Tarrez Data Processing Agreement

1. Definitions

For purposes of this DPA:

• "Customer" means the business using Tarrez's services and acting as the controller of personal data processed through its booking system.
• "Personal Data" means personal data processed by Tarrez on behalf of the Customer in connection with the Tarrez services.
• "Processing" has the meaning given to it under applicable data-protection law and includes collecting, storing, accessing, organizing, retrieving, using, deleting, or otherwise handling Personal Data.
• "Data Subject" means an identifiable individual to whom Personal Data relates.
• "Controller" means the entity that determines the purposes and means of processing Personal Data.
• "Processor" means the entity that processes Personal Data on behalf of the Controller.
• "Subprocessor" means a third party engaged by Tarrez to process Personal Data on behalf of the Customer.
• "Applicable Data Protection Law" means the GDPR and other applicable laws relating to the protection of personal data that apply to the processing covered by this DPA.

2. Roles of the Parties

For Personal Data processed through the Customer's booking system:

• the Customer generally acts as the Controller; and
• Tarrez generally acts as the Processor.

The Customer determines the purposes and means of processing its customers' Personal Data.

Tarrez processes Personal Data on behalf of the Customer to provide the Tarrez services.

Nothing in this DPA transfers responsibility for determining the lawful purposes of processing from the Customer to Tarrez.

3. Subject Matter of Processing

The subject matter of processing is the provision of Tarrez's appointment-booking and business-management services.

Processing may include:

• receiving booking information;
• storing booking information;
• displaying booking information to the Customer;
• managing appointments;
• managing services and availability;
• providing customer-management functionality;
• providing worker-management functionality;
• generating applicable business analytics;
• maintaining the Tarrez platform; and
• deleting booking information in accordance with the Tarrez service's retention processes.

4. Duration of Processing

Tarrez will process Personal Data for the duration of the Customer's use of the relevant Tarrez services.

Processing will continue for as long as necessary to provide the services or comply with the Customer's documented instructions.

Following termination of the Customer's service, Tarrez will delete Personal Data in accordance with Section 15 of this DPA, except where retention is required by applicable law or the information has been irreversibly anonymised or aggregated.

5. Nature and Purpose of Processing

Tarrez processes Personal Data for the following purposes:

• enabling customers to book appointments;
• allowing the Customer to manage appointments;
• providing booking calendars;
• managing customer records;
• managing services and availability;
• providing applicable analytics;
• maintaining and securing the Tarrez platform;
• troubleshooting technical issues;
• providing customer support;
• preventing unauthorized access and abuse; and
• performing other processing necessary to provide the contracted Tarrez services.

Tarrez will not use the Customer's Personal Data for its own advertising or behavioral marketing.

Tarrez will not sell the Customer's Personal Data.

6. Categories of Personal Data

Depending on how the Customer configures and uses Tarrez, Personal Data processed through the service may include:

• full name;
• telephone number;
• email address;
• appointment information;
• selected service;
• appointment date;
• appointment time;
• booking status; and
• other information that the Customer chooses to collect through the Tarrez booking system.

The Customer is responsible for ensuring that it does not collect unnecessary or excessive Personal Data through the Tarrez service.

7. Categories of Data Subjects

Personal Data processed through Tarrez may relate to:

• customers of the Customer;
• prospective customers who submit booking information;
• individuals making appointments on behalf of themselves or another person; and
• other individuals whose information the Customer lawfully enters into the Tarrez system.

8. Customer's Responsibilities

The Customer is responsible for:

• determining the lawful purposes and means of processing;
• identifying an appropriate legal basis for processing Personal Data;
• providing appropriate privacy information to Data Subjects;
• complying with applicable data-protection law;
• ensuring that the Personal Data provided to Tarrez is collected lawfully;
• ensuring that Personal Data is accurate and appropriate for the intended purpose;
• responding to Data Subject requests where appropriate;
• ensuring that its use of Tarrez does not violate applicable law; and
• providing Tarrez with lawful and documented instructions concerning the processing of Personal Data.

The Customer must not instruct Tarrez to process Personal Data in a manner that would violate Applicable Data Protection Law.

9. Tarrez's Processing Instructions

Tarrez will process Personal Data only:

1. on the Customer's documented instructions;
2. as necessary to provide the Tarrez services described in the agreement;
3. as necessary to maintain the security and functionality of the Tarrez platform; or
4. where required by applicable law.

Where Tarrez is required by law to process Personal Data in a manner that is inconsistent with the Customer's instructions, Tarrez will, where legally permitted, inform the Customer of that requirement before carrying out the processing.

Tarrez will not process Personal Data for unrelated purposes of its own.

10. Confidentiality

Tarrez will ensure that persons authorized to process the Customer's Personal Data are subject to appropriate confidentiality obligations.

Access to Personal Data will be limited to persons who need access for the purposes of providing or maintaining the Tarrez services.

