Data Processing Agreement

1. General Provisions

1.1. This data processing agreement (the "DPA") is concluded between the Customer, as the controller, and the Operator, Majevski, MB (legal entity code 304720404, registered office address Smalinės g. 21-3, LT-06225, Vilnius, Lietuva), as the processor. The DPA is an integral part of the Agreement (clauses 1.2 and 21.1 of the Terms) and sets out the terms referred to in Article 28(3) of Regulation (EU) 2016/679 (the "GDPR").

1.2. The DPA is concluded electronically: the Customer accepts it together with the Terms of Service in accordance with the procedure set out in clauses 1.4 and 1.7 of the Terms. The electronic form meets the requirement of Article 28(9) of the GDPR, so the DPA does not need to be signed separately. From the publication of this version of the DPA, the Operator records, together with the acceptance of the Terms, which version of the DPA the Customer accepted; for a Customer that accepted the Terms earlier, the version of the DPA that applies to it is determined by the date on which the Terms were accepted (clause 1.5 of the Terms).

1.3. The expressions defined in Section 2 of the Terms (for example, Service, Account, User, Owner, Team Member, Client, Client Data, Customer Content, Booking Page, Plan, SMS Gateway, Calendar Link, DEK Identity, Reliability Score, Business Day, Exportable Data and Sub-processor) are used in this DPA with the same meaning. The expressions "personal data", "processing", "data subject" and "personal data breach" are used as defined in Article 4 of the GDPR. References to the Terms mean the version of the Terms that applies to the Customer.

1.4. "Processed Data" means Client Data, data of Team Members processed in the Service and other personal data that the Customer or Users enter, import, synchronise or receive through the Service together with such data (for example, SMS messages of persons who are not Clients, clause 14.7 of the Terms), where the Operator processes them on the Customer's behalf, as well as the data of the Customer's asms.lt account referred to in Section 18 of this DPA. Data that the Operator processes as an independent controller (Section 3 of this DPA) is not Processed Data. For the purposes of this DPA, another processor engaged by the Operator to process Processed Data other than Client Data is also regarded as a Sub-processor (clause 2.23 of the Terms).

1.5. On matters of processing Client Data under Article 28 of the GDPR, the DPA prevails over the Terms to the extent set out in point 3 of clause 33.6 of the Terms. The DPA, including its previous versions, does not change the limits of liability set out in Sections 25 and 26 of the Terms or the commitments and time limits regarding availability of the Service, backups, provision of data and deletion set out in Sections 24 and 30 of the Terms. Where the DPA repeats or refers to the Terms on these matters, the Terms apply.

1.6. The Customer, as the controller, decides which Processed Data is processed in the Service and for what purposes, must have a legal basis for processing it and for transferring it to the Operator, must inform data subjects (clauses 11.3 and 11.4 of the Terms), must ensure that its instructions comply with the law and must handle requests of data subjects. The Customer has the right to give instructions (Section 2 of this DPA), to receive information and carry out audits (Section 10 of this DPA) and to choose the return or deletion of data (Section 12 of this DPA), and is responsible for the actions of Users in the Account (clauses 5.2 and 5.3 of the Terms).

2. Instructions and Limits of Processing

2.1. The Operator shall process Processed Data only on documented instructions from the Customer, including with regard to transfers of data to third countries (Section 7 of this DPA), and only for the purposes described in Sections 15 and 18 of this DPA, except in the cases referred to in clauses 2.5 and 12.6 of this DPA.

2.2. The Customer's documented instructions consist of: 1) the instruction referred to in clause 21.3 of the Terms, which the Customer gives by accepting the Terms; 2) this DPA; 3) the settings selected in the Customer's Account and the functions of the Service used by Users (for example, message rules, Booking Page settings, connection of an asms.lt account and contact synchronisation, Calendar Links, import, campaigns and deletion of records); 4) requests of the Owner made under the Terms and this DPA (for example, under clauses 30.4, 30.7 and 30.9 of the Terms); 5) individual instructions that the Operator has agreed to carry out under clause 2.3 of this DPA.

2.3. An instruction that goes beyond the standard operation of the Service referred to in clause 21.3 of the Terms (an individual instruction) shall be submitted by the Owner by email to pagalba@majevski.com from the Owner's email address (clause 32.3 of the Terms). The Operator shall reply within a reasonable time stating whether it will carry out the instruction. The Operator is not obliged to carry out an individual instruction that would require a change to the operation of the Service or that cannot be implemented by the means available in the Service. Point 6 of clause 26.1 of the Terms applies to individual instructions.

2.4. If, in the Operator's opinion, an instruction of the Customer infringes the GDPR or other data protection law of the European Union or a Member State, the Operator shall immediately inform the Customer of this and may refrain from carrying out that instruction until the Customer amends or withdraws it or until the parties agree in writing that the instruction is lawful. If the Customer demands that the Operator carry out an instruction that the Operator reasonably considers unlawful, the Operator is not obliged to carry it out and may terminate the Agreement in accordance with the procedure set out in clause 29.3 of the Terms or, where such a demand constitutes a material breach of the Agreement, in clause 29.4 of the Terms. This clause does not mean that the Operator verifies the lawfulness of the Customer's instructions, and it does not transfer to the Operator the obligations of the Customer as the controller.

2.5. If European Union or Member State law to which the Operator is subject requires the processing of Processed Data, the Operator shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. At the request of an authority, the Operator shall disclose only the Processed Data that it is required to disclose and shall, where permitted, inform the Customer of this in advance (clauses 20.7 and 23.3 of the Terms).

2.6. The Operator does not use Processed Data for its own marketing, does not sell it and does not transfer it to third parties for their own purposes, except where required by law (clause 21.6 of the Terms), and does not use it to train artificial intelligence models without the Customer's instruction (clause 6.5 of the Terms). The Operator may process Client Data for its own purposes only in the cases referred to in Section 3 and clause 12.6 of this DPA (clause 22.3 of the Terms).

2.7. The emails of all Customers are sent through the shared sending infrastructure of the Service, so repeated sending to non-existent addresses harms the delivery of the messages of all Customers (clause 15.3 of the Terms). When a non-delivery report from the recipient's mail server stating that the address does not exist is returned to the Operator's sending address, the Service records that report and disables the sending of emails to that address in all Accounts that contain a non-deleted Client with the same email address, regardless of which Customer's email was rejected, and the status of the email address of each such Client is marked as not working. Reports of temporary non-delivery are also recorded in all such Accounts, but sending is not disabled. If the recipient's mail server rejects an email already at the time of sending, sending is disabled only for the Account whose email was rejected. By accepting the Terms and this DPA, the Customer instructs the Operator to process the email addresses of its Clients in this way and agrees that non-delivery reports for emails sent to its Clients are also used to disable sending to the email addresses of other Customers' Clients (clauses 15.3 and 21.3 of the Terms).

3. Processing by the Operator as an Independent Controller

3.1. As an independent controller, the Operator processes account and billing data of the Customer, Users and payers, DEK Identity data, anti-abuse data and technical log data, as well as data of visitors to the website and to Booking Pages collected with their consent (cookies and analytics) (clause 21.2 of the Terms). This DPA does not apply to such processing: it is described in the Privacy Policy and the Cookie Policy, and the Operator is responsible for ensuring that such processing complies with the law.

3.2. The Operator processes Client Data as an independent controller only for the purposes referred to in clauses 17.4, 17.5 and 21.4 of the Terms, which are described in clauses 3.3, 3.4, 3.5 and 3.6 of this DPA, including the use of the Client's first name, surname and language from the Customer's client card to create a DEK Identity. The Customer agrees that Client Data is disclosed to the Operator for those purposes, except for the numbers referred to in clause 17.4 of the Terms where the Customer has chosen not to transfer them (clause 21.3 of the Terms). In addition, the Operator obtains technical log data directly from the devices of visitors to the Service website and to Booking Pages (including Clients) (for example, the IP address recorded in the audit log when a booking is made online, the language of messages is changed or a person opts out of emails) and, where visitors consent, analytics data (clause 3.7 of this DPA); such data is not Client Data, and the Operator processes it as an independent controller (clauses 2.9 and 21.2 of the Terms).

