Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the business that uses Gooingto (the "Controller", "you") and Gad Lopez Alvarez (the "Processor", "Gooingto", "we"). It applies automatically when we process personal data on your behalf and meets the requirements of article 28 of the GDPR.
1. Subject matter, nature and purpose
We process personal data on your behalf only to provide the Gooingto service: hosting your public booking page, receiving and storing booking requests, letting you manage them in the panel and sending you related notices.
2. Data and data subjects
- Categories of data subjects: your clients who request appointments and your professionals.
- Types of personal data: name, requested date and time, the professional chosen, and the WhatsApp number where provided or received.
- Duration: for as long as your account exists, until you or we delete it.
3. Our obligations as Processor
- Process the data only on your documented instructions, which are these terms and your use of the panel, unless the law requires otherwise (in which case we will inform you unless the law forbids it).
- Ensure that people authorised to process the data are bound by confidentiality.
- Apply appropriate technical and organisational security measures (Annex 1).
- Respect the conditions for engaging sub-processors (section 4).
- Help you, taking into account the nature of the processing, to answer requests from data subjects to exercise their rights. If a data subject contacts us directly, we will refer them to you.
- Help you comply with your security, breach notification and impact assessment duties (GDPR articles 32 to 36).
- Notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data.
- At the end of the service, delete your data (or return it on request) and delete existing copies, unless the law requires us to keep them.
- Make available the information necessary to demonstrate compliance and allow reasonable audits, on reasonable notice and without disrupting the service.
- Inform you if we believe an instruction breaches data protection law.
4. Sub-processors
You give us a general authorisation to use the sub-processors below. We will inform you of any planned addition or replacement so that you can object on reasonable grounds; if we cannot resolve it, you may terminate the service. We impose on each sub-processor obligations equivalent to this DPA.
| Sub-processor | Purpose | Location |
|---|---|---|
| Acens Technologies, S.L. (Hostalia) | Hosting and database | Spain (EU) |
| Resend, Inc. | Sending service emails | United States (SCCs / EU-US DPF) |
5. International transfers
The data is stored on servers in the European Union. Because we operate from Georgia, which is outside the European Economic Area and has no adequacy decision, where you are established in the EEA the parties agree that the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference, with you as data exporter and us as data importer, the supervisory authority being that of your establishment, and the details in sections 1 to 4 and Annex 1 serving as their annexes. We transfer data onward only under an adequacy decision, the Standard Contractual Clauses or another mechanism allowed by the GDPR.
6. Your obligations as Controller
You are responsible for having a lawful basis to process your clients' data, for informing them (including about the use of WhatsApp), for the accuracy of the data you enter and for deciding how long to keep it. You must not send us special-category data.
7. Liability and governing law
The liability provisions of the Terms of Service apply to this DPA. This DPA is governed by the law that governs the Terms.
8. Contact
For questions about this DPA or to exercise your rights: [email protected].
Annex 1: Security measures
- Encrypted connections (HTTPS/TLS) for all traffic.
- Passwords and PINs stored only as salted hashes.
- Access to each business's data restricted to that business's authenticated session; internal administration access limited and protected by credentials.
- Rate limiting on login and sensitive actions; protection against cross-site request forgery.
- Hosting in a data centre in the European Union with the provider's physical and network safeguards and backup arrangements.
- Deletion of an account's data on request or on account deletion.