Data processing agreement

Controller (business):

Name

Address

Registration number

Tax ID

Represented by

E-mail for data protection matters

Processor: [NAZIV PRAVNOG LICA], [ULICA I BROJ, POŠTANSKI BROJ, MESTO], registration number [MATIČNI BROJ], tax ID [PIB], e-mail [privatnost@<domain>].

The agreement is concluded by accepting the Terms of service or by signing this form, and applies from the day the Controller's account is opened.

This agreement sets out the rights and obligations of the parties regarding the processing of personal data that the Processor carries out on behalf of the Controller when providing the Apointo service, in accordance with Article 45 of the Law on Personal Data Protection (the Law).

The Processor collects the data through the Controller's website, stores, organises and displays it to the Controller's authorised users, uses it to send appointment notifications, copies it into backups and erases it, solely to provide online booking and appointment management.

Processing lasts for as long as the contract for the service, subject to the periods in Article 9.

• The Controller's customers: full name, phone number, e-mail address, customer note, appointments (service, staff member, time, status) and the Controller's internal notes.
• The Controller's staff and associates: name, e-mail address, role, working schedule and absences.

The Controller undertakes not to enter special categories of personal data (Article 17 of the Law), for example data on health or allergies, into the service unless it has a legal basis for doing so and has informed the Processor in writing beforehand.

The Processor processes the data only on documented instructions from the Controller. Instructions are this agreement, the settings and actions the Controller makes in the service, and written instructions sent to the Processor's e-mail.

The Processor will inform the Controller without delay if it considers an instruction to be unlawful. The Processor may process data without instructions where required by law, in which case it informs the Controller unless the law prohibits this.

• Ensures that persons with access to the data are bound by confidentiality.
• Applies the technical, organisational and personnel security measures in Annex 2 (Article 50 of the Law).
• Assists the Controller, as far as possible, in responding to data subjects' requests, and forwards requests it receives directly to the Controller without delay.
• Assists the Controller in meeting its obligations under Articles 50 to 55 of the Law (security, data breaches, impact assessment and prior consultation with the Commissioner).
• Makes available to the Controller the information needed to demonstrate compliance with this agreement.

The Processor notifies the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, so that the Controller can notify the Commissioner within 72 hours (Article 52 of the Law). The notification describes the breach, the categories and approximate number of persons and records, the likely consequences and the measures taken.

The Controller gives general written authorisation for the Processor to engage the sub-processors listed in Annex 1. The Processor notifies the Controller at least 30 days in advance of any intended addition or replacement; within that period the Controller may raise a reasoned objection and, if no agreement is reached, cancel the service without penalty.

The Processor binds sub-processors by contract to the same data protection obligations and is liable to the Controller for their performance.

The data is stored in the EU (Frankfurt, Nemačka) region. Data is transferred to sub-processors outside the Republic of Serbia only in accordance with Articles 63 to 65 of the Law and, where the receiving country is not on the list of countries with an adequate level of protection, on the basis of standard contractual clauses or other appropriate safeguards.

When the contract for the service ends, the Controller may export the data within 30 days. After that period the Processor erases all of the Controller's data, unless the law requires it to be kept, and copies in encrypted backups disappear within a further 30 days at the latest.

At most once a year and with at least 30 days' notice, the Controller may verify, itself or through an authorised auditor bound by confidentiality, that the Processor meets its obligations, primarily on the basis of documentation the Processor makes available. The Controller bears the costs of the audit.

The Controller is responsible for the lawfulness of processing, for having a legal basis, for the accuracy of the data it enters and for informing data subjects about the processing (Article 23 of the Law), including that the Processor processes the data on its behalf.

On matters of personal data protection this agreement takes precedence over the Terms of service. The parties' liability is governed by the Law (Article 86) and the Terms of service. The agreement is governed by the law of the Republic of Serbia, and the court of competent jurisdiction in Belgrade has jurisdiction over disputes. The Serbian text prevails.

For the Controller (name, signature, date)

For the Processor (name, signature, date)

• Encrypted data transfer (HTTPS, HSTS) and encryption of data at rest by the infrastructure provider.
• Separation of each Controller's data at the database level (row-level access rules) and role-based access on the principle of least privilege.
• Two-factor sign-in for platform administrators; passwords are stored only as a cryptographic hash.
• Links customers use to manage an appointment are stored only as a hash and cannot be reconstructed from the database.
• A user activity log, without customers' personal data.
• Bot protection for forms and rate limiting.
• Nightly backups encrypted with a public key whose private part is kept outside the infrastructure, in separate storage, with periodic restore tests.
• Removal of e-mail addresses, phone numbers and access links from error reports and logs.
• Regular software updates, automated checks for known vulnerabilities and security headers (CSP).
• Written procedures for incidents, recovery and key rotation.