecy (§ 4a (4)). The hosting provider and the text message provider use only employees committed to confidentiality.

2. Integrity

• All pages and interfaces only via TLS; sending email and retrieving mailboxes only encrypted; text messages via the text message provider's HTTPS interface on its EU platform.
• Businesses' mailbox passwords are stored encrypted.
• Application logs contain identifiers, not content, and are rotated; records carry creation and modification times.

3. Availability and resilience

• At the hosting provider: daily backup of web space, databases and email; disk mirroring, emergency power generator and uninterruptible power supply; firewalls and permanent protection against denial-of-service attacks; restoration of databases and files.
• At the Provider: critical errors alert the operator immediately; code releases can be rolled back.

4. Deletion and data minimization

• Deletion periods for appointments, appointment requests and applications under § 9 (4) and (5); immediate deletion when the product is removed under § 9 (2).
• Defaults for Customers under Annex 4 (Art. 25 GDPR) under § 2 (5)(a).

5. Processor control and review

• Every recipient is listed (Annexes 2 and 3); new sub-processors are announced 30 days in advance (§ 6).
• Every change to the software passes an automated check with tests, static analysis and a dependency check before release. Project rules on health data, deletion and recipients apply to every change.
• This annex is updated with every change to the hosting provider, recipients or protective measures, at least once a year.

Annex 2 — Sub-processors

Annex 3 — Recipients that are not sub-processors

For the Customer's information, so that it can meet its information obligations (§ 5 no. 2).

Annex 4 — Health tier

Trades whose Customers belong to the health tier (§ 2 (5)(a), § 5 nos. 6 to 8), and trades to which § 4a usually applies. The trade chosen on the platform is decisive; § 4a also always applies where its paragraph (1) is met.