3.3. The combined Reliability Score across several businesses (clause 17.4 of the Terms). Only the numbers of attended visits, no-shows and late changes of the Customer's Clients linked to a DEK Identity are used for this purpose, without visit dates, services, notes or the Customer's name. By default, these numbers are transferred; the Customer may choose in the settings of the Service not to transfer them, in which case the combined score is not shown to it either. The numbers from deleted Accounts and deleted client cards are not included in the combined score.

3.4. Protection against abuse (clauses 17.5, 17.7 and 21.6 of the Terms). Information about suspicious activity, including IP addresses and hash values of email addresses, may be transferred to the threat database M Blacklist operated by the Operator (clause 7.8 of the Terms), the data of which is also used to protect other services related to the Operator against abuse. When requests are checked, the IP address, the hash value of the email address and the email domain may be matched against this database or its copy in the Service. M Blacklist makes the list of confirmed threats (IP addresses and their ranges, hash values of email addresses and email domains, without names or email addresses) publicly available so that other websites can also use it to protect their services; this is described in more detail in the Privacy Policy. In the case of a confirmed threat, the Service may automatically reject a login, the creation of an Account, the sending of a password reset link or of a one-time code, or a booking. The Customer or a Client may report blocking which they consider unjustified in accordance with the procedure set out in clause 17.7 of the Terms. The Operator processes this data on the basis of its legitimate interest in ensuring the security of the Service and its users.

3.5. Statistics (clause 21.4 of the Terms). The Operator may prepare and use aggregated anonymised statistics from which the Customer, a Client or any other person cannot be identified, as well as the Customer's usage metrics of the Service.

3.6. DEK Identity (clauses 3.7, 17.3 and 17.4 of the Terms). The Operator processes DEK Identity data, including the one-time codes that the Operator sends to Clients in its own name (clause 15.1 of the Terms), as an independent controller. Updating the email address and phone number of a linked Client on the Customer's client card and displaying the Client's visits in their DEK Identity constitute processing of Processed Data on the Customer's instruction (clauses 15.4 and 15.5 of this DPA). When the Customer's records are removed, DEK Identity data is not deleted, but its link to the removed records is removed (clause 30.9 of the Terms).

3.7. Analytics on Booking Pages (clause 21.6 of the Terms). On Booking Pages, the Operator, as an independent controller, may use analytics tools (for example, Google Analytics or nda.lt) to measure the use of the Service and to improve the Service, but only where the visitor has consented to analytics cookies and similar technologies in the Service's cookie consent window. On the Customer's Booking Page, these tools are used only where the Owner has personally and expressly accepted version 2.1 or a later version of the Terms when creating the Account or in the Service; a notice of an amendment to the Terms alone is not enough for this. The Operator does not use these tools on visit management pages or other pages whose address contains an access token, and where it uses them, it configures them so that they do not receive visit management links, other access tokens or Client Data that the visitor enters or selects in forms. The Operator does not install its own advertising or remarketing tools (for example, Meta Pixel or Google Ads) on Booking Pages, unless the Customer requests this in writing; in that case the roles and responsibilities of the parties are determined by a separate agreement in the form referred to in clause 2.21 of the Terms. Apart from Google Analytics, the Operator may use on Booking Pages only an analytics tool that it has marked as allowed for use there, and it gives that marking only to a tool configured not to record click positions, the text of clicked elements or clicked links (their addresses and labels), not to make session recordings and not to create heatmaps; if nda.lt is used on Booking Pages, it may receive the page view data and other analytics data described in the Privacy Policy, including the page address, which contains no visit management links or other access tokens, but it does not receive click positions, the text of clicked elements or the addresses or labels of clicked links. Analytics data is not Client Data, and the Customer does not receive it.

3.8. The Operator, as the controller, is responsible for ensuring that the processing referred to in this Section complies with the law; Sections 25 and 26 of the Terms apply to the liability of the parties to each other. The Customer shall inform Clients of this processing in its privacy notice (clause 11.4 of the Terms) and may use the Operator's client notice template for this purpose.

4. Confidentiality

4.1. The Operator shall ensure that persons whom it authorises to process Processed Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process Processed Data only in accordance with this DPA and only to the extent necessary to provide the Service, to perform the Agreement and for the purposes referred to in clause 21.5 of the Terms (Article 29 and Article 32(4) of the GDPR).

4.2. The confidentiality obligation of Sub-processors is established by the contracts referred to in clause 6.2 of this DPA.

4.3. The obligation to keep Processed Data confidential applies without limitation in time, including after the data has been deleted, and does not end upon expiry of the period referred to in clause 23.4 of the Terms.

5. Security of Processing

5.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of data subjects, the Operator shall apply the technical and organisational measures set out in Section 16 of this DPA (Article 32 of the GDPR). Notes and custom field values are stored using these measures, but without additional encryption of individual fields (clause 12.4 of the Terms).

5.2. The measures in Section 16 of this DPA are described as they stand on the date of publication of this version of the DPA. The Operator may change and update them, provided that the overall level of protection of Processed Data is not reduced. A change that removes a listed measure without replacing it with an equivalent measure is regarded as an amendment to the DPA, to which Section 31 of the Terms applies. The Operator shall review the measures when the operation of the Service or the Sub-processors change materially, after a personal data breach, and at least once every 12 months.

5.3. The Customer is responsible for the security of its devices, the logins of Users, Calendar Links and other means under its control (clause 16.14 of this DPA; clauses 5.3, 5.5 and 18.1 of the Terms). Before starting to process special categories of data or other sensitive data in the Service, the Customer shall assess whether the measures set out in Section 16 of this DPA, including their limitations set out in clause 16.13, are appropriate to the risk of such processing (clauses 12.2 and 12.4 of the Terms). By accepting the DPA, the Customer confirms that it has read the measures set out in Section 16 of this DPA and their limitations and that, having regard to the risk of its processing, it considers them appropriate or applies additional measures of its own.

6. Sub-processors

6.1. By accepting the Terms and this DPA, the Customer gives the Operator a general written authorisation to engage Sub-processors (Article 28(2) of the GDPR; clause 33.1 of the Terms). The Sub-processors engaged on the date of publication of this version of the DPA, their location, the services they provide and the data they process are set out in Section 17 of this DPA (clause 7.7 of the Terms).

6.2. The Operator shall engage only Sub-processors that provide sufficient guarantees to implement appropriate technical and organisational measures, and only under a written data processing contract, including one in electronic form (Article 28(4) of the GDPR). The hosting providers conclude such contracts on their own standard terms, which differ from this DPA: those terms may provide for a shorter period of notice of changes of their own service providers, audits without access to their systems or paid assistance, and may contain no provisions on the deletion of data after the end of the contract or on transfers of data to third countries. The Customer confirms that it has been informed of this. Such differences do not change the obligations of the Operator to the Customer under this DPA; for example, the Operator itself deletes Processed Data from the servers of Sub-processors (Section 12 of this DPA).

6.3. The Operator remains liable to the Customer for the performance by a Sub-processor of its data protection obligations, and shall notify the Customer of any material failure by a Sub-processor to perform such obligations that is known to the Operator and affects Processed Data; liability is determined in accordance with Section 13 of this DPA.

6.4. The Operator shall notify the Customer of an intended engagement or replacement of a Sub-processor at least 30 days in advance, except where the change is necessary immediately for security reasons or due to the cessation of the provider's business; in that case the Operator shall give notice as soon as possible (clause 21.7 of the Terms). The notice is sent to the Owner's email address and, where possible, provided in the Service (clauses 32.1 and 32.2 of the Terms); it states the name of the Sub-processor, the country in which it is located, the service provided, the data processed and the planned date of the change.

