Draft: this text isn't final yet. Company details will be filled in and the text legally reviewed before launch.

Data processing agreement

Last updated: October 23, 2026

This data processing agreement is part of the slotivo terms and applies between the business (controller) and [to be completed] (processor).

Subject

We process the business's client data (name, contact details, appointments, payments, notes) only to provide the service and according to the business's instructions.

Confidentiality and security

Staff with access are bound by confidentiality. We take appropriate technical and organisational measures, including encryption, access control and separating data per business.

Sub-processors

The business authorises these sub-processors: Vercel Inc. (hosting, EU/VS); Neon Inc. (database, EU (Frankfurt)); Clerk Inc. (auth, VS); Stripe Payments Europe Ltd. (payments, EU); Resend Inc. (email, EU/VS). We inform the business of changes in advance; the business may object.

Data breaches

We report a data breach to the business without undue delay and no later than 48 hours after discovery, with the information needed to notify the supervisory authority.

Data subject rights

We help the business with client requests for access, correction or deletion.

Termination

After the agreement ends we delete the data within 90 days unless the law requires keeping it. The business can export its data before then.