Data Processing Agreement (DPA)

Provider:
sesl GbR
Dammer Weg 31, 63773 Goldbach
Germany
Email: support@calendarbutler.com
Website: www.calendarbutler.com

This agreement is Annex A of the Framework Terms and applies to the Single Subscription and the Corporate Subscription (Hosted).

§ 1 Parties, subject matter and duration

1.1This agreement governs the processing of personal data by sesl GbR, Dammer Weg 31, 63773 Goldbach, Germany (the “Provider”) on behalf of the user of Calendar Butler (the “User”) under Art. 28 GDPR. It is Annex A of the Framework Terms.

1.2The User is the controller within the meaning of Art. 4(7) GDPR, the Provider is the processor within the meaning of Art. 4(8) GDPR.

1.3The subject matter is the processing of the calendar invitations that the User forwards to Calendar Butler, and the creation and sending of anonymous appointment blocks to the calendars the User has registered.

1.4The agreement is concluded when the order is completed (§ 8.3 of the Framework Terms). No signature is required.

1.5It applies for the duration of the subscription, including the 30-day trial period. The obligations on deletion (clause 5.3) and confidentiality continue beyond that.

1.6This agreement does not cover data that the Provider processes as a controller in its own right, such as account data, contract data and payment processing via Stripe. The Privacy Policy applies to that data.

1.7In the event of a conflict between this agreement and the terms and conditions, this agreement prevails on matters of data protection.

§ 2 Nature and purpose of processing, data and data subjects

2.1Nature of processing: receiving, reading, converting and storing the invitations, sending the appointment blocks, deleting.

2.2Purpose: providing Calendar Butler, that is, reconciling the User’s appointments across several calendars without appointment content or names reaching the target calendars.

2.3Types of data:

• Processed but not stored: names and email addresses of participants and organizers
• Processed but not stored: subject, description, invitation text and attachments
• Stored: start and end of the appointment, the recurrence rule for series, a technical appointment ID and the sender’s domain
• Sender address of the email (only the domain is stored)

2.4Data subjects: participants and organizers of the appointments, that is, the User’s clients, colleagues and business partners, and the User.

2.5Special categories of personal data (Art. 9 GDPR) are not processed deliberately. The User does not include them in the subject or the invitation text. If they nevertheless reach an invitation, the measures in Annex 1 apply to them equally.

§ 3 Obligations of the Provider

3.1Instructions. The Provider processes the data only on the User’s documented instructions. The instructions are this agreement together with the use of the service. The User gives further instructions in text form to support@calendarbutler.com. If the Provider considers an instruction unlawful, it informs the User and may suspend execution until the User confirms or changes the instruction.

3.2Confidentiality. The Provider obliges all persons with access to the data to confidentiality, unless they are already bound by law.

3.3Security. The Provider takes the technical and organizational measures under Art. 32 GDPR described in Annex 1. It may develop them further as long as the level of protection does not drop. It informs the User of material changes.

3.4Data subject rights. If a data subject contacts the Provider directly, the Provider forwards the request to the User without undue delay and does not answer it itself. The Provider supports the User in fulfilling data subject rights within its means.

3.5Support. The Provider supports the User with the obligations under Art. 32 to 36 GDPR, in particular notifications, data protection impact assessments and inquiries from supervisory authorities.

3.6Data breaches. The Provider reports personal data breaches that affect the User without undue delay, at the latest 48 hours after becoming aware of them. The report states the nature of the breach, the data concerned, the likely consequences and the measures taken. Further details follow as soon as they are available.

3.7Records. The Provider keeps a record of all processing activities under Art. 30(2) GDPR.

3.8Place of processing. Processing takes place in Germany. The exception is sending emails through a service provider based in the USA, see clause 4.4.

§ 4 Sub-processors and transfers to third countries

4.1The User consents to the use of the sub-processors named in Annex 2.

4.2The Provider informs the User at least 30 days before a new sub-processor is used or a sub-processor is replaced, by email or on the website. The User may object within 14 days for an important data protection reason. If the objection cannot be resolved, either party may terminate the subscription extraordinarily as of the date of use. Fees already paid for the period afterwards are refunded.

4.3The Provider imposes obligations on every sub-processor that correspond to this agreement. It is liable for the sub-processor’s processing as for its own acts.

4.4Emails are sent through Twilio SendGrid (Twilio Inc., USA). The recipient address and the content of the respective message are transferred to the USA. The basis is the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the service provider’s data protection agreement, in addition the EU-U.S. Data Privacy Framework where the recipient is certified. No transfer to any other third country takes place unless the User agrees in text form.

§ 5 Control, deletion, liability and final provisions

5.1Evidence. The Provider demonstrates compliance with this agreement on request, in particular by providing information, the measures in Annex 1 and certificates or audit reports of its sub-processors.

5.2Audits. If the evidence is not sufficient, the User may verify compliance itself or through an auditor who is not a competitor. This happens after 14 days’ notice, at most once a year unless there is a specific reason, and without disrupting operations unduly. The User bears the costs.

5.3Deletion and return. After the end of the agreement and after the period in sentence 3 has expired, the Provider deletes the User’s data unless a statutory retention obligation applies. The incoming invitation is deleted after processing. If the User’s account is deleted, the Provider keeps the stored block data for one year so that the User can reactivate the account and keep working with their appointments, and deletes it afterwards. On the User’s instruction in text form it deletes earlier. Return is not provided for, because the appointments are in the User’s calendars. On request the Provider confirms the deletion in text form.

5.4Liability. § 10 of the Framework Terms applies. The liability rules of the GDPR, in particular Art. 82, remain unaffected.

5.5Final provisions. Amendments and additions require text form. If a provision is invalid, the rest of the agreement remains effective. German law applies.

Annex 1: Technical and organizational measures

Data centers. The processing of the invitations and the appointment database run at Hetzner Online GmbH in the Falkenstein data center (Germany). Accounts, settings, mailbox and user database are hosted by ALL-INKL.COM on servers in Germany. Both service providers secure their sites with access control, entry protection, emergency power and fire protection. Hetzner Online GmbH is certified under ISO/IEC 27001.

Confidentiality

• Access to the user account only with two-factor login via an authenticator app
• Access to data and servers only for the Provider’s operators
• Encryption: the database is encrypted. Transmission via TLS between browser and website, SSL when retrieving the mailbox and STARTTLS when sending emails
• Data minimization: only anonymous blocks without names and content reach the target calendars. Calendar Butler does not access the User’s calendars through an interface. Error and alert messages to the operators contain no calendar addresses and no appointment content, only technical identifiers.

Integrity

• Each appointment block is linked to the original appointment through a technical appointment ID, so that changes and cancellations are carried over
• Data is passed on only to the sub-processors in Annex 2

Availability and resilience

• Hosting in data centers with uninterruptible power supply and fire protection
• Regular backup of the database

Deletion

• Incoming invitations are deleted after processing, only start, end, recurrence rule, appointment ID and sender domain are stored. Deleted accounts are kept for one year so that they can be reactivated, after that the data is deleted

Review procedure

• The Provider reviews the measures when the system changes materially
• The service providers’ evidence (certificates, audit reports, data protection agreements) is kept up to date

Annex 2: Sub-processors

Payment processing via Stripe concerns the User’s contract and payment data, not the data from the invitations. It is covered in the Privacy Policy.