Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between MB Fe dev, Vilnius, Lithuania ("Processor," "we," "us") and the merchant using Rezervito ("Controller," "you," "the merchant"), and applies whenever we process personal data on your behalf in connection with your Shopify customers' use of the Rezervito booking widget.

1. Roles

You are the Controller. You decide why your customers' data is collected (to run your booking calendar, enforce your no-show/deposit policy) and are responsible for your own compliance with GDPR and any other applicable data-protection law, including having a lawful basis for processing and telling your customers about your booking/cancellation policies.

We are the Processor. We process personal data only on your documented instructions (as expressed through your use of the app's features — turning on deposits, blocking a customer, etc.), not for our own independent purposes. See our Privacy Policy for the full description of what we collect and why.

2. Subject matter and duration

• Subject matter: processing of your customers' personal data (name, email, phone, appointment details, booking notes) as necessary to operate the Rezervito booking calendar on your Shopify store.
• Duration: for as long as the app is installed on your store, plus the retention window described in §4 of the Privacy Policy after uninstall or a data-deletion request.
• Nature and purpose: automated booking management, no-show/deposit tracking, client blocking, and related admin record-keeping — see Privacy Policy §2 for the full list.
• Categories of data subjects: your customers who book appointments through Rezervito, and your staff members who connect their Google Calendar.
• Categories of personal data: name, email, phone number, appointment details, free-text booking notes, (if applicable) Shopify customer ID, Waitlist requests (an email address with the service, staff member, day and time of day asked about), and reviews of visits (a rating and an optional comment, shown by first name once the merchant approves them). For a staff member who connects their Google Calendar: their Google account's email address, an encrypted access key, the calendars they chose, and the start and end times of their Busy events (Privacy Policy §6). See Privacy Policy §1 for the full list and what we deliberately don't collect (health/medical data).

3. Our obligations as Processor

We will:

• Process personal data only on your instructions, as expressed through the app's configuration and features, unless required to do otherwise by EU or Lithuanian law (in which case we'll inform you first, unless the law prohibits that).
• Ensure anyone we allow to process the data (our own staff, sub-processors) is bound by confidentiality.
• Implement appropriate technical and organizational security measures — TLS in transit, encryption at rest, EU-region hosting (see §6 below for our backup/reliability practices).
• Assist you, to the extent reasonably possible, in responding to data subject requests (access, deletion, portability) — in practice, most of this is self-service through the app's own admin screens and the mandatory Shopify customers/data_request / customers/redact webhooks.
• Notify you without undue delay if we become aware of a personal data breach affecting your customers' data, per our incident response process.
• Delete or anonymize personal data at the end of the retention window described in the Privacy Policy, or on your instruction, subject to the anonymize-not-delete approach already documented there (a merchant's legitimate interest in "this slot was booked and no-showed on this date" surviving longer than the customer's own PII).
• Make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits or inspections by you or an auditor you mandate, on reasonable notice.

4. Your obligations as Controller

You will:

• Have a lawful basis for the personal data your customers provide when booking (typically: performance of a contract — the booking itself).
• Tell your customers about your booking, cancellation, deposit, and no-show policies before they book — Rezervito enforces the mechanism, you own the policy and its disclosure.
• Not instruct us to process data in a way that would violate GDPR or other applicable law.
• Not use the notes field, or instruct your staff to use it, to record health, medical, or other special-category data — see Privacy Policy §1.
• Treat booking details written to a staff member's Google calendar, when that staff member connects Google Calendar, as your own processing: they are held in that Google account under Google's terms with its holder, and you decide, through the contact-details setting, whether customers' email and phone numbers are included. We remove only the upcoming events we added, when the calendar is disconnected; deleting the staff member or uninstalling leaves them there.

5. Sub-processors

We use the following sub-processors, listed in full in our Privacy Policy §5:

We'll notify you of any change to this list (adding or replacing a sub-processor) via the same channel we use for other material changes to our Terms/Privacy Policy. You may object to a new sub-processor on reasonable data-protection grounds within a reasonable period after notice; if we can't resolve the objection, either party may terminate the affected processing.

6. International transfers

Our hosting (Render) and CDN (Cloudflare) providers are US-incorporated companies operating EU-region infrastructure (Frankfurt). Data is stored physically in the EU, but as US companies, both are subject to US jurisdiction including the CLOUD Act — see our Privacy Policy §3 for the full, honest explanation of this. SMS reminders, when you turn them on, are sent through Messente Communications OÜ (Estonia), which receives the customer's phone number and reminder text. Google Calendar sync, for a staff member who connects it, exchanges data with Google LLC (US) under Google's own terms and data-transfer safeguards.

7. Data breach notification

If we become aware of a personal data breach involving your customers' data, we will notify you without undue delay, providing what we know at the time (nature of the breach, likely consequences, measures taken or proposed) so you can meet your own 72-hour notification obligation to your supervisory authority under GDPR Article 33.

8. Term and termination

This DPA remains in effect for as long as we process personal data on your behalf under the Terms of Service. On termination (uninstall), we handle your data per the retention/deletion timelines already described in the Privacy Policy and the mandatory Shopify shop/redact process.

9. Contact

support@fedevapps.com — for DPA-related questions, including sub-processor objections and audit requests.