Data Processing Agreement (GDPR article 28)

Forms part of the Terms of use.

Controller: the business using Drin (“Customer”). Processor: Drin (test details), 1 Test Street, 105 57 Athens, VAT 000000000 (“Drin”).

1. Subject matter and duration

Drin processes personal data on the Customer’s behalf only to provide the service described in the Terms of use, for as long as the Customer’s account exists.

2. Nature and purpose

Storing and organising customer and appointment details; preparing the text of reminders and greetings; sending email automatically when the Customer chooses; the customer sign-up page (QR) and the appointment confirm/cancel page; a calendar feed (iCalendar) behind a secret link.

3. Categories of data subjects and data

• Data subjects: the Customer’s customers; the Customer’s users (staff).
• Data: first and last name, mobile, email, birthday, name day, appointments (date, time, status), replies to reminders, notes the Customer writes, consent records (what, when, how), messages prepared or sent.
• Special categories: Drin does not ask for health data. However, an appointment at a clinic or dental practice may count as health data. The Customer ensures a legal basis (GDPR art. 9) and does not write health details in notes or messages.

4. Drin’s obligations

Drin:

1. processes the data only on the Customer’s documented instructions (the Customer’s settings and actions in the app are such instructions);
2. binds everyone with access to confidentiality;
3. takes the security measures in the Annex;
4. uses sub-processors only as set out in section 5;
5. helps the Customer answer data-subject requests (access, rectification, erasure, portability); the Customer can correct and delete customers directly in the app;
6. notifies the Customer of a personal-data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information available;
7. assists the Customer with impact assessments and prior consultation where needed;
8. at the end of the agreement, at the Customer’s choice, returns (exports) or deletes the data within 30 days, unless the law requires retention;
9. makes available the information needed to demonstrate compliance and allows audits with reasonable notice.

Access by Drin staff to a Customer account happens only for support or security and is recorded (who, when, what). The Customer may ask for that record.

5. Sub-processors

The Customer approves these sub-processors:

Drin informs the Customer at least 30 days before adding or replacing a sub-processor; the Customer may object and, if no solution is found, terminate. Each sub-processor is bound by data-protection obligations equivalent to these.

6. The Customer’s obligations

The Customer ensures a legal basis for all processing (e.g. consent for greetings and promotional messages), informs its customers about the processing, and gives Drin only lawful instructions.

Annex: security measures

• Database on infrastructure inside the EU.
• Encryption on every connection (HTTPS with HSTS).
• Sign-in without passwords: one-time code (stored only hashed, expires in 10 minutes, up to 3 attempts) or passkey.
• Rate limits on sign-in and public forms.
• Strict separation of data per business, with a membership check on every request; automated tests that one business cannot see another’s data.
• Access removed immediately when a user is removed from a business.
• Secret, unguessable links for public pages (sign-up, appointment confirmation, calendar), which can be replaced.
• Record of administrator actions; customer emails shown partly hidden in error lists.
• Content Security Policies on the app and website.