6.5. Within 14 days of receipt of the notice (clause 32.2 of the Terms), the Customer may raise a reasoned objection by email to pagalba@majevski.com from the Owner's email address (clause 32.3 of the Terms). The parties shall seek to agree on a solution; if the parties do not reach agreement within 14 days of receipt of the objection, the Customer may terminate the Agreement and receive a proportionate part of the fee for the unused paid period (clauses 21.7 and 10.4 of the Terms). Since Sub-processors are engaged for all Customers in common, the Operator may implement the change on the date stated in the notice even where an objection has been raised. If no objection is raised within 14 days of receipt of the notice, the Customer is deemed not to object to the change.

6.6. Sub-processors may engage their own service providers in accordance with their data processing terms. The periods referred to in clauses 6.4 and 6.5 of this DPA apply only to Sub-processors engaged by the Operator (clause 2.23 of the Terms) and not to their service providers, because the Operator learns of changes of such providers from the Sub-processors. The Operator shall keep links to the lists of the Sub-processors' service providers and, at the Customer's request, shall provide within a reasonable time the information in its possession about such providers, the countries in which they are located and the transfer grounds. On receiving notice from a Sub-processor of a new service provider in a third country that may process Processed Data, the Operator shall notify the Customer of this without undue delay in the manner referred to in clause 6.4 of this DPA, and the Customer may raise an objection and exercise the rights referred to in clause 6.5 of this DPA.

7. Transfers of Data to Third Countries

7.1. The Service database, files uploaded by the Customer and their backups, as well as the data of the 1e.lt and asms.lt systems, are stored on servers in the European Union (clause 7.7 of the Terms; Section 17 of this DPA). The Operator itself does not transfer Processed Data to countries outside the European Economic Area (third countries) and has not instructed Sub-processors to do so, except for the delivery of SMS messages through the Sub-processor referred to in clause 17.7 of this DPA (clause 7.5 of this DPA).

7.2. To provide their services, Sub-processors may engage service providers that are also located in third countries, and requests transmitted through the content delivery network of a Sub-processor may also be handled in other countries (clause 17.3 of this DPA). By accepting this DPA, the Customer permits such transfers of data only to the extent that a transfer ground provided for in Chapter V of the GDPR applies to them (for example, an adequacy decision of the European Commission or standard data protection clauses). Not all Sub-processors' data processing terms contain specific provisions on such transfers (clause 6.2 of this DPA). The Operator shall provide information about such providers and the transfer grounds in accordance with the procedure set out in clause 6.6 of this DPA.

7.3. If the Operator intends to engage a Sub-processor that would process Processed Data in a third country, it shall do so only after ensuring a transfer ground provided for in Chapter V of the GDPR (for example, an adequacy decision of the European Commission or standard data protection clauses), and shall give notice of this in accordance with the procedure set out in clause 6.4 of this DPA, stating the country and the transfer ground.

7.4. Disclosure of data to services chosen by the Customer (Google, Apple, Microsoft or other calendar services that subscribe to Calendar Links, the Customer's mobile network operator, meeting platforms and review collection services), as well as to recipients' email service providers, is a disclosure of data instructed by the Customer. The providers of these services are not Sub-processors of the Operator and may also process data outside the European Economic Area; the Customer is responsible for the lawfulness of such disclosure and transfer (clauses 7.4, 18.2 and 18.5 of the Terms). Section 18 of this DPA applies to the SMS gateway service asms.lt provided by the Operator.

7.5. Delivery of SMS messages. The Operator sends one-time phone number verification codes (clause 15.12 of this DPA) through the Sub-processor referred to in clause 17.7 of this DPA, which is established in Latvia (European Union). For a message to reach the recipient, that Sub-processor passes the phone number and the text of the message to its telecommunications partners, which, as the Sub-processor itself states in its privacy policy, may also be located outside the European Economic Area; for such a transfer the Sub-processor applies, as it itself states, the safeguards provided for in Chapter V of the GDPR. The Operator has not instructed any other transfer of Processed Data to third countries. By switching on the phone number verification function on the Booking Page or by requesting the verification of a number in the Account, the Customer is aware of this and permits such a transfer on the conditions set out in clause 7.2 of this DPA.

8. Assistance with Data Subject Requests

8.1. Requests of Clients and other data subjects concerning Processed Data are handled by the Customer (clause 3.3 of the Terms). Taking into account the nature of the processing, the Operator shall assist the Customer in fulfilling its obligations set out in Chapter III of the GDPR by the means set out in this Section.

8.2. In the Service, the Customer can itself: 1) view client cards, the Clients' visits, the message history stored in the Account and, where available on its Plan, SMS conversations; 2) correct the data on client cards, bearing in mind that the email address and phone number of a linked Client are updated on the basis of the DEK Identity (clause 17.3 of the Terms), and change the time, duration, services, status, internal notes and meeting link of visits; 3) change the consent flags of Clients; 4) delete client cards and certain other records (clause 12.7 of this DPA); a deleted client card is no longer shown in the client list, in search or in exports, and its data (first name, surname, phone number, email address, card notes and custom field values) is no longer shown to Users where visits are shown: in the calendar, the visit details, the list of today's visits on the dashboard, Calendar Links, digests and notifications of new bookings; however, visits, rules for recurring visits and SMS messages cannot be deleted in the Service, so the visits of a deleted Client remain and are shown with the label "Deleted client", SMS conversations remain and are shown under the phone number, and such visits are counted in reports without the Client's data (point 8 of clause 16.13 of this DPA); 5) export Client Data using the self-service export function, where it is available on the Customer's Plan (clause 30.4 of the Terms). Clients can opt out of marketing emails via the link contained in every such email (clause 16.3 of the Terms).

8.3. At the Owner's request, the Operator shall: 1) provide the Exportable Data in accordance with the procedure and time limits set out in clause 30.4 of the Terms; 2) remove the data of deleted Client records earlier in accordance with the procedure set out in clause 30.9 of the Terms and in the manner set out in clause 12.7 of this DPA; 3) within a reasonable time, having regard to the time limit set out in Article 12(3) of the GDPR, provide the information in its possession that the Customer needs to respond to a request of a data subject and cannot obtain in the Service; 4) assist the Customer in fulfilling a request of a data subject for erasure: where technically possible, delete specific visits, rules for recurring visits or SMS messages identified by the Owner that the Customer cannot delete in the Service, as well as contacts or messages in the Customer's asms.lt account; this point does not change the commitments and time limits regarding deletion set out in Section 30 of the Terms.

8.4. If the Operator receives a request of a data subject concerning Processed Data directly and it can be determined from the request which Customer it is intended for, the Operator shall forward the request to the Customer without undue delay at the Owner's email address and direct the person to contact the Customer (clause 3.3 of the Terms). The Operator does not itself respond to the substance of such a request, unless the Customer instructs it to do so. Requests concerning data that the Operator processes as an independent controller are handled by the Operator itself in accordance with the Privacy Policy.

8.5. The Customer is responsible for responding to the data subject and for complying with the time limits set out in Article 12 of the GDPR; the Operator's assistance does not extend these time limits.

9. Breaches, Impact Assessment and Other Assistance

9.1. Taking into account the nature of processing and the information available to it, the Operator shall assist the Customer in ensuring compliance with the obligations set out in Articles 32–36 of the GDPR: it applies the measures set out in Section 16 of this DPA and, at the Customer's request, provides information about them and about the Sub-processors.

9.2. On becoming aware, including from a Sub-processor, of a personal data breach relating or possibly relating to the Processed Data of the Customer, the Operator shall notify the Customer of it without undue delay by email to the Owner's email address and, where possible, by a notice in the Service. The Operator may also send urgent security notices to other Users (clause 32.1 of the Terms).

9.3. The notice states, to the extent that such information is known at the time: 1) the nature of the breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; 2) the contact point where more information can be obtained, by email at pagalba@majevski.com; 3) the likely consequences of the breach; 4) the measures taken or proposed to be taken by the Operator to address the breach and to mitigate its possible adverse effects. Where it is not possible to provide all the information at the same time, the information is provided in phases without undue further delay.

