Data processing agreement

This agreement, required by Article 28 of the General Data Protection Regulation (GDPR), is part of the terms of service accepted when the account is created. It is made between the professional who uses Resaly (“the Business”), the controller, and [Raison sociale] (“Resaly”), the processor. It applies as long as the Business’s account exists.

1. Description of the processing

Subject and purpose: letting the Business take and manage appointments online, keep its agenda and notify its customers by email.
Nature: collection through the booking form, hosting, viewing, editing, sending emails, export and erasure.
Data subjects: the Business’s customers and its team members.
Data: identity and contact details (first name, last name, email, phone), appointments (date, service, price, team member, status, customer’s message), the Business’s private notes, language, and technical data (IP address, bot check) used against abuse.
Duration: that of the Business’s account.

2. Resaly’s commitments

Process the data only on the Business’s documented instructions, which are the terms of service and the way it uses the service, and tell the Business if an instruction seems to breach the law.
Ensure that the people allowed to process the data are bound by confidentiality.
Apply the security measures described below.
Help the Business answer requests from data subjects: the service lets it view, correct, export and erase its customers’ data. Resaly passes on to the Business the requests it receives directly.
Help the Business keep the data secure and, if needed, carry out an impact assessment.
Make available to the Business the information needed to show that this agreement is followed.

3. Security measures

Encrypted connections (HTTPS).
Each business’s data kept apart in the database (row level security), checked by automated tests.
Access limited to the people who need it; passwords stored hashed; the service’s access keys kept secret.
Database and files hosted in the European Union (Paris), with regular backups.

4. Sub-processors

The Business authorises Resaly to use the following sub-processors:

Supabase Pte. Ltd.: database, logins and files. Location: European Union (Paris, France). Safeguards: data hosted in the European Union; standard contractual clauses for remote support.
Railway Corporation: website hosting and execution, audience measurement (Umami, which we host ourselves). Location: European Union (Amsterdam, Netherlands). Safeguards: data hosted in the European Union; standard contractual clauses for access from the United States.
Resend (Plus Five Five, Inc.): sending emails. Location: European Union (Ireland) and United States. Safeguards: EU–US Data Privacy Framework; standard contractual clauses.
Sentry (Functional Software, Inc.): monitoring the website’s technical errors. Location: European Union (Frankfurt, Germany) and United States. Safeguards: EU–US Data Privacy Framework; standard contractual clauses.
Cloudflare, Inc.: protecting the booking form from bots (Turnstile). Location: Cloudflare’s global network. Safeguards: EU–US Data Privacy Framework; standard contractual clauses.

Resaly lets the Business know by email at least 30 days before adding or replacing a sub-processor. The Business may object; if no solution is found, it can delete its account. Resaly binds each sub-processor to the same data protection obligations as this agreement, and remains responsible for their compliance.

5. Transfers outside the European Union

Data is only transferred outside the European Union with appropriate safeguards: an adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.

6. Personal data breaches

Resaly informs the Business of any personal data breach without undue delay, and at the latest 48 hours after becoming aware of it, with the information it has: the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences and the measures taken.

7. End of the processing

The Business can download all its data from Settings at any time. When it deletes its account, Resaly erases all the Business’s data from the database and its files at once; backup copies are overwritten within 7 days.

8. The Business’s obligations

Have a legal basis for the processing it entrusts to Resaly and inform its customers (the booking form does so for online bookings).
Only collect the data it needs, and no sensitive data unless it is strictly necessary and the person has explicitly agreed.
Answer its customers’ requests about their data.

9. Audits

On written request, Resaly provides the information needed to check that this agreement is followed. An audit may be carried out at most once a year, by an independent auditor bound by confidentiality, with 30 days’ notice and at the Business’s expense.