Data Processing Agreement (DPA)

1. Roles of the parties

For the personal data the client collects or publishes through the website, the shop, JoaoDG Calendar, JoaoDG Cards or JoaoDG Builder (e.g. data of their own customers or end users), the client is the controller and JoaoDG is the processor, under Article 28 GDPR, processing that data only on behalf of the client and following the client's instructions.

On JoaoDG Calendar, the business receiving the bookings is the controller of the data of the people who book (name, contact details, service, date and booking notes), and JoaoDG processes it on the business's behalf to manage the bookings and send confirmations and reminders.

2. Subject matter and duration

Processing takes place while the services are provided (development, hosting, maintenance or product subscription) and ends when they end, as set out in point 8.

3. Nature of the data and purpose

JoaoDG may process, on the client's behalf, data such as name, contact details, account data, booking data and content submitted or published on the website, the shop, the card or the booking calendar, for the sole purpose of hosting and running the contracted solution (including backups and troubleshooting). On JoaoDG Builder, the site's content and the change request are processed to carry out the change the client asked for.

4. Instructions and confidentiality

JoaoDG processes the data only on the client's documented instructions, does not use it for its own purposes and ensures that anyone with access to it is bound by confidentiality.

5. Security

Appropriate technical and organisational measures are applied: authenticated access with permission profiles, encrypted connections (HTTPS/TLS), passwords stored with hashing algorithms, two-step authentication available, and regular backups of the database.

6. Sub-processors

The client authorises the use of the following sub-processors, bound by guarantees equivalent to those in this agreement:

• Hetzner Online GmbH (Germany, EU) - hosting of servers/applications.
• Hostinger - website and email hosting.
• Stripe Payments Europe, Ltd. - payment processing.
• Resend - sending of transactional emails.
• Anthropic, PBC (USA) - the artificial intelligence model behind JoaoDG Builder, which receives the site's content and the change request. Transfer under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
• Google (Google Ireland Limited and Google LLC, USA) - syncing JoaoDG Calendar with Google Calendar, only when the business connects it. Transfer under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

The list may be updated; relevant changes are communicated to the client, who may object on legitimate grounds.

7. Assistance and data breaches

JoaoDG assists the client in meeting their obligations (data subject requests, impact assessments) and notifies the client without undue delay after becoming aware of any personal data breach.

8. Return and deletion

When the services end, and on request, JoaoDG returns and/or deletes the personal data processed on the client's behalf, unless the law requires it to be kept.

9. Contact

For any question about this agreement or about data processing, contact [email protected].