Data Processing Agreement

1.1 Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them in Regulation (EU) 2016/679 (the "GDPR"). "Data Protection Law" means the GDPR, Romanian Law no. 190/2018, Law no. 506/2004 on privacy in electronic communications, and any other law on personal data that applies to the processing.

1.2 "Provider Data" means the personal data TimeNow processes on the Provider's behalf in providing the Platform, as described in Annex I.

1.3 "Clients" are the people who book, buy from or interact with the Provider through the Platform — on the Provider's booking page, booking widget, WhatsApp number or in the TimeNow mobile app. "Team members" are the Provider's owners, employees and collaborators whose data is kept in the Provider's account, for example as dashboard users, employees with schedules, or instructors.

1.4 "Sub-processor" means another processor TimeNow engages to process Provider Data. A "Provider-selected service" is a third-party service the Provider itself chooses and connects to the Platform under its own contract with that third party.

1.5 "Platform" means the TimeNow web application, booking pages, booking widget, mobile app, WhatsApp features, APIs and integrations, as described in the Terms.

2.1 For Provider Data, the Provider is the controller and TimeNow is the processor. The Provider decides why its clients' and team's data is processed; TimeNow processes it only to run the Platform for the Provider.

2.2 TimeNow is an independent controller — outside this DPA, under its Privacy Policy — only for:

• (a) the accounts, billing details and invoices of the Provider and its Team members in their own relationship with TimeNow;
• (b) a person's own TimeNow account (the TimeNow mobile app or client portal), including showing that person their bookings with the businesses they use, and connections they authorise themselves, such as linking an AI assistant;
• (c) keeping the Platform secure and preventing fraud and abuse, including technical logs;
• (d) statistics about how the Platform itself is used, based on pseudonymised or aggregated data;
• (e) TimeNow's own marketing — about TimeNow and about offers from businesses on the Platform — sent only to people who have separately agreed to receive it from TimeNow.

2.3 If TimeNow asks Clients on a Provider's booking page whether they want to hear from TimeNow, it does so in a separate, optional request that names TimeNow, never as a condition of booking. Only the data of people who agree is used under clause 2.2(e).

2.4 TimeNow will not sell Provider Data; use the Provider's client list to send those Clients marketing for TimeNow or for other businesses — people who opted in under clause 2.2(e) may receive it, because they asked TimeNow, not because they are the Provider's clients; use Provider Data to train artificial-intelligence models; or combine one Provider's data with another's, except within a person's own TimeNow account under clause 2.2(b).

3.1 TimeNow processes Provider Data only on the Provider's documented instructions. The Terms, this DPA and the Provider's own use of the Platform — the settings it chooses, the features and integrations it turns on, the messages, automations and campaigns it sets up, and the data it enters, imports or deletes — are those instructions.

3.2 TimeNow may process Provider Data beyond those instructions only where EU or Romanian law requires it. In that case TimeNow will tell the Provider before the processing, unless that law forbids it on important grounds of public interest.

3.3 TimeNow will tell the Provider promptly if, in its opinion, an instruction infringes Data Protection Law, and may suspend that instruction until the Provider confirms or changes it.

3.4 Instructions beyond what the Platform offers — for example a custom export or bespoke processing — need TimeNow's agreement and may be charged at a reasonable cost.

4.1 The Provider is responsible for having a lawful basis for the processing it instructs and for informing its Clients and Team members. TimeNow gives each Provider a public privacy notice page on its booking site and a template to start from; what that notice says is the Provider's responsibility.

4.2 Marketing. Promotional messages to Clients by email, SMS or WhatsApp generally require the Client's prior consent under Law no. 506/2004 and the GDPR. The Provider will send campaigns and promotional automations only to Clients whose consent it holds, and will respect every opt-out. Booking confirmations, reminders and other messages needed to deliver a booking are not marketing. When a Client books, the Platform offers them an optional, unticked box to receive the Provider's marketing and records each consent with when, where and in which wording it was given. Every marketing email sent through the Platform carries an unsubscribe link, and Clients can also opt out from their TimeNow account or app; the Platform applies these opt-outs to every record of the Client at the Provider, and they are not requests under clause 9.2. An opt-out the Client made themselves can only be reversed by the Client. The Provider may record in the Platform a consent the Client gave it in another way, with a note of how it was given, and is responsible for being able to prove it; it may also record an opt-out the Client asks it for.

4.3 Special categories of data. The Platform is a scheduling and client-management tool, not a medical records system. Notes, booking comments and other free-text fields should hold only what the Provider needs to deliver its service. If the Provider records health data or other special categories — for example a clinic, a physiotherapist, or a trainer noting an injury — the Provider is responsible for having a condition under Article 9 GDPR and for keeping that data to the minimum necessary. TimeNow protects it with the measures in Annex II.