11. Security of Processing

Tarrez will implement reasonable technical and organizational measures designed to protect Personal Data against:

• unauthorized or unlawful processing;
• accidental loss;
• destruction;
• alteration;
• unauthorized disclosure; and
• unauthorized access.

These measures may include:

• access controls;
• authentication mechanisms;
• restricted administrative access;
• secure cloud infrastructure;
• appropriate security configurations;
• measures to maintain confidentiality and integrity; and
• procedures for handling security incidents.

Tarrez will periodically assess and improve its security measures as reasonably appropriate for the nature of the services.

The Customer acknowledges that no online system can be guaranteed to be completely secure.

12. Personal Data Breaches

If Tarrez becomes aware of a Personal Data breach affecting Personal Data processed on behalf of the Customer, Tarrez will notify the Customer without undue delay after becoming aware of the breach, where required by Applicable Data Protection Law.

Where reasonably available, the notification will include information concerning:

• the nature of the breach;
• the categories of Personal Data affected;
• the likely consequences of the breach;
• measures taken or proposed to address the breach; and
• other information reasonably necessary for the Customer to meet its legal obligations.

Tarrez will reasonably cooperate with the Customer in investigating and addressing the breach.

The Customer remains responsible for determining whether the breach must be reported to a supervisory authority or Data Subjects.

13. Subprocessors

The Customer generally authorizes Tarrez to use subprocessors where necessary to provide the Tarrez services.

Tarrez currently uses Lovable Cloud as part of the infrastructure used to operate the Tarrez platform and store Personal Data.

Lovable Cloud may therefore process Personal Data on behalf of Tarrez in connection with providing the underlying infrastructure.

Tarrez will require subprocessors that process Personal Data on its behalf to comply with data-protection obligations appropriate to the services they provide.

Tarrez remains responsible to the Customer for the performance of its subprocessors' data-protection obligations to the extent required by Applicable Data Protection Law.

Tarrez may update or replace subprocessors where reasonably necessary to operate or improve the services.

Where required by Applicable Data Protection Law, Tarrez will provide the Customer with information about relevant subprocessors and an opportunity to object to material changes.

14. Assistance With Data Subject Rights

Taking into account the nature of the processing, Tarrez will reasonably assist the Customer in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

Such rights may include:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability; and
• objection.

Where Tarrez receives a Data Subject request relating to Personal Data processed on behalf of the Customer, Tarrez may direct the individual to the Customer where appropriate.

Tarrez will not independently respond to or fulfill a Data Subject request on behalf of the Customer unless:

• the Customer instructs Tarrez to do so; or
• Applicable Data Protection Law requires Tarrez to respond directly.

The Customer acknowledges that Tarrez's booking-data retention system automatically deletes identifiable booking information after the applicable booking period. This may limit the availability of information for requests concerning records that have already been deleted.

15. Deletion of Personal Data

At the end of the Customer's use of the Tarrez services, Tarrez will delete Personal Data processed on behalf of the Customer unless:

• the Customer instructs Tarrez to retain it;
• retention is required by applicable law; or
• the information has been irreversibly anonymised or aggregated and is no longer Personal Data.

The Customer acknowledges that Tarrez is designed to automatically delete identifiable booking information after the relevant booking period.

Tarrez does not provide a standard ongoing data-export service after cancellation.

The Customer is responsible for obtaining any information it requires before the end of its subscription where such information is available through the Tarrez service.

Technical backups or infrastructure copies may be retained for limited periods according to the retention and backup practices of the relevant infrastructure provider. Such copies may not be deleted immediately when information is deleted from the active Tarrez application.

16. Assistance With Compliance

Taking into account the nature of the processing and information available to Tarrez, Tarrez will reasonably assist the Customer with its obligations under Applicable Data Protection Law, including where applicable:

• security of processing;
• Personal Data breach notification;
• Data Subject rights;
• data-protection impact assessments; and
• consultations with supervisory authorities.

The Customer remains responsible for its own legal compliance and for determining whether a particular processing activity requires a Data Protection Impact Assessment or consultation with a supervisory authority.

17. International Data Transfers

Where Tarrez or a Subprocessor transfers Personal Data outside the European Economic Area, the relevant transfer will be subject to an appropriate transfer mechanism where required by Applicable Data Protection Law.

Such mechanisms may include:

• an adequacy decision;
• Standard Contractual Clauses;
• another legally recognized transfer mechanism; or
• another safeguard permitted under Applicable Data Protection Law.

Tarrez will take reasonable steps to ensure that relevant international transfers are conducted in accordance with applicable requirements.

18. Audits and Information

Tarrez will make information reasonably necessary to demonstrate compliance with its obligations under Article 28 GDPR available to the Customer, subject to reasonable confidentiality, security, and operational restrictions.

Where required by Applicable Data Protection Law, Tarrez will allow for and contribute to audits or inspections conducted by the Customer or an auditor mandated by the Customer.

