Data Processing Agreement

Last updated: October 16, 2026

This Data Processing Agreement ("DPA") under Article 28 of the General Data Protection Regulation (GDPR) is part of the REZVA Terms of Service and applies when a specialist uses REZVA for their clients' data. The parties are:

1. Subject matter, nature and purpose

REZVA processes personal data of the Specialist's clients only to provide the Platform's features: booking page, calendar, client records, reminders and notifications, messages, reviews, deposits and related features, on the Specialist's instructions. The instructions are these terms and the Specialist's actions in the Platform. REZVA does not use this data for its own purposes, except for security, abuse prevention and the reliability score, for which REZVA is an independent controller (Privacy Policy, sections 3.2 and 3.3).

2. Categories of data subjects and data

Data subjects: the Specialist's clients and prospective clients, and the members of the Specialist's team.

• Names, email address, phone number, date of birth (if entered)
• Booking history, services, prices, preferences and notes
• Health or allergy notes, formulas and client photos (if entered by the Specialist)
• Messages between the Specialist and the client
• Deposits and payment receipts

Health and allergy notes are a special category of data (Art. 9 GDPR). The Specialist is responsible for the legal basis for them (usually the client's explicit consent) and keeps them to what the service needs.

3. REZVA's obligations

REZVA commits to:

• process personal data only on the Specialist's documented instructions, unless the law requires otherwise, and tell the Specialist if it believes an instruction breaks the law;
• ensure that the people with access to the data are bound by confidentiality;
• apply appropriate technical and organisational measures (section 4);
• use sub-processors only under section 5;
• help the Specialist with data subject requests, data protection impact assessments and consultations with the supervisory authority;
• notify the Specialist without undue delay after becoming aware of a personal data breach, so that the Specialist can meet their own 72-hour deadline;
• delete the data after the account ends (section 7);
• give the Specialist the information needed to show compliance with Article 28 GDPR, and allow audits on reasonable written request, at most once a year, protecting the data of REZVA's other customers.

4. Security measures

• Encrypted connections (HTTPS) everywhere and a database encrypted at rest
• Passwords only in hashed form
• Client photos, deposit receipts and documents stored separately and shown only to the Specialist, the client concerned or authorised staff
• Role-based access (owner, manager, staff member in a team) and records of admin actions
• Servers in the EU (Germany) and backups
• A written procedure for security incidents

5. Sub-processors

The Specialist gives REZVA general authorisation to use the sub-processors below. REZVA has a contract with each of them with data protection obligations equivalent to this DPA and remains responsible for them. REZVA tells the Specialist about a new sub-processor by email or in the dashboard at least 14 days in advance. The Specialist may object on reasonable grounds and, if we cannot find a solution, close their account.

Transfers to the USA rely on the EU-US Data Privacy Framework where the sub-processor is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

6. Data subject rights

The Specialist answers their clients' requests (access, rectification, erasure, portability, objection). REZVA provides the tools: viewing and editing client records, deleting notes, formulas and photos, and exporting the data (Settings). To erase a client completely, the Specialist can write to us and we will do it on their instruction. If a client contacts REZVA directly about data the Specialist keeps, REZVA passes the request to the Specialist or helps as the Specialist instructs. For assistance: [email protected].

7. Duration and termination

This DPA applies for as long as the Specialist has a REZVA account. Before closing it, the Specialist can download their data (Settings). After a deletion request the account is deactivated at once, and the clients' data is deleted or anonymised within 30 days (with a paid subscription: within 30 days of the end of the paid period), unless the law requires longer retention. Copies in backups are removed as the backups are replaced.

8. Governing law

This DPA is governed by Bulgarian law and the GDPR. If it conflicts with the Terms of Service on a data protection matter, this DPA prevails.

9. Contact