9.4. The Operator shall document each breach referred to in clause 9.2 of this DPA (the facts relating to it, its effects and the remedial action taken) and shall provide this information at the Customer's request. The Operator shall take reasonable measures to contain the breach and mitigate its consequences, for example by suspending the sending of messages, restricting access or disconnecting an integration (clauses 14.3, 15.4 and 28.1 of the Terms).

9.5. The obligations of the Customer, as the controller, to notify a personal data breach to the supervisory authority and to data subjects (Articles 33 and 34 of the GDPR) remain with the Customer. The Operator shall assist in fulfilling them by providing the information in its possession, but does not submit notifications to the authority or to data subjects on the Customer's behalf, unless the parties agree on this. The Operator's notice does not in itself constitute an admission of fault by the Operator. The Customer shall notify the Operator immediately of any suspected unauthorised access to the Account (clause 5.5 of the Terms).

9.6. If the Customer processes special categories of personal data on a large scale, it shall notify the Operator of this in advance (clause 12.2 of the Terms). At the Customer's request, the Operator shall provide the information in its possession that is needed to carry out a data protection impact assessment and, where necessary, prior consultation with the supervisory authority (Articles 35 and 36 of the GDPR), including the information set out in Sections 15, 16 and 17 of this DPA and answers to reasonable questions about the operation of the Service. The data protection impact assessment is carried out by the Customer.

10. Information and Audit

10.1. The Operator shall make available to the Customer the information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR and in this DPA: this DPA (including Sections 15, 16, 17 and 18), the records of logins to the Account referred to in clause 21.5 of the Terms and, within a reasonable time, written answers to reasonable questions or questionnaires of the Customer (clause 10.6 of this DPA). Requests are submitted by email to pagalba@majevski.com.

10.2. If the Customer considers that the information referred to in clause 10.1 of this DPA is insufficient and specifies in writing what information is missing, or if a supervisory authority so requires, the Customer may carry out an audit, including an inspection, itself or through an independent auditor who is bound to confidentiality and is not a competitor of the Operator.

10.3. An audit is carried out no more than once every 12 months, except where it is carried out after a personal data breach relating to the Processed Data of the Customer or where a supervisory authority so requires. The Customer shall give notice of an audit by email to pagalba@majevski.com at least 30 days in advance or, in the cases excepted in the previous sentence, at least 10 Business Days in advance or such shorter period in advance as the supervisory authority sets, stating the scope, timing and auditor of the audit. An audit is carried out on Business Days during business hours, remotely or at a place agreed by the parties, in such a way that it does not disrupt the provision of the Service, and lasts no longer than 2 Business Days, unless the parties agree otherwise. The Customer shall bear its own costs and those of the auditor, and the Operator shall not charge the Customer for its own working time to the extent that it does not exceed the duration of the audit set out in this clause. The auditor reviews the operation of the Service and the settings and records relating to the Processed Data of the Customer that the Operator shows to the auditor, but does not obtain direct access to the servers and database of the Service, to the data of other Customers, to the trade secrets of the Operator beyond what is necessary for the purpose of the audit, or to the premises or systems of the hosting providers: the audit rights of their customers are limited by their terms, so in respect of them the Operator provides the information it has obtained from them.

10.4. The audit report or its findings are also provided to the Operator, which may submit its comments. Information obtained during the audit is confidential but may be provided to a supervisory authority. If the audit reveals that the Operator is not complying with this DPA, the Operator shall remedy the deficiencies within a reasonable time; if the breach is material and is not remedied within the period referred to in clause 29.5 of the Terms, the Customer has the right referred to in that clause to terminate the Agreement.

10.5. The Operator shall cooperate with the supervisory authority where required by law (Article 31 of the GDPR).

10.6. The Operator shall provide the assistance referred to in Sections 8, 9 and 10 of this DPA free of charge to the extent that it is provided through the functions of the Service, through the actions referred to in clause 8.3 of this DPA, by providing information already in its possession or by answering no more than one questionnaire of the Customer per 12 months, and in all cases where the assistance is needed because of a breach of this DPA by the Operator or a personal data breach at the Operator or a Sub-processor. Other assistance that requires greater costs on the part of the Operator (for example, additional questionnaires, meetings or the part of an audit that exceeds the duration set out in clause 10.3 of this DPA) is provided by the Operator for a reasonable fee agreed by the parties in advance by email. No fee applies to the provision and deletion of data under Section 30 of the Terms.

11. Operator's Access to the Account

11.1. Clause 21.5 of the Terms applies to logins to the Account by persons authorised by the Operator. Logging in with the rights of a User is permitted only to the extent necessary to provide support at the Customer's request, to investigate and correct an error, to manage a security incident or abuse, or to comply with legal requirements. Each such login is recorded (which administrator account of the Operator, when, for what purpose and with the rights of which User), the records are kept for 13 months from their creation and are provided to the Customer at its request (clauses 21.5 and 30.8 of the Terms). The Owner is informed of a login in accordance with the procedure set out in clause 21.5 of the Terms.

11.2. For the purposes referred to in clause 21.5 of the Terms and for the performance of the Agreement, persons authorised by the Operator may process the Account data using the Service's administration tools or directly in the database, without logging in to the Account; the recording, retention and notification requirements referred to in clause 11.1 of this DPA do not apply to such actions (clause 21.5 of the Terms). Where this is needed to investigate an error, for maintenance or to provide the data referred to in clause 30.4 of the Terms, they may make a copy of the Service database or part of it, including Processed Data, on a device of the Operator; such a copy is used only for that purpose and is deleted when it is no longer needed, but no later than 14 days after it was made. Section 4 of this DPA applies to such persons and copies.

12. Return and Deletion of Data

12.1. Section 30 of the Terms applies to the return and deletion of Processed Data. This Section summarises it and sets out how it applies to Processed Data; in the event of any inconsistency, the Terms apply (point 3 of clause 33.6 of the Terms).

12.2. The Customer chooses the return of data by submitting a request to obtain the Exportable Data under clause 30.4 of the Terms during the term of the Agreement, during the transition period referred to in clause 30.5 of the Terms or during the 30-day data retrieval period referred to in clause 30.6 of the Terms. The data is provided free of charge (clause 30.1 of the Terms), and the data referred to in clause 30.3 of the Terms is not provided. The list of Exportable Data set out in clause 30.2 of the Terms is exhaustive, so the Operator is not obliged to return other Processed Data (for example, visit custom field values, payment method, delivery and click events); such data is deleted in accordance with the procedure set out in clauses 12.3, 12.4 and 12.5 of this DPA.

12.3. Upon expiry of the data retrieval period, the Operator shall, within 60 days at the latest, delete the Exportable Data, other Client Data and Customer Content from the active systems of the Service and inform the Owner of this by email. If a request under clause 30.4 of the Terms is received during the data retrieval period, the data is not deleted until the Operator has fulfilled it. At the Customer's request, data is deleted without waiting for the end of the data retrieval period (clauses 30.6 and 30.7 of the Terms).

12.4. The active systems of the Service (clauses 7.8 and 30.7 of the Terms) also include data managed by the Operator on the servers of Sub-processors: the Service database, uploaded files, the Operator's mailbox that receives non-delivery reports and replies to calendar invitations, and the 1e.lt system. Accordingly, Processed Data stored in these systems, including the Customer's lists and campaign lists, campaign content and statistics stored in the 1e.lt system, is deleted together with other Processed Data in accordance with the procedure set out in clause 12.3 of this DPA. Technical logs kept by Sub-processors under their own rules (for example, sending logs of mail servers) are deleted by the Sub-processors within the periods they set; clause 12.5 of this DPA applies to backups.

12.5. Data remains in backups until those backups are overwritten in the ordinary course, but no longer than 90 days after deletion from the active systems, and during that time is used only for recovery after an incident; if a backup is restored, data already deleted is deleted again. Deleted data is not restored (clause 30.7 of the Terms).

