Data Processing Agreement

Data Processing Agreement (GDPR Article 28)

Version 6 (DRAFT) · Tablemeet by SISI TECH SOLUTIONS was previously called “Event Scheduler”; only the name has changed. This agreement is part of the Terms and Conditions of Tablemeet.

Controller: the Customer (the company that uses Tablemeet), represented by the admin who accepts this agreement. Processor: SISI TECH SOLUTIONS SRL, Str. C. C. Arion 11, Et. Parter, Ap. 1, 011081 Bucharest, Sector 1, Romania, VAT/tax ID [to be completed], registration number [to be completed], contact contact@sisitechsolutions.com.

1. Subject and duration

1. The Processor provides Tablemeet to the Controller and, in doing so, processes personal data on the Controller's behalf.
2. This agreement lasts as long as the Controller uses the service, plus the deletion period in section 9.
3. Applicable law: Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018 on measures implementing the GDPR.

2. Nature and purpose of the processing

Hosting, storing, displaying, exporting and backing up the data the Controller's Users enter in the app, so that the Controller can plan and run its meetings at trade events. The Processor does not use the data for its own purposes.

3. Types of personal data

• Users of the Controller: name, email address, role, whether the account is active, login details (password hash and two-factor authentication devices are held by the login service), time of last login.
• Emails to Users: the recipient's email address; for notification emails also the changed meeting's company, date, time, place and event (never the text of bullet points, finance or discussion notes).
• The Controller's business contacts (people at the companies it meets): name, job title, company, mobile and other phone numbers, email address.
• Calendar invites to the Controller's business contacts (only when a User ticks "Send calendar invite to customer" for a meeting): the contact's name and email address, the organising User's name and email address, the two companies, the meeting's date, time and place, and who received the invite and when (never bullet points, finance or discussion notes, and no links into the app).
• Meetings: date, time, place, our attendees, customer attendees, status, free-text notes.
• Bullet points (sales bullet points, notes from finance) and discussion notes written by Users, which may mention people.
• Activity log: who did what in the app and when (names of Users, counts and field names, never the content of notes).
• Acceptance records of these legal documents (name, job title, date).
• No national identification numbers, no special categories of data, no payment card data.

4. Data subjects

Employees and representatives of the Controller; employees and representatives of the companies the Controller meets.

5. Instructions

1. The Processor processes personal data only on the Controller's documented instructions: the Terms, this agreement and the way the Controller's Users use the app. If the Processor believes an instruction breaks the law, it informs the Controller.
2. The Processor will not transfer personal data outside the storage locations in section 7 without the Controller's agreement, except where required by law.

6. Confidentiality and security (Article 32)

1. The Processor's staff who may access personal data are bound by confidentiality.
2. Technical and organisational measures: two-factor authentication (authenticator app) available for every login, and may be required by the Controller; per-customer access rules enforced in the database (row level security), so that one customer can never read another's data; role-based permissions inside a customer; encryption in transit (HTTPS/TLS) and encryption at rest by the hosting providers; private storage for logos; secret keys kept only on the server; an append-only activity log; passwords of at least 12 characters, stored hashed by the login service; regular updates of the software's dependencies.
3. [to be completed: backup frequency and retention of backups.]

7. Storage location and sub-processors

1. Data is stored in the United Kingdom (London), which is covered by the European Commission's adequacy decision for the UK.
2. Sub-processors the Controller agrees to:

• Supabase, Inc. – database, login service and file storage; data centre in London (UK). [to be completed: contractual address.]
• Netlify, Inc. – web hosting of the application (serves the pages; does not store the Controller's data). [to be completed: region and address.]
• Resend, Inc. – sending the app's emails (invites, password resets, meeting notification emails and calendar invites to the Controller's business contacts); EU region (Ireland). [to be completed: contractual address.]

1. The Processor informs the Controller of intended changes to this list at least [to be completed] days in advance; the Controller may object on reasonable grounds.
2. The Processor remains responsible for its sub-processors and has agreements with them that provide the same level of protection.

8. Assistance to the Controller

1. The Processor helps the Controller answer requests from data subjects (access, rectification, erasure, restriction, portability, objection) within [to be completed] days: Users can edit or delete contacts, meetings and notes themselves, and the Processor can produce an export or delete an account on request at contact@sisitechsolutions.com.
2. The Processor helps with data protection impact assessments and consultations with the supervisory authority where needed, taking into account the information it has.

9. Deletion and return of data

1. When the Controller stops using the service, it can download its data (Excel, PDF, calendar files) before the end.
2. The Processor deletes the Controller's organisation and all of its data from the live database when the Controller asks for it or within [to be completed] days after the end of the agreement, and from backups within [to be completed] days after that. A record of the deletion (which customer, when, counts) is kept without personal data of the Controller's contacts.
3. Acceptance records of the legal documents and the activity log entries that name Users may be kept for [to be completed] years as evidence.

10. Personal data breaches

1. The Processor informs the Controller without undue delay, and at the latest within [to be completed: e.g. 48] hours after becoming aware of a personal data breach affecting the Controller's data, with the information needed for the Controller's notification to the supervisory authority (Article 33) and to data subjects (Article 34).
2. Contact for breaches: contact@sisitechsolutions.com, [to be completed].

11. Audits

The Processor makes available the information needed to show compliance with Article 28 and allows audits by the Controller or an auditor mandated by it, with reasonable notice and at most once a year unless a breach occurred. [to be completed: costs.]

12. Supervisory authority

The Romanian supervisory authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro.

13. Signature

Accepted electronically in the app by an admin of the Controller on its behalf (name, job title, date and time are recorded) and by SISI TECH SOLUTIONS SRL by publishing this version.