Data Processing Agreement (DPA)
Version 3 · in effect from October 7, 2026
1. Parties and conclusion
The controller is the business using Appointa, identified by the data in its account and billing details (the “business”).
The processor is CODEVO, obrt za računalne i druge usluge, vl. Ivan Babić, Krotovica 16, 10040 Zagreb, Croatia, OIB (Croatian tax ID) 00448210519, e-mail [email protected] (the “processor”).
This agreement is made under Article 28 of the General Data Protection Regulation (GDPR) and forms part of the Terms of Service. The business accepts it electronically, when opening an account or in the app, through a person authorised to represent it.
2. Subject matter, nature, purpose and duration
Subject matter: providing the Appointa service — bookings and calendar, client records, notifications to clients (e-mail, SMS, push), client forms, messages, reviews, loyalty programmes, packages and vouchers and, where the business turns fiscalisation on, issuing and fiscalising invoices to clients in the Codevo Fiskal software and delivering them to clients.
Nature of processing: collection through booking pages and apps, storage, organisation, retrieval, alteration, sending notifications, issuing invoices and sending them to the Tax Administration for fiscalisation, export and erasure.
Purpose: solely providing the service to the business according to its instructions.
Duration: for as long as the business uses Appointa and until the data is deleted or returned under section 10.
3. Types of data and categories of data subjects
Clients of the business: first and last name; contact details (phone, e-mail); appointment data (service, staff member, time, price, status, cancellations); notes, preferences, allergies and date of birth if the business enters them; messages; reviews; loyalty, package and voucher data; answers to forms; invoices the business issues (items, amounts, payment method, invoice number and fiscal data); device tokens for push notifications.
Staff and other users of the business: name, e-mail, phone, photo, working hours and role; for staff who issue invoices, also their personal OIB and operator code.
Special categories of data (Article 9 GDPR). Client forms may contain health data (e.g. allergies, medication, pregnancy, injuries, skin conditions), and so may the allergies field in a client’s profile. We process such data only if the business collects it. The business ensures the legal basis, usually the client’s explicit consent (Article 9(2)(a)): the built-in form templates that ask for health data include a consent field, and the business must add one to its own forms itself. The business assesses whether a data protection impact assessment (Article 35) is needed, and the processor assists under section 8.
4. Instructions of the business
The processor processes personal data only on documented instructions from the business, including with regard to transfers to third countries. The instructions are this agreement, the Terms of Service and the business’s settings and actions in the app (entering, changing and deleting data, sending notifications, exports).
The exception is processing required by Union or Croatian law; the processor then informs the business before processing, unless that law prohibits it.
By turning fiscalisation on, the business instructs the processor to issue and fiscalise its invoices in the Codevo Fiskal software, which the processor produces and maintains, to send the data of every invoice, including the business’s OIB and the OIB of the employee who issues it, to the Croatian Tax Administration as the Fiscalisation Act requires, and to keep issued invoices for at least 11 years, as described in the Terms addendum — fiscalisation. The Tax Administration receives that data as a public authority, not as a sub-processor.
If the processor considers that an instruction infringes the GDPR or other data protection rules, it informs the business immediately.
The processor does not use clients’ data for its own purposes, does not sell it and does not use it to train AI models.
5. Confidentiality
Only people who need access to provide the service can access the data: the owner of the sole trader business and, where needed, collaborators who have committed to confidentiality or are under a statutory obligation of confidentiality.
6. Security of processing
The processor applies measures under Article 32 GDPR, including:
- Hosting: servers and backups with Hetzner Online GmbH in the European Union; traffic passes through Cloudflare (attack protection, and the server accepts connections only through Cloudflare).
- Encryption in transit: TLS 1.2 and 1.3, HSTS.
- Server protection: firewall, SSH key-only access, blocking of repeated sign-in attempts; the database, cache and file storage are not reachable from outside. Public images (logos, service photos, profile pictures) are served through unguessable links.
- Access control: data is separated per business at application level; owner, manager and staff roles; passwords are stored as hashes (scrypt); two-factor sign-in is available to all users with a password and mandatory for the processor’s administrative access; request rate limits.
- Logging: sensitive actions (viewing form answers, the processor’s administrator accessing a business account, deleting a business, changes to billing details) are recorded in an audit log.
- Fiscalisation: the access key and secret for Codevo Fiskal are stored encrypted (AES-256-GCM); the FINA certificate and its password are not stored in Appointa, and the certificate’s private key is kept encrypted in Codevo Fiskal and used only to sign the business’s invoices.
