Data Processing Agreement

Effective Date: 25-08-2026

Parties

Controller: The Tenant (the business or individual using the Platform to manage bookings) Processor: GCII, Tax ID (CUI): 49067593, European Union (referred to as "Processor" or "Clickobook")

1. Purpose and Scope

Subject matter: Processor hosts and processes Controller's customer data to provide the booking SaaS. Duration: For the term of the Services Agreement. Categories of data: names, contact details, booking history, notes, and related metadata, together with any special categories of personal data (including health or medical data) that Controller elects to process through the Service (e.g. health, fitness or treatment information entered into booking forms). Data subjects: Controller's customers, employees, and end users.

2. Roles and Instructions

Processor shall process Personal Data only on documented instructions from Controller, unless required by law. If Processor believes an instruction infringes data protection law, it will notify Controller.

3. Processor Obligations (Article 28 GDPR)

Confidentiality: Personnel with access to Personal Data are bound by confidentiality obligations.

Security measures: Processor implements technical and organizational measures appropriate to risk, including encryption in transit and at rest, access controls, logging, vulnerability management, backups, and incident response, in line with Article 32 GDPR. Processor maintains appropriate protection for special categories of personal data processed through the Service.

Subprocessors: Controller authorizes the Subprocessors listed in Annex A. Processor may update the list of Subprocessors by updating Annex A. Processor will notify Controller of any new or replacement Subprocessor. If Controller objects to a new Subprocessor within 14 days of notification, Controller may terminate the affected Service in accordance with the Services Agreement; continued use of the Service after the updated list is posted constitutes acceptance of the updated list.

Breach notification: Processor will notify Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach, and will provide reasonable cooperation for Controller's regulatory obligations.

4. Audit and Records

Processor will maintain appropriate records of processing activities. Processor will make available to Controller, on reasonable notice and no more than once per calendar year unless required by a supervisory authority, such information as is reasonably necessary to demonstrate compliance with its obligations under Article 28 GDPR, subject to confidentiality and without compromising the security of Processor or its other customers.

5. Data Subject Rights Assistance

Processor will assist Controller, to the extent reasonably possible, with requests to access, rectify, erase, restrict, port, or object. Processor will not respond directly to Data Subjects except as authorized by Controller.

6. International Transfers

For transfers outside the EU/EEA, Processor will use GDPR-compliant mechanisms (SCCs or adequacy decisions) and will inform Controller of transfer locations when applicable.

7. Return and Deletion

Upon termination or Controller's request, Processor will make available standard data export tools and will securely delete Personal Data within a reasonable period, except where retention is required by law. Additional custom exports may be subject to fees.

8. Liability and Indemnity

Cap: Processor's aggregate liability for breaches of this DPA is limited to the total fees paid by Controller to Processor in the 12 months preceding the claim.

Exclusions: Neither party is liable for indirect, consequential, special, or punitive damages, including lost profits.

Indemnity:

• Controller indemnifies Processor for claims arising from Controller's instructions, content, or failure to obtain lawful consents.

• Processor indemnifies Controller only for Processor's gross negligence or willful misconduct.

9. Subprocessor List (Annex A)

• AWS (United States / Germany) — hosting & storage

• OVH (Europe) — hosting & storage

• Cloudflare (global) — CDN & security

• SendGrid (United States) — email delivery

• Twilio (United States) — SMS

• Google (United States / EU) — analytics & cloud

• Stripe (global) — payments

• PayPal (global) — payments

Please contact us if you need the current location and contact details for any Subprocessor.

10. Special Categories of Data (Article 9 GDPR)

Where Controller processes special categories of personal data (including health or medical data) through the Service, Controller confirms it has a valid legal basis and, where required, explicit consent from the relevant data subjects before such data is processed. Processor processes such data only at Controller's documented instruction and as necessary to provide the Service. Processor is not responsible for obtaining consent from data subjects for the processing of such data.

11. Miscellaneous

This DPA is governed by the Services Agreement. In case of conflict, this DPA prevails for data protection matters. Amendments may be made by updating this page; continued use of the Service constitutes acceptance.