12.6. The Operator may retain Processed Data for longer only in the cases referred to in clause 30.8 of the Terms, that is, to the extent required by law or necessary to bring or defend legal claims. At the Customer's request, the Operator shall state the legal provision or legal claim for which the data is retained for longer. Such data is processed only for that purpose, and Section 4 of this DPA continues to apply to it. Aggregated anonymised statistics may continue to be retained (clauses 21.4 and 30.8 of the Terms).

12.7. Clause 30.9 of the Terms applies to records deleted during the term of the Agreement: deleted records of Clients, services, service categories and Team Members are kept in the database as deleted until the end of the Agreement and, if the Owner so requests in writing, are removed earlier, within 30 days of receipt of the request at the latest; other deleted records are removed from the Service database immediately. The Service removes a deleted Client from the Customer's list in the 1e.lt system, but the data of that Client in the lists of earlier campaigns, as well as the content, statistics and recipient list of a deleted campaign in the 1e.lt system, are removed together with other data in accordance with the procedure set out in clauses 12.3 and 12.4 of this DPA, also where the data of the Client's record is removed earlier at the Owner's request. At the Owner's written request, the Operator removes the data of a deleted Client's record using an administration tool, without logging in to the Account (clause 21.5 of the Terms; clause 11.2 of this DPA): it erases the card's first name, surname, phone number, email address, date of birth, gender, card notes, custom field values, consent flags and link to the DEK Identity, the email click and non-delivery events of that Client, and the recipient address in that Client's message records, including error texts in which the address appears, and it ensures that the Client's email address no longer remains on the Customer's list in the 1e.lt system. An empty card record remains in the database (its identifier, the dates of creation, last change and deletion, the source of the record, the language, the date of the last visit, the numbers of attended visits, no-shows and late changes and the identifier of a contact in the Customer's asms.lt account, where the card was linked to it or such a contact is found by the phone number), so that visits continue to be shown with the label "Deleted client" and contact synchronisation does not create the Client again; the message records retain their type, channel, time and status. Such removal does not delete that Client's visits with their notes and visit custom field values, rules for recurring visits, SMS messages, or contacts and messages in the Customer's asms.lt account: the Operator deletes these only where the Owner identifies them (point 4 of clause 8.3 of this DPA). Audit log entries are not changed and are deleted after the period set out in clause 16.7 of this DPA.

12.8. The Operator does not delete data that the Customer has disclosed to the services referred to in clause 7.4 of this DPA. Clause 18.4 of this DPA applies to the data of the Customer's asms.lt account.

13. Liability

13.1. Sections 25 and 26 and clauses 7.5 and 33.1 of the Terms apply to the liability of the parties under this DPA. The Operator remains liable to the Customer for the performance by Sub-processors of their data protection obligations (Article 28(4) of the GDPR) within the limits set out in these provisions of the Terms; clause 24.3 of the Terms applies to loss of data.

13.2. No provision of this DPA limits the statutory liability of the parties to data subjects or supervisory authorities under the GDPR (Articles 82 and 83 of the GDPR). Clause 25.5 of the Terms applies to recourse claims between the parties.

13.3. Point 6 of clause 26.1 of the Terms applies to individual instructions of the Customer and to a breach of this DPA committed by the Customer. Clause 26.1 of the Terms does not apply to the extent that the claim was caused by a breach of this DPA by the Operator or by processing carried out by the Operator as an independent controller for the purposes referred to in clauses 17.4, 17.5, 21.4 and 21.6 of the Terms (clause 26.2 of the Terms).

14. Final Provisions

14.1. The DPA remains in force for the entire term of the Agreement and, after the Agreement ends, for as long as the Operator or Sub-processors process Processed Data, including storing it in backups (Section 12 of this DPA; clause 29.8 of the Terms).

14.2. This version of the DPA applies to a Customer from the day on which version 2.1 of the Terms starts to apply to it under clause 1.7 of the Terms: to Customers who conclude the Agreement on or after 2026-09-21 and to Customers who accepted version 2.1 of the Terms when creating their Account, from the creation of the Account; to other Customers, from the time the Owner expressly confirms in the Service that they agree to version 2.1 of the Terms. If the Owner does not confirm version 2.1 of the Terms by 2026-10-21, clause 31.6 of the Terms applies. Until then, the previous version of the DPA accepted by the Customer applies to it.

14.3. The Operator keeps previous versions of the DPA together with their publication dates and records, or determines on the basis of the date on which the Terms were accepted, which version of the DPA the Customer accepted (clause 1.2 of this DPA). The previous Beta 1.0 version of the DPA remains available on the Service website. At the Customer's request, the Operator provides free of charge the version of the DPA that applied to the Customer at a specified time (clauses 1.5 and 1.6 of the Terms).

14.4. The DPA is amended in accordance with the procedure set out in Section 31 of the Terms; the Operator shall notify the Owner by email of every amendment to the DPA, other than amendments of an editorial nature, even if the amendment takes effect earlier under clause 31.3 of the Terms. Individual agreements that amend or supplement the DPA are valid only if made in the form set out in clause 2.21 of the Terms. The list of Sub-processors is amended in accordance with the procedure set out in clauses 6.4 and 6.5 of this DPA, and the security measures in accordance with the procedure set out in clause 5.2 of this DPA.

14.5. Section 32 of the Terms applies to notices under this DPA. The Customer shall address all questions relating to this DPA by email to pagalba@majevski.com. The Operator has not appointed a data protection officer.

14.6. The DPA was drafted in Lithuanian and is published in Lithuanian, English, Polish and Russian. The Lithuanian text is the original, and the versions in other languages are translations of it. If the versions differ, the Lithuanian version prevails, except where the discrepancy arose from a translation error and the Customer, having concluded the Agreement in another language, relied in good faith on the version in that language; in that case the version in which the Customer concluded the Agreement applies in respect of that Customer.

14.7. The DPA is governed by the law of the Republic of Lithuania and the GDPR. Disputes are resolved in accordance with the procedure set out in Section 34 of the Terms. If any provision of the DPA is held to be invalid or unenforceable, clause 33.7 of the Terms applies.

15. Description of Processing

15.1. Subject matter of processing. The processing of Processed Data in providing the Service to the Customer, that is, the visit booking, calendar, client card, messaging and related functions that the Customer uses in its business or professional activity.

15.2. Duration. Processing takes place during the term of the Agreement, during the transition period referred to in clause 30.5 of the Terms, during the data retrieval period referred to in clause 30.6 of the Terms and until the data is deleted under clause 30.7 of the Terms, including storage in backups. During the term of the Agreement, records are kept until the Customer deletes them; visits, rules for recurring visits and SMS messages, which cannot be deleted in the Service, are kept until the end of the Agreement, unless the Operator deletes them under clause 8.3 of this DPA. Clause 30.9 of the Terms and clause 12.7 of this DPA apply to deleted records, and certain technical records are deleted automatically (clause 16.11 of this DPA). The duration of the processing of the data of the Customer's asms.lt account is set out in clause 18.2 of this DPA.

15.3. Frequency. Processing takes place continuously; automated processes (reminders, synchronisation, receipt of messages and visit status updates) run periodically (clause 7.2 of the Terms).

15.4. Client cards. Creating, viewing, searching, changing and deleting client cards; importing Client lists (clause 13.5 of the Terms); selecting Clients for campaigns according to criteria chosen by the Customer; exporting Client Data, where this function is available on the Customer's Plan; updating the email address and phone number of a linked Client on the basis of the DEK Identity data (clause 17.3 of the Terms).

15.5. Bookings and visits. Accepting bookings on the Booking Page, where the Client provides their name, a contact detail through which messages are sent to them and, if they wish, a note, and where a new Client may mark their consent to receive marketing messages; linking a booking to an existing client card on the basis of the phone number or email address, filling in only empty fields of the card; the visit calendar, creating, moving and cancelling visits, marking their statuses, and rules for recurring visits; automatically marking visits whose status has not been changed as attended (clause 17.1 of the Terms); visit management pages, on which the Client can confirm, cancel or reschedule a visit and choose the language of messages; displaying the Client's visits in their DEK Identity (clause 2.17 of the Terms).