Audits must:

• be conducted during reasonable business hours;
• provide reasonable advance notice;
• not unreasonably interfere with Tarrez's operations;
• comply with applicable confidentiality and security requirements; and
• not expose information relating to other Tarrez customers.

The Customer should first use information and documentation reasonably provided by Tarrez to demonstrate compliance before requesting an on-site audit.

19. Government and Legal Requests

If Tarrez receives a legally binding request from a public authority for access to Personal Data processed on behalf of the Customer, Tarrez will, where legally permitted:

• notify the Customer;
• provide reasonable information regarding the request; and
• limit disclosure to the information legally required.

Tarrez will not knowingly disclose Personal Data beyond what is required by the applicable legal request.

20. Customer Instructions and Security

The Customer is responsible for ensuring that its instructions to Tarrez are lawful.

The Customer must not intentionally provide Tarrez with sensitive or special-category Personal Data unless the Tarrez service expressly supports such processing and the Customer has an appropriate legal basis and safeguards for doing so.

The Customer should configure the service to collect only information reasonably necessary for its booking and business operations.

21. Aggregated and Anonymised Information

Tarrez may create aggregated statistics from booking information for the purpose of providing analytics features.

Analytics may include information such as:

• booking counts;
• customer counts;
• service popularity;
• average service duration;
• revenue statistics; and
• other business-performance statistics.

Tarrez's analytics features are designed not to display individual customers' names, phone numbers, or email addresses.

Where information has been genuinely anonymised so that individuals can no longer be identified, Tarrez may retain and use that information independently of this DPA.

Until information has been properly anonymised, it will continue to be treated as Personal Data where required by Applicable Data Protection Law.

22. No Sale or Advertising Use

Tarrez will not sell Personal Data processed under this DPA.

Tarrez will not use identifiable booking Personal Data for:

• advertising;
• behavioral advertising;
• customer profiling for Tarrez's own purposes; or
• marketing unrelated to the Customer's services.

23. Conflict With Other Agreements

This DPA forms part of the agreement between Tarrez and the Customer.

If there is a conflict between this DPA and the Tarrez Terms of Service concerning the processing of Personal Data on behalf of the Customer, this DPA will prevail to the extent of that conflict.

The Tarrez Privacy Policy governs Tarrez's own processing of personal data as a controller and does not replace this DPA.

24. Duration and Termination

This DPA remains effective for as long as Tarrez processes Personal Data on behalf of the Customer.

The DPA automatically ends when Tarrez no longer processes Personal Data on behalf of the Customer, subject to any provisions that by their nature must continue after termination.

25. Changes to This DPA

Tarrez may update this DPA where reasonably necessary to:

• reflect changes to Applicable Data Protection Law;
• reflect changes to the Tarrez services;
• add or replace subprocessors;
• improve security requirements; or
• reflect changes in the way Personal Data is processed.

Where a change materially affects the Customer's data-protection rights or obligations, Tarrez will provide reasonable notice where required by Applicable Data Protection Law.

26. Governing Law

This DPA is governed by the laws of Poland, except to the extent that mandatory provisions of Applicable Data Protection Law require otherwise.

Any dispute arising from or relating to this DPA will be subject to the jurisdiction of the competent courts in Poland, unless applicable mandatory law requires otherwise.

27. Contact

For questions concerning this DPA or the processing of Personal Data by Tarrez, contact:

Annex 1 — Processing Details

A. Subject Matter

Provision of Tarrez's appointment-booking, calendar, customer-management, service-management, worker-management, website, and related business-management services.

B. Duration

For the duration of the Customer's active use of the applicable Tarrez services, followed by deletion in accordance with Section 15 of this DPA.

C. Nature and Purpose

Processing necessary to:

• accept and manage appointments;
• store booking information;
• display bookings to the Customer;
• manage services and availability;
• provide applicable analytics;
• maintain the service;
• provide technical support;
• maintain security; and
• perform other functions necessary to provide the contracted Tarrez services.

D. Categories of Data Subjects

• Customers of the business using Tarrez;
• prospective customers making bookings;
• individuals making appointments; and
• other individuals whose Personal Data the Customer lawfully enters into Tarrez.

E. Categories of Personal Data

• Full name;
• telephone number;
• email address;
• appointment date;
• appointment time;
• selected service;
• booking status; and
• other information that the Customer chooses to collect through the Tarrez booking system.

F. Special Categories of Personal Data

Tarrez is not intended to require the processing of special categories of Personal Data as part of its standard booking functionality.

The Customer must not intentionally use Tarrez to collect special categories of Personal Data unless the relevant Tarrez service expressly supports such processing and the Customer has established an appropriate legal basis and safeguards.

G. Subprocessor

Lovable Cloud

Lovable Cloud is used as part of the infrastructure supporting the Tarrez application and storage of Personal Data.

Additional subprocessors may be used where reasonably necessary to provide the Tarrez services and in accordance with Section 13 of this DPA.