Draft — these texts are still being reviewed by a lawyer and may change.

Version 0.1 · 21 October 2026

Data Processing Agreement (DPA) — PetPoint

This Data Processing Agreement ("DPA") is entered into between the business that has accepted the PetPoint Terms of Service ("Customer", "Controller") and [Seller legal name], [ENI / Unipessoal Lda], NIF [number], [address], Portugal ("PetPoint", "Processor"). It applies whenever PetPoint processes personal data on behalf of the Customer while providing the PetPoint service ("Service").

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Regulation (EU) 2016/679 ("GDPR"). "Customer Data" means personal data entered into or collected through the Service by or for the Customer, including data of the Customer's clients, their pets' owners and the Customer's staff.

2. Roles and scope

2.1 The Customer is the controller and PetPoint is the processor of Customer Data. PetPoint is a separate controller for the data of its own account users and billing contacts, as described in the PetPoint Privacy Policy.

2.2 Subject matter, duration, nature and purpose of processing, types of personal data and categories of data subjects are set out in Annex I.

2.3 The Customer is responsible for having a lawful basis for the processing, for informing its clients (for example, through the privacy notice shown on its salon website), and for the accuracy of Customer Data. The Customer must not enter special categories of personal data (Art. 9 GDPR) — such as health data of people — into free-text fields of the Service.

3. Instructions

PetPoint processes Customer Data only on documented instructions from the Customer. The Terms of Service, this DPA and the Customer's use and configuration of the Service are the Customer's complete instructions. PetPoint will inform the Customer if, in its opinion, an instruction infringes the GDPR. PetPoint may process Customer Data otherwise only where required by EU or Member State law, and will inform the Customer of that requirement unless the law prohibits it.

4. Confidentiality

PetPoint ensures that every person authorised to process Customer Data is bound by confidentiality. Access is limited to what is needed to operate, support and secure the Service.

5. Security

PetPoint implements the technical and organisational measures in Annex II and may update them, provided the overall level of protection is not reduced.

6. Sub-processors

6.1 The Customer gives general authorisation for PetPoint to engage sub-processors. The current list is published at subprocessors (Annex III).

6.2 PetPoint will notify the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance by email to the business owner and on that page. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for the remaining period.

6.3 PetPoint imposes on each sub-processor data-protection obligations that are substantially the same as in this DPA and remains liable for its sub-processors.

7. International transfers

Customer Data is stored in the European Union (primary database: Frankfurt, Germany). Where a sub-processor processes Customer Data outside the EEA, PetPoint ensures an adequate transfer mechanism: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses (Commission Decision (EU) 2021/914).

8. Assistance

8.1 Taking into account the nature of processing, PetPoint assists the Customer with responding to data subject requests, mainly by providing in-product tools to view, correct, export and delete client data. If PetPoint receives a request directly from a Customer's client, it will forward it to the Customer and will not respond itself, except to direct the person to the Customer.

8.2 PetPoint provides reasonable assistance with data protection impact assessments and prior consultations, to the extent the Customer cannot do this with the information available in the Service and its documentation.

9. Personal data breaches

PetPoint will notify the Customer without undue delay and in any case within 48 hours after becoming aware of a personal data breach affecting Customer Data. The notice will include, as far as known: the nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases. Notifying the supervisory authority and data subjects is the Customer's responsibility as controller; PetPoint will assist.

10. Deletion and return

During the subscription the Customer can export and delete Customer Data in the Service. After the account is closed or the agreement ends, the Customer has 30 days to export its data; PetPoint then deletes Customer Data within 90 days, except where EU or Member State law requires storage. Encrypted backups are overwritten within 30 days of deletion.

11. Audits

PetPoint makes available the information necessary to demonstrate compliance with Art. 28 GDPR, primarily this DPA, Annex II and sub-processors' certifications and reports. The Customer may request an audit or inspection by itself or an independent auditor bound by confidentiality, with at least 30 days' notice, no more than once per year (unless required by a supervisory authority or following a breach), at the Customer's cost, and without disrupting the Service or the confidentiality of other customers.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service, to the extent permitted by law. In case of conflict regarding personal data, this DPA prevails over the Terms of Service.

Annex I — Description of processing

Controllerthe Customer (salon/grooming business)
ProcessorPetPoint, [legal name, address, NIF], contact: privacy@[domain]
Subject matter and durationprovision of the Service for the term of the subscription plus the deletion period in section 10
Nature and purposestorage, organisation, retrieval, display, transmission (emails/notifications), online booking, reporting — to manage the Customer's clients, pets, appointments, payments, staff, stock and finances, and to run the Customer's salon website
Data subjectsthe Customer's clients (pet owners) and website visitors who book; the Customer's staff
Personal dataclients: name, phone, email, preferred language, notes, tags, discount, blacklist flag and reason, pets (name, species, breed, sex, birth date, weight/height, allergies, behaviour, groomer notes, photos), appointments, payments (amount, method, tip — no card data), client portal login; staff: name, email, role, schedule, services, pay scheme, payroll, performance statistics
Special categoriesnone intended (see 2.3)
Frequencycontinuous

Annex II — Technical and organisational measures

  1. Hosting in the EU: database in Frankfurt (Neon, AWS eu-central-1), application functions in Frankfurt (Vercel fra1).
  2. Encryption: TLS for all connections; encryption at rest by the database and storage providers; nightly backups encrypted with AES-256 and kept for 30 days.
  3. Tenant isolation: every business record carries a tenant identifier; all data access goes through one API layer that filters by tenant and checks role permissions; automated tests verify that one business cannot access another's data.
  4. Access control: roles owner/admin/staff with least-privilege permissions and salon scoping; staff see only their own clients and appointments; email verification required; passwords stored as hashes; session lifetime 30 days; rate limiting on authentication.
  5. Accountability: append-only audit log of significant actions, without client personal data.
  6. Data minimisation and erasure: in-product deletion and anonymisation of clients; invitation and login tokens are stored as hashes and expire.
  7. Backups and recovery: nightly backups with an automated restore test.
  8. Development: schema and migrations under version control; code review and automated tests before deployment; production data is not used in development or testing environments.
  9. Personnel: access to production limited to the owner of PetPoint; confidentiality obligations for anyone with access.
  10. Incident response: documented procedure for breach detection, containment, credential rotation and notification (section 9).

Annex III — Sub-processors

See subprocessors.