Data Processing Agreement

1. Parties

• Controller: the company or sole trader that accepted the Jedro+ Terms of Service (the "User").
• Processor: Sonja Žužek s.p., Prešernova cesta 21A, 1234 Mengeš, Slovenia, registration number 9323228000, authorised person Tim Kogej, tim.kogej@jedroplus.com (the "Provider").

2. Subject matter and duration

The Provider processes personal data on behalf of the User solely to provide the Jedro+ app, to the extent of the features the User uses. This agreement applies for as long as the service agreement does, and until the data is deleted after it ends.

3. Nature and purpose of processing

Storage, organisation, display, sending messages (email, SMS), answering and transcribing phone calls, preparing answers with AI models, processing online payments, export and deletion — for managing appointments and clients, reminders, notices, marketing messages, online booking, Chatbot+ and Receptionist+.

4. Types of data and data subjects

• The User's clients: first and last name, email, phone, gender, language, notes, client type, appointment history, services, prices and discounts, payment status, marketing consent and unsubscribes.
• Callers (Receptionist+): phone number, call recording and transcript, call outcome.
• Chat visitors (Chatbot+): conversation content and data they enter.
• The User's staff: name, contact, schedule, absences, assigned appointments.

Special categories of data are processed only if the User enters them (e.g. in notes); the User ensures a legal basis and limits them to what is necessary.

5. Provider's obligations

• Processes data only on the User's documented instructions, given through the use and settings of the app, and informs the User if it considers an instruction unlawful.
• Ensures that persons with access to the data are bound by confidentiality.
• Implements the technical and organisational measures in section 7.
• Assists the User with data subject requests (access, rectification, erasure, export) and with obligations under Articles 32 to 36 GDPR.
• Notifies the User of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with all information available.
• Provides, on request, the information needed to demonstrate compliance and allows reasonable audits (normally through documentation and written answers).

6. Sub-processors

The User gives general authorisation for the sub-processors listed on the "Sub-processors" page. The Provider binds each of them to the same data protection obligations and is liable for them as for itself.

The Provider informs the User of any new or replaced sub-processor at least 30 days in advance (by email or in the app). The User may object on reasonable grounds; if no solution is found, the User may terminate without cost.

Transfers to third countries take place only with appropriate safeguards (Standard Contractual Clauses, EU-US Data Privacy Framework).

7. Technical and organisational measures

• Encryption in transit (TLS) and encryption at rest at the database provider.
• Database, hosting, email and automation server in the EU.
• Separation of data per business; database-level access rules (RLS); data written only through verified server routes.
• Role-based access (owner, administrator, staff) and least privilege; secret keys on the server only.
• Rate limiting and abuse protection; signed links (e.g. for unsubscribing).
• Regular backups at the database provider; logging of changes to appointments and clients.
• Automatic deletion of call recordings after 90 days and of data after the agreement ends.

8. User's obligations

• Has a legal basis for processing the data of its clients, staff and callers and informs them (e.g. in its own privacy policy).
• Sends marketing messages only to clients for whom it has a basis, and respects unsubscribes.
• Keeps the Receptionist+ recording notice on, or itself ensures that recording is lawful.
• Gives access to the app only to people who need it and removes access in time.

9. End of processing

After the agreement ends the User may export the data. The Provider deletes it 90 days after the end, including copies at sub-processors within their backup periods, unless the law requires it to be kept.

10. Final provisions

Liability is governed by the Terms of Service except where the GDPR provides otherwise. The law of the Republic of Slovenia applies. If language versions differ, the Slovenian version applies.