Data processing agreement
Version 2026-10-13 · Aethrovia Appointments
1. Parties and roles
The business identified in its acceptance is the controller. Aethrovia, Arch. Makariou III 24, 4000 Mesa Geitonia, Limassol, Cyprus, support@aethrovia.com, is its processor. This DPA forms part of the Terms and governs processing of customer data on the business's documented instructions. Aethrovia separately controls owner account, billing, supplier and support records under its privacy notice.
2. Scope and duration
Processing comprises recording, storing, retrieving, correcting, exporting, restricting and deleting customer contacts and appointments, and sending appointment-specific texts. Subjects are the business's customers. Data comprises first/last name, international phone number, appointment date/time/duration/status/language, scheduling notes, privacy choices, SMS sender/text/status/provider reference and closure notices/recipients. Clinical appointments, health records and other special-category data are excluded. Processing continues while service/customer data is held, including agreed retrieval and backup expiry periods.
3. Instructions and confidentiality
Using the service, privacy controls, retention settings and authorised support requests supplies documented instructions. We process only to fulfil them, including for transfers, unless law requires otherwise; we inform you of such a legal requirement unless prohibited. We promptly tell you if an instruction appears to infringe applicable data-protection law. Authorised personnel are bound by confidentiality. Operations screens expose account information and aggregate counts, not customer records. Exceptional customer-data access is limited to an authorised support request, a security incident or a legal requirement, and is documented with purpose, scope and time.
4. Security measures
Measures include HTTPS for website/provider connections; tenant-scoped queries; validated owner access; hashed passwords and login throttling; authenticator protection for privileged accounts and optional owner two-step sign in; restricted service users and read-only releases; private logs; encrypted off-server backups and separate encrypted recovery suppression records; transaction-backed message/credit claims and signed billing webhooks. Ordinary SMS is not end-to-end encrypted. We maintain and test measures proportionate to risk, review changes and assist with relevant information. This DPA does not promise a certified infrastructure, full-disk encryption, guaranteed message delivery or an availability/recovery SLA.
5. Subprocessors and transfers
You give general authorisation for Hetzner Online GmbH, Germany, for hosting/database/encrypted backup services, and BulkGate (TOPefekt s.r.o.), Czech Republic, for SMS numbers, sender, text and sending records, including destination mobile networks. We bind subprocessors to equivalent protection obligations and remain responsible for their performance of these duties. Resend handles owner account emails and Stripe handles billing under separate supplier arrangements; customer appointment records are not intentionally sent to them for those purposes.
Before adding or replacing a customer-data subprocessor we give 30 days' notice identifying its role and relevant transfer safeguards. You may object on reasonable data-protection grounds. We seek a resolution; if none is possible you may terminate the affected service and receive prepaid unused service fees. International transfers require a valid applicable GDPR mechanism, such as an adequacy decision or appropriate standard contractual clauses with necessary assessment/safeguards. An EU supplier's address does not itself establish every onward transfer's location. Cloudflare edge processing is not authorised by these named subprocessors; enabling an edge proxy requires a prior supplier/transfer assessment and agreement update.
6. Assistance and incidents
We assist with access, correction, erasure, restriction, objection and applicable portability requests, taking account of the nature of processing. Owner controls work for privacy requests even after normal booking access ends. We direct customer requests to the controller and do not independently choose its lawful basis. We assist with security, impact assessments and prior consultation using information available to us.
We notify you without undue delay after becoming aware of a breach affecting your customer data, without waiting for a complete investigation. Initial information describes known circumstances, affected data, likely consequences, mitigation and contact; further details follow as available. We preserve incident evidence and cooperate with your applicable reporting duties. You remain responsible for your controller notifications.
7. Retention and return/deletion
Your chosen appointment/contact retention is one, two, three or five years, initially two, with a 30-day implementation grace period after acceptance/change. Future appointments are retained. SMS and closure records normally expire after 180 days; restricted processing is reviewed before deletion. You can request earlier erasure, export or restriction. After paid service ends there is ordinarily a 30-day retrieval period, subject to a documented switching extension. At your choice we return data through export and/or delete it, unless law requires retention; legal/accounting evidence is held separately. Successful backup pruning normally expires copies within a further 30 days. Recovery reapplies erasure/restriction records before access or sends resume. Supplier copies need supplier-directed handling and we assist with it.
8. Accountability and audits
We supply information necessary to demonstrate compliance, allow and contribute to reasonable audits and inspections by you or an authorised auditor, and cooperate with authorities. Agree practical arrangements, confidentiality and reasonable notice where circumstances allow; these arrangements cannot prevent an audit required by law or an incident. You supply lawful instructions, appropriate notices and justified retention choices. This DPA lasts while we process your customer data, prevails over inconsistent personal-data clauses in the Terms and is governed by Cyprus law subject to mandatory data-protection law.