Data Processing Agreement

1. The parties and their roles

The business that creates a Sitebook account ("the controller" or "you") decides why and how its customers' details are used. [ΕΠΩΝΥΜΙΑ ΕΤΑΙΡΕΙΑΣ / COMPANY NAME] ([ΝΟΜΙΚΗ ΜΟΡΦΗ / LEGAL FORM]), based at [ΔΙΕΥΘΥΝΣΗ ΕΔΡΑΣ / REGISTERED ADDRESS] ("the processor" or "we"), stores and processes those details on the business's behalf, through Sitebook.

This agreement is part of the Terms of Service and applies for as long as we process such details. It applies from the moment the business accepts the Terms of Service. The controller's details are those of the business's account in Sitebook. ⚖ Lawyer check

2. Subject and purpose

We process the details only to provide the Sitebook service: so the business can take bookings, manage them and contact its customers about them.

• Types of data: name, phone, email (optional), booking message (optional), the business's private notes about the customer, history of bookings and packages, date and version of the consent.
• People concerned: the business's customers and, if the business adds them, the members of its team.
• Special categories of data: Sitebook has no fields for them. The optional booking message is free text and may contain such details. If the business needs them, it is responsible for the lawfulness and for the extra safeguards. ⚖ Lawyer check
• Duration: as long as the business has an account, and as long as deletion afterwards takes.

3. The controller's instructions

We process the details only on the business's documented instructions. The instructions are the settings and actions the business takes in the dashboard, and this agreement. We do not use the details for our own purposes, sell them or combine them with other data. If we think an instruction breaks the law, we will tell the business. ⚖ Lawyer check

4. Confidentiality

The people on our side who have access to the details are bound to keep them confidential and see them only when needed, for example for support you asked for. [HOW OUR STAFF ACCESS IS RECORDED] ⚖ Lawyer check

5. Security

We apply the technical and organisational measures in Annex B. We review them from time to time and improve them. We do not claim certifications we do not have. ⚖ Lawyer check

6. Subprocessors

The business allows us to use other providers to deliver the service. The current list is in Annex C. We will tell the business at least [NUMBER] days before we add or change a subprocessor, and the business may object. If the disagreement is not resolved, the business may delete its account. We agree data protection terms with each subprocessor that are equivalent to these, and we stay responsible to you for its obligations. ⚖ Lawyer check

7. Transfers outside the EEA

We do not transfer details outside the European Economic Area except with the safeguards the law provides, such as standard contractual clauses or an adequacy decision. [TRANSFER SAFEGUARDS PER SUBPROCESSOR] ⚖ Lawyer check

8. Helping the business

We help the business answer its customers' requests (access, correction, deletion, restriction, portability, objection). The dashboard has tools for this: data export in JSON and CSV, deleting a customer, a retention setting and an activity log. If a customer writes to us directly, we will pass the request to the business without answering it ourselves. We also help, as reasonably requested, with impact assessments, with contact with authorities and with handling incidents. ⚖ Lawyer check

9. Personal data breaches

If we learn of a breach that affects the business's customers' details, we will tell the business without undue delay and no later than [HOURS]. We will give it the information we have so it can notify the authority and its customers, if needed. ⚖ Lawyer check

10. Deletion or return at the end

When the agreement ends, the business can download its data (JSON and CSV) from Settings. We then delete the details from our systems within [DELETION PERIOD]. Backups are deleted within [BACKUP PERIOD]. If the law requires us to keep something, we keep it only for that purpose. If the business asks, we will confirm the deletion in writing. ⚖ Lawyer check

11. Audits and information

We can give the business the information it needs to show that these terms are followed. If an audit is requested, it will be done with reasonable notice, once a year unless there is an incident, in working hours and with respect for security and for the details of our other customers. [COST OF AN AUDIT] ⚖ Lawyer check

12. Liability and governing law

Each party's liability is governed by the Terms of Service, except where the law says otherwise. Greek law applies. If this agreement and the Terms of Service differ on data protection, this agreement prevails. ⚖ Lawyer check

Annex A: Details of the processing

• Nature of the processing: storing, organising, showing to the business, exporting, deleting, and sending booking emails to the customer (once an email provider is connected).
• Purpose: managing bookings and communicating about them.
• Types of data and people concerned: as in part 2.
• Retention: set by the business in Settings. Default: 24 months after the last booking. ⚖ Lawyer check

Annex B: Technical and organisational measures

• Encrypted connection (HTTPS) between the browser and the service.
• Separation of data: access rules in the database so each business sees only its own details. Visitors to a public page cannot reach customer details.
• The secret administration key of the database is never sent to the browser.
• Passwords: kept by the sign in service in scrambled form. Repeated sign in attempts are limited.
• A log of actions on customer details (viewing, changing, exporting, deleting), without the details themselves.
• Automatic deletion of old details according to the retention setting. It is not switched on yet. ⚖ Lawyer check
• Backups: [DESCRIPTION OF THE DATABASE PROVIDER'S BACKUPS]. ⚖ Lawyer check
• Staff access: [WHO HAS ACCESS AND HOW IT IS RECORDED]. ⚖ Lawyer check

Annex C: Subprocessors

• Supabase: database, user sign in, file storage. Region: [ΠΕΡΙΟΧΗ ΒΑΣΗΣ ΔΕΔΟΜΕΝΩΝ / DATABASE REGION].
• Vercel: hosting of the application and the websites. Region: [ΠΕΡΙΟΧΗ ΦΙΛΟΞΕΝΙΑΣ / HOSTING REGION].
• [ΠΑΡΟΧΟΣ EMAIL / EMAIL PROVIDER]: sending booking emails. Not connected yet.
• Analytics tool: none for now.
• Payment provider: none for now.

This list must match the providers actually used and the agreements signed with them. ⚖ Lawyer check