Zusatz zur Auftragsverarbeitung

1. Definitions and scope

Applicable Data Protection Law means the GDPR, the Irish Data Protection Acts 1988 to 2018, and any other privacy or data-protection law that applies to processing under this DPA.

Customer Personal Data means Personal Data contained in Customer Content that Caballus processes as processor on the Customer's behalf through the Service.

Personal Data, Controller, Processor, Data Subject, Process and Supervisory Authority have the meanings given by Applicable Data Protection Law.

Security Incident means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data processed by Caballus. It does not include unsuccessful attempts that do not compromise Customer Personal Data.

Subprocessor means another processor engaged by Caballus to process Customer Personal Data.

Caballus is a Processor and the Customer is the Controller, or a Processor appointing Caballus as a subprocessor, for Customer Personal Data. Each party remains responsible for its own compliance with Applicable Data Protection Law.

This DPA does not apply to personal data for which Caballus determines the purposes and means, such as account administration, Caballus subscription billing, security, legal compliance and business operations. The Clearslot Privacy Notice covers that processing.

2. Processing instructions

Caballus will process Customer Personal Data only:

• to provide, secure, maintain and support the Service in accordance with the Agreement;
• as configured or initiated by authorised Customer users;
• on other documented instructions from the Customer that Caballus has agreed to follow; or
• where Union or Member State law to which Caballus is subject requires processing, in which case Caballus will inform the Customer before processing unless that law prohibits notice on important grounds of public interest. Other government requests are assessed under sections 11 and 12 and do not by themselves displace these instruction and transfer requirements.

The Agreement, this DPA, the Customer's use and configuration of the Service, and supported requests from authorised users are the Customer's documented instructions.

Caballus will promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. Caballus may suspend the affected processing until the parties resolve the issue. Bespoke work outside the Service may require an agreed scope and fee, but this does not limit Caballus's mandatory duties to assist, return or delete data, or demonstrate compliance.

3. Customer responsibilities

The Customer warrants that:

• it has a lawful basis for the processing and has given all required notices;
• its instructions and use of the Service comply with Applicable Data Protection Law;
• Customer Personal Data is adequate, relevant and limited to what is necessary;
• it will respond to Data Subjects and authorities as Controller and use available Service controls before requesting additional assistance; and
• it will not submit payment-card numbers in free-text fields, passwords, authentication secrets, government identity numbers, health or other special-category data, or criminal-offence data.

If the Customer is itself a Processor, it confirms that the relevant Controller has authorised the Customer to appoint Caballus and Caballus's Subprocessors.

4. Confidentiality and personnel

Caballus will ensure that people authorised to process Customer Personal Data:

• access it only where necessary for their responsibilities;
• are bound by contractual or statutory confidentiality duties; and
• receive appropriate privacy and security instructions.

Caballus remains responsible for its personnel's compliance with this DPA.

5. Security

Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risk to individuals, Caballus will maintain appropriate technical and organisational measures designed to protect Customer Personal Data. The current measures are described in Schedule 2.

The Customer is responsible for using the Service securely, including managing user access, protecting credentials, configuring booking forms and integrations appropriately, and keeping its devices and connected services secure.

Caballus may update the measures as technology and risks change, provided the overall level of protection does not materially decrease while it processes Customer Personal Data. These protections apply to free and paid accounts.

6. Subprocessors

The Customer gives Caballus general written authorisation to use the Subprocessors in Schedule 3 and to appoint replacements or additional Subprocessors.

Caballus will:

• impose data-protection obligations on each Subprocessor that are no less protective in substance than the obligations applicable to Caballus under this DPA, to the extent relevant to the subcontracted processing;
• remain responsible to the Customer for the Subprocessor's performance of those obligations as required by Applicable Data Protection Law; and
• publish an updated schedule and give the account administrator at least 15 days' written notice before a Subprocessor directly appointed by Caballus starts processing Customer Personal Data, allowing an opportunity to object before engagement.