- Data minimisation: form answers are deleted automatically 24 months after the appointment; request logs are kept for 90 days with a truncated IP address.
- Backups: daily database copies (21 days), encrypted system backups (up to 6 months) and encrypted continuous database archiving with point-in-time recovery; a full restore was tested on 26 June 2026.
- Maintenance: automated monitoring and weekly dependency updates, with security fixes applied immediately; a security review was carried out on 26 June 2026.
The processor adapts these measures to the state of the art and to risks, and informs the business of material changes.
7. Sub-processors
The business gives general authorisation for the engagement of sub-processors. The current sub-processors are:
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Servers, database, backups | EU | — |
| Cloudflare, Inc. | DNS, attack protection, traffic passing through | Global | EU–US DPF / standard contractual clauses |
| Resend | Sending e-mails to clients | USA | EU–US DPF / standard contractual clauses |
| Infobip | Sending SMS messages to clients (if the business uses them) | EU | — |
| Google LLC (Firebase Cloud Messaging, Crashlytics, Gmail) | Push notifications, app crash reports, support mailbox | Global | EU–US DPF / standard contractual clauses |
| Apple Inc. | Push notifications on iOS devices | Global | EU–US DPF / standard contractual clauses |
| Anthropic PBC | AI assistant in the admin area (receives the user’s question and the names of services and staff) | USA | EU–US DPF / standard contractual clauses |
Codevo Fiskal is not a sub-processor: the processor produces and maintains it, and it runs on the infrastructure of the sub-processors listed above.
The processor imposes on sub-processors the same data protection obligations as in this agreement and remains fully liable to the business for their performance.
The processor informs the business by e-mail at least 30 days before adding or replacing a sub-processor. Within that period the business can object at [email protected]. If we cannot resolve the objection, the business can terminate the contract before the change takes effect.
8. Assistance to the business
Data subject rights. In the app the business can view and correct a client’s data, anonymise a client, delete form answers and export the list of appointments. Where that is not enough, the processor helps respond to data subject requests on request. A data subject’s request that reaches the processor is forwarded to the business without delay, at the latest within 3 working days.
Obligations under Articles 32–36 GDPR. The processor assists the business in ensuring security of processing, notifying personal data breaches, carrying out data protection impact assessments and prior consultation with the supervisory authority, taking into account the nature of processing and the information available to it.
9. Personal data breaches
The processor notifies the business of a personal data breach without undue delay and at the latest 72 hours after becoming aware of it. The notice contains, as far as known: a description of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact for further information. Information not available immediately is provided later without undue delay.
The processor keeps a record of breaches and helps the business notify the Croatian Personal Data Protection Agency and data subjects where required.
10. End of processing: return and deletion of data
When the business stops using the service, it chooses whether its data is returned or deleted.
Return: the business can export its list of appointments as CSV itself at any time and, if it turned fiscalisation on, its list of issued invoices (CSV or Excel). On request, the processor prepares an export of all of the business’s data in a machine-readable format (CSV or JSON) within 30 days.
Deletion: the processor deletes the business and all personal data it processes on its behalf within 30 days of the request, or of the end of the return period. Data in backups disappears as their cycle expires, at the latest after 6 months. Backups of the data in Codevo Fiskal, where invoices are issued and fiscalised, are kept for at most 13 months. The additional copy of files (e.g. photos), which is not rotated automatically, is deleted by the processor together with the active data.
The exception is data the processor must keep under Union or Croatian law, and issued invoices with their fiscalisation data, which the processor keeps for at least 11 years on the business’s instruction (section 4). Clients who have their own user account in the Appointa app keep that account; their data held by the deleted business is deleted.
11. Audits and demonstrating compliance
The processor makes available to the business all information needed to demonstrate compliance with Article 28 GDPR (this agreement, the list of sub-processors, the description of measures, the report of the latest security review).
The business, or an auditor it mandates, can carry out an audit, including an inspection, with at least 30 days’ notice, during working hours and under confidentiality, at most once a year, except after a data breach or at the request of a supervisory authority. An audit must not put other businesses’ data at risk. The business bears the cost of the audit unless it finds a material breach of this agreement.
12. Liability and final provisions
The parties’ liability is governed by the Terms of Service, except to the extent that Article 82 GDPR or other mandatory rules provide otherwise.
For data protection matters this agreement prevails over the Terms of Service. This agreement is governed by the law of the Republic of Croatia.
The processor announces changes to this agreement by e-mail at least 30 days in advance. Changes that reduce the protection of data give the business the right to terminate the contract before they take effect.
This English version is a translation; in case of doubt the Croatian version prevails.