Data processing agreement

1. Who is who

Your business is the controller: you decide what the data of your customers is used for. DutchCalendar (Tristan de Lange, Leeuwarden) is the processor: we only process it for you.

This agreement applies as long as your business has an account with DutchCalendar, and after that until we have deleted the data (article 11).

For the data of your own account and your team, DutchCalendar itself is responsible. That is covered by our privacy policy.

2. Which data, and what for

What for

Scheduling appointments for your business: letting customers book, reschedule and cancel, and showing the appointments to you and your team.

Whose

Your customers: everyone who books an appointment with your business.

Which data

Name, e-mail address, phone number if filled in, the answers to the questions you ask for an appointment type, and the appointment itself: what, when, with whom and possibly with which resource, such as a car or room.

What we do with it

Store it, show it in your dashboard and in the iPhone app, send e-mails (confirmation, reminder, change), put it in the connected calendars of your team, send it to your own systems through the API and webhooks if you connect them, and delete it.

We only process special categories of personal data, such as about someone's health, if you ask for it in your questions. Only do so if it is really needed; you are responsible for that.

3. Your instructions

We only process the data as you want: according to this agreement and what you set up in DutchCalendar, such as your appointment types, your connections and your API keys. Not for ourselves, and we sell nothing.

If we think an instruction is against the GDPR, we say so. If we must do something because the law requires it, for example give data to a court, we let you know, unless the law forbids that.

4. Confidentiality

Only those who work for DutchCalendar and really need it can access the data, and they must keep it confidential. Right now that is only Tristan de Lange. We only look at it if you ask for help, or if it is needed for security or by law.

5. Security

We take these measures (article 32 GDPR):

• Everything goes over https, and browsers must keep using it (HSTS).
• The server and the database are in a data centre in the Netherlands. The database can only be reached from the server itself.
• Logging in to the server is only possible with a key, not with a password. The firewall only lets website traffic and that access through, and security updates install automatically.
• We store passwords and API keys only as a hash. The access to calendars and the secrets of webhooks are encrypted in the database (AES-256).
• Each business only sees its own data, and within a business the role decides what someone can do.
• We limit how often logins and bookings come from one address, and how many appointments one e-mail address can make with you a day, against abuse.
• A backup every day, kept for at most 30 days. Technical logs with IP addresses are kept at most 14 days.

If we improve something, we update this list. It never gets less secure.

6. Subprocessors

You give permission for these subprocessors:

• TransIP (the Netherlands): the server, the database and the backups, in a data centre in the Netherlands.
• Resend (United States): sends the e-mails to your customers, from Ireland, and for that receives the name, the e-mail address and the content of each e-mail.

They have the same obligations as we have in this agreement. If we want a new subprocessor, we e-mail you at least 30 days in advance. If you have a good reason to object and we cannot solve it together, you can stop before the new one starts.

If someone in your team connects a calendar from Google, Microsoft or Apple, we put appointments with the data of customers in that calendar. That is a choice of you and your team; that provider then works under the agreements you have with that provider yourselves.

7. Outside the EU

The database with all the data of your customers is in the Netherlands. Data only leaves the EU through Resend: logs and data about the sending of e-mails are kept in the United States. That is allowed, because Resend takes part in the EU-U.S. Data Privacy Framework.

8. Data breaches

If we discover a data breach involving the data of your customers, we report it without undue delay, and within 48 hours, to the e-mail address of the owner of your business. We tell you what happened, which data and roughly how many customers are involved, what the consequences may be and what we are doing about it.

You decide whether to report it to the Autoriteit Persoonsgegevens (within 72 hours) and to your customers. We help you with everything we know.

9. Rights of your customers

If a customer asks to see, correct or delete data, you decide what happens. You see a lot in your dashboard. If something is not possible there, e-mail info@dutchcalendar.com; we help you within a week.

If such a request reaches us, we pass it on to you and do not answer it ourselves.

We also help you if you need to carry out a data protection impact assessment (DPIA), or if the Autoriteit Persoonsgegevens has questions.

10. Audit

We give you all the information you need to show that the GDPR is complied with. If you want an independent expert to check it, that is possible, at your expense, at a moment we agree on together and at most once a year, except after a data breach.

11. When it ends

If you delete your business, we immediately delete the data of your customers from the database. It disappears from the backups within 30 days. If you want the appointments in a file first, e-mail us before you delete your business and we will send them to you.

If the law requires us to keep something longer, we keep it for that purpose only.

12. Other

For liability, what is in our terms applies (article 8). If this agreement conflicts with the terms, this agreement prevails where the data of your customers is concerned. This agreement is governed by Dutch law.