For changes to a listed provider's own subprocessors, Caballus will pass on relevant notices promptly, identify the affected processing and give the Customer an opportunity to object before the change takes effect. The notice will state the applicable objection deadline. If the provider's timetable does not allow a meaningful prior opportunity to object, Caballus will seek specific prior written authorisation or suspend the affected processing. Provider notice periods do not override the Customer's statutory rights.

The Customer may object in writing during the notice period on reasonable, documented data-protection grounds. The parties will try in good faith to resolve the objection, including a commercially reasonable configuration change where available. If they cannot resolve it, Caballus will not use the disputed Subprocessor for that Customer's data, or either party may terminate the affected Service before that processing begins. Caballus will refund prepaid fees attributable to the unused terminated period. Mandatory rights and remedies remain unaffected.

For an urgent replacement, Caballus will seek specific prior written authorisation for a shorter period or suspend the affected processing if necessary. Urgency alone does not remove the Customer's statutory authorisation and objection rights.

7. Assistance with Data Subject requests

Taking into account the nature of processing, Caballus will assist the Customer through Service functionality and reasonable additional measures to respond to requests to access, correct, erase, restrict, object to or port Customer Personal Data.

If Caballus receives a request relating to Customer Personal Data and can identify the Customer, Caballus will ordinarily direct the requester to the Customer and notify the Customer. Caballus will not respond on the Customer's behalf unless instructed or legally required.

If a request requires material work beyond standard Service functionality, Caballus may charge reasonable costs agreed in advance, unless Applicable Data Protection Law requires assistance without charge. A fee discussion must not obstruct mandatory assistance or a statutory response deadline.

8. Security Incidents

Caballus will notify the Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The notice will include, as information becomes reasonably available:

• the nature of the incident;
• the categories and approximate numbers of affected Data Subjects and records;
• likely consequences;
• measures taken or proposed; and
• a contact for follow-up.

Caballus will take reasonable steps to contain, investigate and mitigate the Security Incident and will provide information reasonably needed for the Customer's notification and documentation duties. Notification is not an admission of fault or liability.

The Customer is responsible for notifying Supervisory Authorities, Data Subjects and others unless law assigns that duty to Caballus.

9. Compliance assistance

Taking into account the nature of processing and information available to it, Caballus will provide reasonable assistance with the Customer's obligations concerning processing security, breach notification, data-protection impact assessments and prior consultation with a Supervisory Authority.

Caballus may satisfy this obligation through documentation, security information, questionnaires, audit summaries and responses reasonably suited to the risk. Material bespoke assistance may be charged at reasonable rates agreed in advance, except where the need arises from Caballus's breach of this DPA or law requires assistance without charge. A fee discussion must not obstruct mandatory assistance or a statutory deadline.

10. Demonstrating compliance and audits

Caballus will make available information reasonably necessary to demonstrate compliance with this DPA.

The parties will first consider current reports and written information where these provide sufficient assurance. Caballus will allow and contribute to audits, including inspections, by the Customer or an auditor it mandates. Ordinarily one planned audit per 12 months and 30 days' notice are sufficient; additional audits or shorter notice are permitted where reasonably necessary to assess compliance, following an incident or material change, or where required by Applicable Data Protection Law or a Supervisory Authority.

An audit must:

• use reasonable notice and business hours where practicable;
• minimise unnecessary disruption to operations;
• be limited to systems and records relevant to the Customer;
• be performed by the Customer or an independent auditor that is not a Caballus competitor and is bound by confidentiality; and
• protect other customers' data and security; testing or production access must use agreed safeguards without preventing an inspection required by law.

The Customer bears its own audit costs. Any charge for Caballus's additional assistance must be reasonable, agreed in advance and must not obstruct mandatory audit rights; no such charge applies to remedy Caballus's material breach. Caballus may propose an alternative that gives equivalent assurance, but cannot use it to exclude a legally required inspection.

11. Government and third-party requests

Unless prohibited by law, Caballus will notify the Customer of a legally binding request for Customer Personal Data from a public authority. Caballus will assess the request, disclose only data it reasonably believes it must disclose, and challenge disproportionate or unlawful requests where there are reasonable grounds to do so.