15.6. Emails. Sending visit notifications, reminders and other automated messages to Clients by email from an address on the Operator's domain on behalf of the Customer, where applicable attaching a calendar entry file and setting the Owner's email address as the reply-to address (clause 15.1 of the Terms); applying sending limits (clause 15.3 of the Terms); receiving and automatically processing non-delivery reports and, where this function is enabled, replies to calendar invitations (clause 15.6 of the Terms; clause 2.7 of this DPA); recording the message history and clicks on Service links in emails.

15.7. SMS messages. Sending messages to Clients by SMS through the Customer's SMS Gateway (clause 14.1 of the Terms) and storing the texts of these messages in the Account; where an asms.lt account is connected on a paid Plan, periodically retrieving and storing in the Account all messages received at the SMS Gateway number and sent through that account, including those sent outside the Service and to persons who are not Clients (clause 14.7 of the Terms); automatically processing Clients' replies by SMS and changing the visit status (clause 15.6 of the Terms), except for replies that the Service receives more than 24 hours after they were written and for visits created after the reply was written; synchronising contacts with the asms.lt account, where the Customer enables it and chooses the direction (clause 14.8 of the Terms). Messages are retrieved from the asms.lt account and Clients' replies are processed only for Accounts that are not deleted or suspended and whose Plan includes the SMS function; once the asms.lt account is disconnected in the Service, the sending and retrieval of messages and contact synchronisation stop. Section 18 of this DPA applies to processing in the Customer's asms.lt account.

15.8. Marketing messages and campaigns. Sending birthday and name day greetings and invitations to book again by email to Clients whose client card is flagged with consent to receive marketing messages (clause 16.1 of the Terms); sending campaigns through the Operator's email sending system 1e.lt, that is, transferring the email addresses, first names, surnames and Client identifiers of such Clients to the Customer's list and, when a campaign is sent to a selected group of Clients, also to a separate list for that campaign; sending campaign content, tracking delivery, opens and clicks under the Operator's default settings and showing statistics in the Account (clauses 16.2 and 16.5 of the Terms); receiving opt-outs and transferring them to the client card (clause 16.3 of the Terms); sending review requests with the link specified by the Customer (clause 16.6 of the Terms). Replies received at the reply-to address of campaigns are not forwarded to the Customer and are not processed in the Service (clause 15.1 of the Terms).

15.9. Calendar Links. Making the visit data of a Team Member, including Clients' names, phone numbers, services, notes, addresses and meeting links, available in Calendar Links subscribed to by calendar services chosen by the Customer or Team Members (clauses 18.1 and 18.2 of the Terms).

15.10. Reliability Score. Counting a Client's attended visits, no-shows and late changes and showing the Reliability Score in the Customer's Account (clause 17.1 of the Terms).

15.11. Team Members and Users. Processing the names, contact details, positions, photos, work schedules and time off of Team Members, including the reason given for time off; showing the names and photos of Team Members on the Booking Page; sending to Users visit digests and notifications of new bookings that state Clients' names, services and visit times.

15.12. Protective measures. Rate limiting and other protective measures in the Account and on the Booking Page, including checking the IP address, the hash value of the email address and the email domain of the person making a booking against the M Blacklist database (clauses 17.5 and 21.3 of the Terms; clause 3.4 of this DPA). Where the Customer has switched this function on, the Service verifies the mobile phone number entered on the Booking Page, and at the Customer's request it also verifies the number of a Client, a Team Member or the Customer itself. A number is verified by a one-time code sent in an SMS message from the Operator's sender name "DEK" (clause 15.1 of the Terms) through the Sub-processor referred to in clause 17.7 of this DPA or, for as long as the Operator does not use that Sub-processor's service, through the Operator's own asms.lt account, whose servers are hosted by the Sub-processor referred to in clause 17.3 of this DPA. Landline numbers are not accepted on a Booking Page with this function, and a number verified on the Booking Page is treated as verified in the visitor's browser session for 24 hours. The Service records the proof of verification (the number, the time, the method of verification, the IP address, the browser and the record to which the proof belongs) and marks the record as verified. Using the Service's administration tools (clause 11.2 of this DPA), for example when the sending of SMS messages is disrupted, the Operator may mark the number of a record as verified or vouch for a number for no longer than 7 days so that a booking with it is accepted without a code; such a proof entered by hand names the administrator account of the Operator that entered it.

15.13. Technical processing and support. Storing Processed Data in the Service database and on servers; resizing and re-encoding uploaded images (clause 13.6 of the Terms); backups made by the hosting provider (clause 24.3 of the Terms); technical support and the investigation and correction of errors, including logins to the Account by persons authorised by the Operator (clause 21.5 of the Terms; Section 11 of this DPA).

15.14. Provision and deletion of data. Providing the Exportable Data, switching to another service provider and deleting data (Section 30 of the Terms; Section 12 of this DPA).

15.15. Categories of data subjects: 1) Clients, including minors, where the Customer processes their data (clause 12.6 of the Terms); 2) Team Members, regardless of whether they have a login; 3) persons who are not Clients but send SMS messages to the SMS Gateway number or receive messages from it (clause 14.7 of the Terms); 4) Users, to the extent that their data relates to Processed Data (for example, who created a visit or sent a message); 5) other persons whose data the Customer or Users record in notes or other free-text fields (for example, representatives of Clients).

15.16. Categories of personal data: 1) client card data: first name, surname, email address, phone number, date of birth, gender, language, notes, custom field values, consent and marketing opt-out flags, email address status, source of the record, numbers of attended visits, no-shows and late changes, date of the last visit, link to a DEK Identity, the phone number verification stamp and identifiers in the 1e.lt and asms.lt systems; 2) visit data: date, time, duration, services, price, payment method, Team Member, branch, status, cancellation data, notes and internal notes, visit custom field values, meeting link, visit management link and short code, rules for recurring visits; 3) message data: the recipient's email address or phone number, channel, type, time, status and errors, texts of SMS messages, non-delivery reports, clicks on Service links and replies to calendar invitations; 4) campaign data: list members, campaign content, delivery, open, click and opt-out data; 5) Team Member data: name, email address, phone number and its verification stamp, position, photo, work schedule, time off and the reason for it, Calendar Link identifier; 6) data of protective checks: the IP address, the hash value of the email address and the email domain of the person making a booking, proofs of phone number verification (the number, the time, the method of verification, the IP address, the browser and the record to which the proof belongs) and records of SMS messages with verification codes sent in the Operator's name (clauses 15.12 and 16.11 of this DPA).

15.17. Special categories of data. The Customer may, at its own discretion, process special categories of personal data in the Service, in particular health data: in notes, custom fields (for example, allergies, contraindications, health notes, medical alerts, injuries or hearing aid data), service names, SMS messages and the reason for time off of Team Members. The Service does not require such data, and the Customer may process it only in compliance with Section 12 of the Terms. Such data is processed only for the purposes set out in this Section, applying the measures set out in Section 16 of this DPA and having regard to their limitations; the Customer may hide unnecessary suggested fields in the settings for the entire Account.

15.18. Prohibited data and data not processed. It is prohibited to store payment card details, passwords, personal identification numbers or identity document numbers in notes, custom fields and other free-text fields, except in the cases referred to in clause 12.5 of the Terms. The Service does not process data of Clients' payment instruments, because the Operator does not accept payments from Clients on behalf of the Customer (clause 3.4 of the Terms).

16. Technical and Organisational Security Measures

16.1. Protection of connections. The Service is accessible over an encrypted HTTPS (TLS) connection: HTTP requests are redirected to HTTPS, and an HSTS header is sent in responses generated by the application. Connections of the Service to the 1e.lt, asms.lt, M Blacklist, Stripe and VertexSMS systems are made over HTTPS with verification of the server certificate.

