1. Parties and purpose
This agreement is entered into between the business using the Service (the “Controller”) and the publisher of Sutempo (Lorenzo Mira Mateo, in a personal capacity, company being incorporated) (the “Processor”, “Sutempo”). It sets out the parties’ obligations under Article 28 of Regulation (EU) 2016/679 (GDPR) for personal data processing carried out by Sutempo on behalf of the Controller.
It supplements the terms and conditions and takes precedence over them in all matters concerning data protection. It applies as soon as the business is opened, without further formalities.
2. Description of processing
| Item | Description |
|---|---|
| Nature and purpose | Hosting, storing, displaying and processing data needed for appointment booking, calendar management, appointment-related emails, payments into the Controller’s Stripe account, the customer portal and features enabled by the Controller (group classes, packs, review requests, calendar synchronisation). |
| Duration | For the term of the agreement, followed by deletion in accordance with section 10. |
| Data subjects | The Controller’s customers and prospects; members of its team. |
| Categories of data | Identity and contact details (name, email, phone), language, appointments and history, notes entered by the Controller or customer, payment amounts and references (without card data), consents and preferences, access tokens and email logs. The Service does not require special-category data; the Controller refrains from entering such data in free-text fields or ensures an appropriate lawful basis. |
3. Controller’s instructions
Sutempo processes data only on the Controller’s documented instructions. These instructions consist of this agreement, the terms and conditions and use of the Service’s features (settings, actions in the administration area, API). Sutempo informs the Controller if it believes an instruction breaches the GDPR.
Sutempo does not use data subjects’ data for its own purposes, other than aggregated, anonymised statistics for operating the Service, and does not transfer it to any third party.
4. Confidentiality
Persons authorised to process data under Sutempo’s authority are bound by a contractual duty of confidentiality and access data only as necessary to operate, support or secure the Service.
5. Security (Article 32)
Sutempo implements and maintains the following measures:
- encryption of data in transit (TLS) and at rest (database and backups);
- application-level encryption of secrets and access keys stored in the database; hashed one-time sign-in codes; time-limited HttpOnly, SameSite sessions;
- data isolation by business verified on every request, narrowly scoped access keys and least-privilege access for teams;
- strict content security policy on all surfaces, protection against cross-site requests and rate limiting of authentication attempts;
- audit log of configuration changes; technical logging without card data;
- hosting in the European Union (Vercel Frankfurt region, Neon Frankfurt region, eu-central-1), automatic backups and restoration procedures;
- security review of changes and automated tests covering isolation between businesses and data erasure.
These measures evolve with the state of the art; Sutempo does not reduce them below this level without informing the Controller.
6. Subprocessors
The Controller generally authorises the use of the subprocessors listed below, each bound by a contract imposing obligations equivalent to this agreement:
| Subprocessor | Registered office | Role | Location and safeguards |
|---|---|---|---|
| Vercel Inc. | 340 S Lemon Ave #4133, Walnut, CA 91789, United States | Hosting the application and pages, code execution, technical logs | European Union (Frankfurt region) for execution; transfers governed by the Data Privacy Framework and standard contractual clauses |
| Neon Inc. | 2261 Market Street #4459, San Francisco, CA 94114, United States | PostgreSQL database: all application data, encrypted at rest, backups | European Union (Frankfurt region, eu-central-1); standard contractual clauses |
| Stripe Payments Europe, Ltd. | 1 Grand Canal Street Lower, Dublin 2, Ireland | Customers’ online payments into the business’s Stripe account (Stripe Connect), refund management; Sutempo subscription billing | European Union; Stripe also acts as controller for its own obligations (fraud prevention, KYC) |
| Resend Inc. | 2261 Market Street #5039, San Francisco, CA 94114, United States | Sending emails: sign-in codes, confirmations, reminders, thank-you messages, review requests | United States; standard contractual clauses |
| Google LLC / Google Ireland Ltd. | Gordon House, Barrow Street, Dublin 4, Ireland | Sign in with Google (at the user’s choice), Google Calendar synchronisation (enabled by the business), Google Maps map on the business’s public page, Google Fonts on booking surfaces | European Union and United States; Data Privacy Framework |
| Apple Inc. | One Apple Park Way, Cupertino, CA 95014, United States | Sign in with Apple (at the user’s choice) | United States; Data Privacy Framework |
Sutempo informs the Controller by email and by updating this page at least 30 days before adding or replacing a subprocessor. The Controller may object on legitimate grounds; if no agreement is reached, it may terminate without charge and export its data. Sutempo remains responsible to the Controller for the performance of its subprocessors’ obligations.
7. Transfers outside the European Union
Data is hosted in the European Union. Where a subprocessor processes data from a third country (email delivery, Google or Apple sign-in, technical support), the transfer relies on an adequacy decision (EU–US Data Privacy Framework for certified providers) or the European Commission’s standard contractual clauses, together with supplementary measures (encryption, minimisation).
8. Assistance to the Controller
Sutempo helps the Controller respond to data subjects’ requests: administration tools allow customer data to be viewed, corrected, exported (CSV) and erased. Erasing a customer replaces their personal data with anonymous values throughout the database, including delivery history and logs.
Sutempo promptly forwards to the Controller any request it receives directly from a data subject. Taking account of the nature of processing and the information available to it, Sutempo assists the Controller with impact assessments, prior consultation with the supervisory authority and breach notification. Contact: contact@sutempo.com.
9. Data breaches
Sutempo notifies the Controller of any personal data breach affecting it without undue delay after becoming aware of it, and no later than 48 hours, by email to the account address. The notification describes the nature of the breach, the categories and approximate number of affected individuals and records, the likely consequences and the measures taken or proposed. Information may be provided in stages.
10. End of processing
At the end of the agreement, or whenever the Controller decides, the Controller exports its data from the administration area and deletes its business. Deletion is immediate, in a single transaction, across all business data, as detailed in the privacy policy. Copies in backups disappear at the next rotation.
Sutempo retains only what the law requires (accounting records) and an audit log without customer content.
Sutempo may delete a business that has been inactive for an extended period, following the same procedure, after email reminders and notice.
11. Documentation and audit
Sutempo makes available to the Controller the information necessary to demonstrate compliance with this agreement: this page, the privacy policy, the description of security measures and, on written request, further details. No more than once a year and with 30 days’ notice, the Controller may conduct a documentary audit or an on-site audit at its own expense during working hours, respecting other businesses’ confidentiality. Subprocessors’ audit reports and certifications serve as audits for their respective activities.
12. Liability and governing law
Each party is liable for damage caused by processing in breach of the GDPR under Article 82. The limitations of liability in the terms and conditions apply, except where contrary to a mandatory provision. This agreement is governed by French law; any dispute falls within the jurisdiction of the competent courts for the publisher’s registered office.