1. Parties and roles
The Controller is the salon, studio or other business that has accepted the Terms of Service and uses Retunk to manage its own clients. The Processor is Morovid s.r.o., Kurzova 2222/16, 155 00 Praha, IČO 21762261, DIČ CZ21762261, registered in the Commercial Register maintained by Městský soud v Praze.
The Controller is the data controller of the personal data relating to its clients that it processes through Retunk. The Processor processes that data only as a processor and only on the Controller's documented instructions, including as set out in this DPA and the Terms of Service.
This DPA applies for the duration of the Terms of Service and until all personal data processed under it is deleted or returned in accordance with section 10.
2. Subject matter and duration
The Processor provides the Retunk platform: online booking, client and appointment management, notifications, payments, vouchers and website publishing. In doing so it processes personal data contained in the Controller's account, client records, bookings, sales and communications on the Controller's behalf.
3. Nature and purpose of processing
Processing consists of storage, organisation, retrieval, disclosure to authorised subprocessors, and deletion of personal data, for the following purposes: enabling clients to book appointments; maintaining client and visit records; sending booking confirmations, reminders and marketing messages at the Controller's direction; processing payments and deposits; selling and redeeming vouchers; and providing analytical features to the Controller.
The Processor does not process personal data for its own purposes, does not sell it, and does not use it to train advertising profiles.
4. Categories of personal data and data subjects
The processing concerns the following categories of personal data and data subjects:
- Data subjects: the Controller's clients, prospective clients, and staff whose data the Controller enters.
- Identification and contact data: name, email address, phone number, date of birth or birthday where the Controller records it.
- Booking data: services requested, appointment dates and times, assigned staff member, status and history.
- Notes and preferences: free-text notes, allergies or preferences recorded by the Controller.
- Transaction data: amounts, currency and identifiers of bookings, vouchers and payments.
- Communication data: content and delivery status of messages sent to data subjects at the Controller's direction.
The Controller determines whether any special categories of data (Article 9 GDPR) are processed and, if so, ensures it has a lawful basis and appropriate safeguards. The Processor does not require special category data and recommends that the Controller avoids recording it unless necessary.
5. Processor obligations
The Processor shall:
- process personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do otherwise by Union or Member State law, in which case it will inform the Controller unless prohibited from doing so;
- ensure that persons authorised to process the data are bound by appropriate confidentiality obligations;
- implement the technical and organisational measures described in section 6;
- respect the conditions for engaging subprocessors set out in section 7;
- assist the Controller in responding to data subject rights requests, taking into account the nature of the processing;
- assist the Controller in ensuring compliance with Articles 32 to 36 GDPR, including notifying the Controller without undue delay after becoming aware of a personal data breach;
- delete or return personal data at the end of the provision of services, in accordance with section 10; and
- make available all information necessary to demonstrate compliance with Article 28 GDPR and allow for audits as described in section 9.
The Processor will inform the Controller without delay if, in its opinion, an instruction infringes the GDPR or other data protection law.
6. Security measures
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the Processor shall implement appropriate technical and organisational measures, including:
- encryption of personal data in transit (TLS) and at rest;
- access controls based on least privilege, with authentication and role-based permissions;
- network and application protection, logging and monitoring of access to production systems;
- secure development, code review and dependency management practices;
- regular backups with tested restoration procedures;
- a documented incident response and breach notification process; and
- due diligence and contractual safeguards for all subprocessors.
7. Subprocessors
The Controller grants general authorisation for the Processor to engage subprocessors. The Processor will inform the Controller of any intended changes concerning the addition or replacement of subprocessors, giving the Controller the opportunity to object, and will impose on each subprocessor the same data protection obligations as set out in this DPA. Current subprocessors are:
| Subprocessor | Role |
|---|---|
| Cloudflare, Inc. | Hosting and content delivery, object storage, queues, email delivery and aggregate analytics. |
| Stripe Payments Europe, Ltd. | Payment processing, deposits, subscriptions and payouts. |
| GatewayAPI A/S | Delivery of SMS messages and reminders. |
| Functional Software, Inc. (Sentry) | Error monitoring and application diagnostics. |
| Seznam.cz, a.s. (Mapy.com) | Address search and geocoding. |
| Our managed PostgreSQL database provider | Storage of application data. |
| Meta Platforms, Inc. | Optional Instagram integration connected at the Controller's choice. |
8. International transfers
The Processor shall not transfer personal data outside the European Economic Area without the Controller's documented instruction and appropriate safeguards under Chapter V GDPR. Where a transfer occurs, the Processor relies on an adequacy decision, the European Commission's Standard Contractual Clauses and, where relevant, the EU–U.S. Data Privacy Framework. Details are set out in the Privacy Policy.
9. Data subject requests and audit
The Processor will forward to the Controller, without undue delay, any request it receives from a data subject relating to the Controller's personal data, and will not respond to the data subject except on the Controller's instructions or as required by law.
The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, by the Controller or an auditor mandated by it, on reasonable notice and no more than once per year, absent a specific incident or a legal requirement.
10. Deletion and return
On termination of the services, the Processor shall, at the Controller's choice, delete or return all personal data processed on the Controller's behalf, including in backups, within 30 days, and certify deletion in writing on request, unless Union or Member State law requires further storage. Data held in routine backups is deleted on the normal backup rotation, within 90 days.
11. Liability
Each party is liable in accordance with the Terms of Service and applicable law for damage caused by processing that infringes the GDPR. The limitations of liability in the Terms of Service apply to this DPA to the extent permitted by Article 82 GDPR and mandatory law.
12. General and order of precedence
This DPA forms part of the Terms of Service. By accepting the Terms of Service and using Retunk to process personal data, the Controller enters into this DPA. In case of conflict between this DPA and the Terms of Service on the subject of data protection, this DPA prevails.
Amendments to this DPA must be made in accordance with the change provisions of the Terms of Service.
13. Contact
Questions about this DPA may be directed to Morovid s.r.o., Kurzova 2222/16, 155 00 Praha, or by email to privacy@retunk.com.