16.2. Login and authentication. Logins of Users are personal: the Owner creates and disables them in the Service, and sharing login credentials is prohibited (clause 5.4 of the Terms). Passwords must be at least 8 characters long and are stored only as bcrypt hash values. The number of login attempts is limited per IP address and per account, and the message shown after a failed login does not reveal whether the email address or the password is incorrect. A password reset link is valid for 60 minutes, can be used once and is stored as a hash value, and resetting the password revokes that User's remember-me tokens. Session cookies are transmitted only over an encrypted connection, are not accessible to page scripts and are protected by the SameSite setting; the session identifier is changed upon login. A disabled or removed login stops working at the next request. Requests that change Processed Data are protected against cross-site request forgery (CSRF) by a token or a signature.

16.3. Access rights. The Owner role is held by the User who created the Account or by a User to whom the Operator gives it at the Customer's request or in the case referred to in clause 5.8 of the Terms, and the Customer assigns other Users the Manager, Reception or Staff role; the roles have different rights. A User with the Staff role sees and changes only their own visits in the calendar, but sees all Clients of the Account and, on their client cards, the history of the Client's visits with all Team Members, including visit prices and notes (clause 16.13 of this DPA). Only Users with the Owner, Manager and Reception roles can export Client Data, where the export function is available on the Customer's Plan, and exports are recorded in the audit log.

16.4. Separation of Customers' data. The data of all Customers is stored in a shared database and separated by software means: each record is linked to an Account, and the Service selects data according to the Account of the logged-in User. Uploaded images are given random names, and Client import files are stored in a directory closed to internet access, linked to the Account and deleted once the import has been completed.

16.5. Application security. Database queries are executed using prepared statements, and data output to pages is escaped. Responses generated by the application include security headers (Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options and Referrer-Policy). Internal directories and configuration files of the Service are closed to internet access. Uploaded images are checked by their content, re-encoded and saved under random names, and program code is not executed in the directory of uploaded files. On pages whose address contains a personal link or an access token, analytics tools are not loaded, and the browser is instructed not to pass such an address on to other websites. The installable app of the Service does not store in its cache pages that are accessible after logging in.

16.6. Encryption and hash values. The Customer's asms.lt API key is stored encrypted with the AES-256-GCM algorithm (clause 14.3 of the Terms). Passwords of Users, password reset links, remember-me tokens and one-time codes are stored only as hash values, and in reports of suspicious activity email addresses are transmitted only as hash values. Other Processed Data, including notes, custom field values and SMS message texts, is not additionally encrypted at application level (clause 12.4 of the Terms).

16.7. Activity logs. The audit log records logins and failed login attempts; the creation, change, deletion, import and export of client cards; the creation and moving of visits and changes to their services and status carried out by Users; bookings made online; replies of Clients by SMS or to calendar invitations; changes to settings, Team Members and logins; campaigns; SMS messages sent by Users; phone number verifications carried out by Users and those entered by hand by the Operator (the latter with the administrator account of the Operator that entered them; clause 15.12 of this DPA); and logins to the Account by the Operator; each entry states the action and the time and, for an action taken through a browser, also the IP address and, where a User took it, that User. The main actions that are not recorded are set out in clause 16.13 of this DPA. Audit log entries are kept for 90 days, and the server log files of the Service (errors, warnings and other technical events) for 30 days.

16.8. Operator access. The Operator's administration area is separated from the Accounts and is not accessible to persons who are not logged in, and attempts to log in to it are limited and recorded. Persons authorised by the Operator may log in to an Account only after stating a purpose and an explanation; each such login is recorded, the Owner is informed of a login not carried out at the Customer's request in accordance with the procedure set out in clause 21.5 of the Terms and subject to the exceptions set out there, and the records are kept for 13 months (clauses 21.5 and 30.8 of the Terms; Section 11 of this DPA).

16.9. Sending and abuse controls. Sending limits per recipient, per Customer and for the Service as a whole apply to emails, and the Operator may suspend the sending of emails or SMS messages (clauses 15.3 and 15.4 of the Terms). If it is unclear whether the SMS Gateway has accepted a message, the message is not automatically resent (clause 14.5 of the Terms). SMS messages are not sent to landline numbers. The number of login, Account creation, booking and one-time code requests is limited, a tool for detecting automated requests (bots) is used in the Account creation form, and the M Blacklist database is used to identify threats (clause 3.4 of this DPA).

16.10. Backups and recovery. Backups of the Service database and of files uploaded by the Customer are made automatically by the Operator's hosting provider at the frequency it sets and are kept by it for the period it sets; the Operator uses only a hosting service in which such backups are made. After a failure caused by the Operator or its hosting provider, the Operator shall, using reasonable efforts, restore data from the latest available backup. The frequency of backups, their retention period and the recovery of all data are not guaranteed (clauses 11.10 and 24.3 of the Terms).

16.11. Data minimisation and retention periods. Only the name and a contact detail through which messages are sent to the Client are mandatory in the Booking Page form. The Customer may hide the custom fields suggested for its business category. The text of automated message emails is not stored in the Service database; message records (recipient, channel, type, time and status) are deleted automatically after 12 months, records of SMS messages with verification codes sent in the Operator's name (the recipient's number, the record to which the message belongs, purpose, provider, sender name, number of message parts, delivery status with the mobile network code, price, time and the IP address of the request; the text of the message is not stored) and proofs of phone number verification (clause 15.12 of this DPA) after 12 months, one-time code records (the hash value of the code, the contact detail, the IP address and the time) after 90 days, non-delivery events and clicks on Service links recorded in the Service database after 90 days, and failed background jobs 90 days after the failure. Emails received as non-delivery reports and replies to calendar invitations, which may also contain the content of the returned email, are stored in a dedicated folder of the Operator's mailbox on the server of the Sub-processor referred to in clause 17.2 of this DPA. A task of the Service run every hour automatically deletes from this folder the emails that were received more than 90 days ago, but the exact moment of deletion is not guaranteed; this deletion does not cover the Sub-processor's backups (clause 16.10 of this DPA) or the mail server logs that it keeps under its own rules, and after the end of the Agreement clauses 12.3 and 12.4 of this DPA also apply to these emails. In the Operator's delivery log, the addresses and numbers of recipients are shown partially masked and are kept for 14 days. Records of deleted Clients are not used for messages, and no new visits are created under their rules for recurring visits (clause 30.9 of the Terms).

16.12. Infrastructure and persons. The servers of the Service and of the 1e.lt and asms.lt systems are located in the European Union, in the infrastructure of the Sub-processors listed in Section 17 of this DPA; the physical security of the servers and the maintenance of their environment are ensured by the hosting providers under their own terms. Sections 4 and 11 of this DPA apply to persons authorised by the Operator.

16.13. Limitations of the measures. On the date of publication of this version of the DPA: 1) the Service has no two-factor authentication, and changing a password does not log out devices that are already logged in, so when a User no longer works for the Customer or their login credentials have become known to others, the Customer shall disable that User's login; 2) Users with the Staff role see all client cards of the Account, including notes, custom fields and the history of the Client's visits with all Team Members with visit prices and notes, and this data cannot be hidden from individual roles; 3) the audit log does not record who viewed Client Data, nor changes to the internal notes, duration and meeting link of a visit, automatic changes of visit statuses, a Client's confirmation, cancellation or rescheduling of a visit on the visit management page, the creation of a client card in the visit window or by an online booking (only the visit or the booking is recorded), the filling in of client cards by an online booking, the creation and changes of client cards by contact synchronisation with asms.lt, by updates on the basis of the DEK Identity and on receipt of an opt-out in the 1e.lt system, the adding and removal of Team Members' time off and branches' closed days, or the deletion of service categories; 4) the data of Customers is separated by software means and not at database level; 5) notes and custom field values are not separately encrypted; 6) Calendar Links and visit management links work without logging in and do not expire, and a visit management link continues to work even after the client card has been deleted, so anyone who has the link can see or manage the corresponding data (clause 18.1 of the Terms); 7) SMS messages are transmitted over the mobile network without additional encryption applied by the Service, and the protection of emails in transit also depends on the recipient's mail server; 8) the Customer cannot delete visits, rules for recurring visits or SMS messages in the Account, so after a client card is deleted, the Client's visits remain and are shown with the label "Deleted client" together with their time, services, Team Member, status, price, internal notes, visit notes (including the note written by the Client when booking), visit custom field values, meeting link and message history (without the text of delivery errors), SMS conversations remain and are shown under the phone number, such visits are counted in reports without the Client's data, and Calendar Link data already received by calendar services changes only when those services refresh the subscribed calendar (clause 30.9 of the Terms); 9) actions of persons authorised by the Operator carried out using the Service's administration tools or directly in the database without logging in to the Account (clause 11.2 of this DPA) are not recorded in the records of logins referred to in clause 21.5 of the Terms.