12. International transfers

Caballus processes Customer Personal Data in the EEA and uses providers that process it in other countries, including the United States, as described in Schedule 3. This includes storage, email delivery, network processing and remote access for support or operations. EU hosting of the primary application does not mean that all processing takes place in the EU or EEA.

For a transfer restricted by Applicable Data Protection Law, Caballus will use a valid transfer mechanism, such as an adequacy decision, the EU-US Data Privacy Framework for an eligible participating recipient, or the European Commission's Standard Contractual Clauses (SCCs), and will implement supplementary measures where required.

Before a restricted transfer relying on SCCs begins, the relevant parties must put in place the applicable official clauses, select the correct module and options, complete the required annexes, and assess and implement any necessary supplementary safeguards. This DPA alone does not complete unspecified SCCs or authorise a transfer without a valid mechanism. Caballus will provide information about the applicable safeguards, and a copy where required, with lawful redactions to protect confidential information.

13. Return and deletion

During the subscription, the Customer can access, export and delete Customer Personal Data using supported Service functions.

After the relevant processing services end, Caballus will, at the Customer's choice, return or delete Customer Personal Data and delete existing copies unless Union or Member State law requires storage. Self-service export limitations do not restrict that right. Unless the Customer gives a lawful contrary instruction or an earlier legal deadline applies:

• Caballus will delete or irreversibly anonymise remaining Customer Personal Data in its active systems, and instruct applicable Subprocessors to delete their copies, under its ordinary deletion process within 90 days after termination;
• residual encrypted database backups will be isolated from ordinary use. Hourly database-only recovery points are scheduled to expire after 7 days; designated daily, weekly and monthly generations after 30, 84 and 365 days respectively. Noncurrent object versions are scheduled for deletion a further 30 days after becoming noncurrent, subject to the storage provider's lifecycle processing time;
• independent encrypted media backup history will also be isolated from ordinary use. Four complete current weekly snapshots and their referenced media are retained; noncurrent snapshot references remain protected during their 30-day retention. Older combined database/media backups remain until their existing expiry. Shared media content is deleted only when no retained snapshot references it. Database-only backups do not extend media retention, and media history does not cover every database recovery point; and
• provider residual copies follow the applicable deletion process. For example, Google's Workspace addendum permits up to 180 days to complete deletion after data becomes irrecoverable through the service; ending the Workspace agreement may first involve a recovery period of up to 30 days. These periods concern provider deletion completion, not continued use of the data.

The backup period is not permission to keep using deleted data or to defer a binding deletion instruction. Residual backups remain isolated and protected; if restored for disaster recovery, deletion instructions must be reapplied before restored services reopen. Any retention exception for Customer Personal Data must have the legal basis required by Article 28 GDPR. Separately held controller records, such as Caballus's own invoices or security logs, follow the Privacy Notice and cannot be used as a blanket reason to retain the Customer's booking dataset. This DPA continues to protect retained Customer Personal Data until deletion or anonymisation.

The parties will agree a secure, usable return method. Caballus will protect other persons' information and security secrets without using those safeguards to frustrate mandatory return, portability or switching rights. Any applicable mandatory retrieval or erasure timetable takes precedence over the default schedule above.

14. Liability and order of precedence

The liability exclusions and caps in the Agreement apply in aggregate to the Agreement and this DPA, except to the extent Applicable Data Protection Law does not permit them.

If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA prevails. If valid SCCs conflict with this DPA, the SCCs prevail for the relevant transfer. Except as changed by this DPA, the Agreement remains in effect.

15. Duration and changes

This DPA starts when the Customer accepts the Agreement or when Caballus first processes Customer Personal Data, whichever is earlier. It ends when Caballus and its Subprocessors no longer process Customer Personal Data, subject to surviving confidentiality, deletion and legal obligations.

Caballus may update this DPA where reasonably necessary to reflect law, regulatory guidance, Service or Subprocessor changes, provided the update does not materially reduce mandatory data-protection rights. Notice will be given under the Agreement.

