PlanSlot Data Processing Addendum (DPA)

1. Roles

The Supplier is the Controller and PlanSlot is the Processor for the personal data described in the applicable service/order documentation, except where PlanSlot independently determines the purposes and means of processing, in which case PlanSlot acts as controller for that activity.

2. Subject matter and duration

Processing relates to provision of booking, scheduling, notification, waiting-list, reporting and related platform services for the duration of the Supplier agreement and any agreed post-termination period.

3. Nature and purpose

Collection, hosting, organisation, retrieval, consultation, transmission, notification, reporting, support, backup and deletion of booking and account information as instructed by the Supplier.

4. Categories of data subjects

• Supplier owners and representatives
• Supplier staff
• Customers/clients
• Individuals appearing in booking or waiting-list records

5. Categories of personal data

• Name and contact details
• Booking and appointment information
• Staff schedules and business information
• Account/authentication data
• Technical/log information
• Other data expressly instructed by Supplier and necessary for the service

6. Special categories

If Supplier instructs PlanSlot to process health data or another special category, the Supplier confirms that it has identified the lawful Article 9 condition and that the processing is necessary for the agreed service. PlanSlot will apply appropriate safeguards and will not use such data for its own independent purposes. Where the Supplier is a clinic or healthcare provider, which may be the case from PlanSlot's initial launch, the Supplier confirms it has completed any Data Protection Impact Assessment required for its own processing, and PlanSlot will only process such data on the Supplier's documented instructions.

7. Processor obligations

• Process personal data only on documented instructions.
• Ensure authorised persons are subject to confidentiality obligations.
• Implement appropriate technical and organisational security measures.
• Assist the Supplier with data-subject requests, DPIAs, security and breach obligations as reasonably required.
• Maintain appropriate records of processing where required.
• Notify the Supplier without undue delay after becoming aware of a personal data breach affecting Supplier data.
• Use subprocessors only under appropriate contractual controls and with the required authorisation/notification mechanism.
• Return or delete personal data at the end of the service, subject to applicable legal retention.

8. Subprocessors

PlanSlot will maintain a list of relevant subprocessors at the Subprocessor List. The list should identify the service, entity, processing location and transfer mechanism where relevant. Supplier objections and change-notification procedures should be addressed in the final DPA.

9. International transfers

Transfers outside the EEA will be subject to an applicable GDPR transfer mechanism and appropriate supplementary safeguards where required.

10. Audit

PlanSlot will provide reasonable information necessary to demonstrate compliance and will permit reasonable audits/inspections subject to confidentiality, security and proportionality safeguards.

11. Security measures

A separate technical and organisational measures schedule should be attached to enterprise agreements and updated as the Platform evolves.

12. Deletion and return

At the Supplier's choice and subject to technical feasibility and legal obligations, PlanSlot will delete or return personal data after termination. Backup copies may remain for a limited period where necessary for secure backup cycles, after which they will be securely overwritten.