16.14. Customer's measures. The Customer shall: 1) grant Users only the roles needed for their work and immediately disable logins that are no longer needed (clause 5.3 of the Terms); 2) ensure that Users use strong passwords, keep their login credentials secure and protect their devices (clause 5.5 of the Terms); 3) treat Calendar Links like passwords and renew them if a device is lost or the Team Members change (clause 18.1 of the Terms); 4) keep the asms.lt API key secure and use only a business phone number for the SMS Gateway (clauses 14.3 and 14.7 of the Terms); 5) not store payment card details, passwords, personal identification numbers or identity document numbers in notes, custom fields and other free-text fields, except in the cases referred to in clause 12.5 of the Terms; 6) hide unnecessary suggested fields and process only the health data necessary for planning visits and providing services (clauses 12.1 and 12.2 of the Terms); 7) to the extent permitted by the functions of the Service available on its Plan or by the procedure for providing data set out in clause 30.4 of the Terms, regularly save a copy of visit and Client Data (clause 11.10 of the Terms); 8) notify the Operator immediately of any suspected unauthorised access (clause 5.5 of the Terms).

17. List of Sub-processors

17.1. On the date of publication of this version of the DPA, the Operator engages the Sub-processors listed in this Section. The list is amended in accordance with the procedure set out in clauses 6.4 and 6.5 of this DPA.

17.2. UAB "Interneto vizija", legal entity code 126350731, J. Kubiliaus g. 6, 08234 Vilnius, Lithuania. Service provided: hosting of the Service servers (database and uploaded files), backups made by the hosting provider, and mail servers through which emails are sent and non-delivery reports and replies to calendar invitations are received. Data processed: all Processed Data stored in the Service and emails sent to Clients. Data location: Lithuania (European Union).

17.3. Hostinger International Limited, 61 Lordou Vironos str., 6023 Larnaca, Cyprus. Service provided: hosting of the servers of the Operator's email sending system 1e.lt, the content delivery network (CDN) through which the 1e.lt system is accessed, and hosting of the servers of the Operator's SMS gateway service asms.lt. Data processed: in the 1e.lt system, members of the Customer's lists and campaign lists (Clients' email addresses, first names, surnames and Client identifiers), campaign content, delivery, open, click and opt-out data, as well as the Customer's name, the branch address and the Owner's email address stated in the list settings; in the asms.lt system, the contacts, phone numbers and SMS message texts of the Customer's asms.lt account (Section 18 of this DPA) and, for as long as the Operator sends verification codes through its own asms.lt account (clause 15.12 of this DPA), the recipients' phone numbers and the texts of those code messages. Data storage location: European Union; requests transmitted through the content delivery network may also be handled at Hostinger nodes located in other countries (clause 7.2 of this DPA).

17.4. The email sending system 1e.lt and the threat database M Blacklist are systems operated by the Operator and are deemed to be part of the Service (clause 7.8 of the Terms), so they are not separate Sub-processors; the hosting providers of their servers are listed in this Section. The Operator processes M Blacklist data as an independent controller (clause 3.4 of this DPA). The SMS gateway service asms.lt is also a system operated by the Operator, but it is not part of the Service; Section 18 of this DPA applies to it.

17.5. The following are not regarded as Sub-processors: 1) Stripe, which processes the Customer's billing data and does not receive Client Data (clauses 2.23 and 9.2 of the Terms); 2) the analytics tools Google Analytics and nda.lt, which the Operator uses as an independent controller (clause 3.7 of this DPA); 3) the services chosen by the Customer and the recipients' email service providers referred to in clause 7.4 of this DPA; 4) the provider of public holiday and name day data, to which the Service does not transfer personal data (clause 18.6 of the Terms).

17.6. Lists of the service providers of Sub-processors are published in their data processing terms; the Operator provides information about such providers and changes to them in accordance with the procedure set out in clause 6.6 of this DPA.

17.7. SIA VERTEX LV, registration number 50003866501, Mihoelsa iela 66-10, Daugavpils, LV-5401, Latvia (the VertexSMS service). Service provided: sending SMS messages from the Operator's sender name: one-time codes for verifying phone numbers on the Booking Page and in the Account (numbers of Clients, Team Members and the Customer), where the Customer uses these functions (clause 15.12 of this DPA). Data processed: the phone number, the text of the message containing the code, the sender name, the time and the delivery report with the mobile network code. Data location: the Sub-processor is established in Latvia (European Union); in delivering a message, the Sub-processor's telecommunications partners may process the number and the text of the message also outside the European Economic Area, subject to the safeguards stated in the Sub-processor's privacy policy (https://vertexsms.com/en/privacy) (clause 7.5 of this DPA). Retention by the Sub-processor: under its privacy policy, communications data is retained for two months by default.

18. SMS Gateway Service asms.lt

18.1. The SMS gateway service asms.lt is provided to the Customer by the Operator itself under a separate agreement (clauses 7.8 and 14.2 of the Terms). The Operator, as the provider of the asms.lt service, processes the personal data in the Customer's asms.lt account on the Customer's behalf, as a processor. Until a separate data processing agreement applies to the asms.lt service, such data is regarded as Processed Data for the purposes of this DPA, and this Section and Sections 1, 2, 4, 6, 7, 8, 9, 10, 13, 14 and 17 of this DPA apply to it. Sections 3, 5, 11, 12, 15 and 16 of this DPA describe the Service and do not apply to the data of the asms.lt account, except for the references to them made in this Section.

18.2. Description of processing. Subject matter and nature: sending and receiving SMS messages through the Customer's Android device and SIM card, storing messages and contacts in the Customer's asms.lt account and making them available through the interfaces of the asms.lt service, including to the Service (clause 15.7 of this DPA). Purpose: to enable the Customer to send and receive SMS messages using its business phone number. Data subjects: Clients and other persons who send messages to the SMS Gateway number, receive messages from it or are recorded in the contacts of the asms.lt account. Data: phone numbers, contact names and SMS opt-out flags, texts of SMS messages, the time of their sending and receipt, and their status; texts of SMS messages may also contain special categories of data (clause 15.17 of this DPA). Duration: for as long as the Customer's asms.lt account remains active, and until the data is returned or deleted under clause 18.4 of this DPA. The instructions consist of the functions and settings of the asms.lt service used by the Customer and the functions of the Service that the Customer has enabled (clauses 14.7, 14.8 and 21.3 of the Terms).

18.3. Security. For the data of the Customer's asms.lt account, the Operator shall apply the technical and organisational measures referred to in Article 32 of the GDPR, taking into account the criteria referred to in clause 5.1 of this DPA. Section 16 of this DPA describes only the measures of the Service; the Operator shall provide information about the measures of the asms.lt service at the Customer's request (clause 10.1 of this DPA). The Customer shall keep the asms.lt API key and its device secure and use only a business phone number for the SMS Gateway (clauses 14.3 and 14.7 of the Terms).

18.4. Return, deletion and liability. The data of the Customer's asms.lt account is not deleted together with the data of the Service under Section 30 of the Terms, because the asms.lt account may continue to be used after the end of the Agreement, and deletions are not carried over between the Service and the asms.lt account (clause 14.8 of the Terms). When the provision of the asms.lt service ends, the Operator shall, at the Owner's choice, return or delete the data of the asms.lt account and, if the Owner does not make a choice within a reasonable time, shall delete it, except for data that the law requires to be retained. This Section does not limit liability under the asms.lt service agreement (clause 7.8 of the Terms).