16. Contact

Data-protection contact: [email protected]

Postal address: CABALLUS LIMITED, 2 Bridge Street, Athlone, Co. Westmeath, Ireland

Schedule 1 — Processing details

Subject matter

Provision of Clearslot's scheduling, booking-page, availability, contact, messaging, reporting, integration and related support functionality as configured by the Customer.

Duration

For the term of the Agreement and the deletion/retention period described in section 13.

Nature and purpose

Collection, recording, organisation, storage, retrieval, consultation, use, transmission, display, synchronisation, restriction, deletion and other processing necessary to provide, secure and support the Service on the Customer's documented instructions.

Categories of Data Subjects

• Customer employees, contractors, users, administrators and representatives;
• Bookers, invitees, attendees, prospects, clients and contacts;
• people represented in connected calendars, contact lists or routing-form responses;
• providers or staff whose availability and services are managed; and
• people who communicate with the Customer through Clearslot.

Types of Personal Data

• identifiers, names, contact details, organisation and role;
• account association and access/permission data;
• booking, availability, calendar, meeting, attendance and cancellation data;
• form questions and answers, notes, messages and Customer Content;
• service descriptions, preferences, language and time zone;
• payment amount, currency, status and provider identifiers, but not full card numbers held by Stripe;
• connected-service identifiers, permissions and tokens;
• IP address, device/browser data, timestamps, logs and security events; and
• other Personal Data the Customer chooses to submit consistently with the Agreement.

Sensitive data

The launch Service is not intended or approved for health or other special-category data, criminal-offence data, authentication secrets, full payment-card data or government identity numbers. The Customer must not submit or solicit such data.

Frequency

Continuous or as initiated by the Customer and its users during the term.

Customer instructions for deletion

Service controls, a verified written request, and the default process in section 13.

Schedule 2 — Technical and organisational measures

Caballus maintains measures appropriate to the launch Service and risk, including:

Governance and people

• defined operational responsibility for security and privacy;
• confidentiality duties and need-to-know access;
• review of material provider and system changes; and
• documented incident, backup and restoration procedures.

Identity and access

• unique user accounts and authenticated sessions;
• role- and organisation-based application access controls;
• restricted production and administrative access;
• multi-factor authentication for privileged provider accounts where supported; and
• revocation of sessions and access when an account or role is removed.

Infrastructure and network security

• Cloudflare edge protection, TLS termination, traffic filtering, rate limiting and anti-abuse controls where configured;
• default-restricted origin and database network exposure;
• host firewalls and separation of production services;
• security updates and vulnerability remediation according to risk; and
• secrets kept outside source code and encrypted or access-controlled in operational storage.

Data protection

• TLS for data in transit over public networks;
• client-side encryption of PostgreSQL backups, independent media backup objects and their manifests before upload to Scaleway Object Storage;
• logical separation of Customer data through organisation and access identifiers;
• restricted handling of integration tokens and credentials; and
• data minimisation and supported deletion/export functions.

Monitoring and resilience

• application, authentication and security logging;
• monitoring and investigation of material operational and security events;
• hourly encrypted database-only backups with seven-day hourly retention and designated daily, weekly and monthly lifecycle rules, plus independent weekly encrypted media backup history;
• documented restoration procedures and periodic restore testing; and
• incident containment, recovery and communication procedures.

These measures do not represent a certification or a promise that every control applies identically to every component.

Schedule 3 — Subprocessors and customer-authorised services

A. Core Subprocessors

B. Customer-authorised integrations and other recipients

These providers receive data only for the relevant billing/payment function or when the Customer enables the integration. Depending on the feature and provider terms, they may act as the Customer's processor, Caballus's processor, an independent controller or a joint controller. They are not core Clearslot hosting providers.

The Customer authorises Caballus to transmit the data and instructions necessary for an integration it enables. Data already received by an integration provider remains subject to that provider's terms and the Customer's relationship with it after disconnection.