4.4 Children. Where the Provider serves children, for example with kids' classes, bookings should be made by a parent or legal guardian, and the Provider is responsible for collecting only the data it needs about the child.

4.5 Access. The Provider decides which Team members can use the Platform and with which role, keeps its credentials safe, removes access promptly when someone leaves, and is responsible for what its users do in its account.

4.6 Imports. If the Provider imports clients from another system, it is responsible for the lawfulness of that data, including any marketing consent recorded with it.

5.1 TimeNow gives access to Provider Data only to personnel who need it to operate, support, secure or maintain the Platform, and only to the extent they need it. All of them are bound by a written confidentiality obligation or a statutory duty of confidentiality.

5.2 TimeNow personnel access a Provider's account or data only to provide the service, to handle a support request from the Provider, to investigate a security incident or abuse, or where the law requires it.

6.1 TimeNow implements and maintains the technical and organisational measures described in Annex II, appropriate to the risk of the processing (Article 32 GDPR).

6.2 TimeNow may change those measures over time, provided the overall level of protection does not decrease.

7.1 The Provider gives TimeNow general written authorisation to engage Sub-processors. The current list — each Sub-processor's identity, what it does and where it processes data — is Annex III, part A.

7.2 TimeNow will announce any intended addition or replacement of a Sub-processor at least 30 days in advance, by updating Annex III and by email to the Provider's account owner. The Provider can object on reasonable data-protection grounds by writing to TimeNow within that period.

7.3 If the Provider objects, TimeNow will try in good faith to resolve the objection — for example by not using the new Sub-processor for that Provider's data, or by explaining the safeguards in place. If that is not possible, the Provider may end the affected service, or its account, before the change takes effect, without penalty and with a pro-rata refund of fees paid in advance for the period after termination.

7.4 Where a Sub-processor has to be replaced urgently to keep the Platform secure or available, TimeNow may do so immediately and will notify the Provider as soon as possible afterwards; clause 7.3 then applies.

7.5 TimeNow binds each Sub-processor by contract to data-protection obligations no less protective than this DPA, and remains fully liable to the Provider for each Sub-processor's performance (Article 28(4) GDPR). On request, TimeNow will give the Provider the information it needs about any Sub-processor, including, where available, the sub-processors that Sub-processor relies on.

8.1 Some Platform features exchange data with services the Provider chooses and contracts with directly, listed in Annex III, part B — for example online payments through the Provider's own Netopia merchant account, messages through its own WhatsApp Business account, synchronisation with a team member's Google Calendar, or a CRM such as GoHighLevel.

8.2 By turning such a feature on, the Provider instructs TimeNow to send the relevant Provider Data to that service and to receive data from it. These services are not TimeNow's Sub-processors: they process the data under the Provider's own agreement with them, and TimeNow is not responsible for their processing. The Provider can turn the feature off at any time, which stops further transfers.

9.1 Requests from data subjects. The Platform lets the Provider view and correct its Clients' data and remove Clients from its client list. Where those tools are not enough — for example to permanently erase a client record or to produce a complete export — TimeNow will do it on the Provider's written request within 30 days.

9.2 If a Client or Team member contacts TimeNow directly about Provider Data, TimeNow will forward the request to the Provider without undue delay and within 5 business days at the latest, and will not answer it on the merits unless the Provider asks it to. TimeNow may tell the person that their request has been forwarded.

9.3 TimeNow will give the Provider reasonable assistance — taking into account the nature of the processing and the information available to TimeNow — with data protection impact assessments, prior consultation of the supervisory authority, and the security of processing (Articles 32 to 36 GDPR).

9.4 If a public authority asks TimeNow for Provider Data, TimeNow will redirect it to the Provider where it can, disclose only what the law requires, and inform the Provider unless the law forbids it.

9.5 Deleting a TimeNow account. When a Client deletes their own TimeNow account, the Platform removes their name, email address and phone number from the client records linked to that account at every business they used; their bookings and sales records remain, without those details, and their consent to the Provider's marketing is recorded as withdrawn. So that this withdrawal survives if the Client books again, the Platform keeps a one-way coded form of their email address and phone number, which neither TimeNow nor the Provider can turn back into those details. The Provider instructs TimeNow to do this by accepting this DPA. Clause 9.2 does not apply to these deletions.

10.1 TimeNow keeps Provider Data primarily in the European Union: the application and its database run in Hetzner data centres in Finland, and backups and uploaded files are stored in Cloudflare R2 within its EU jurisdiction.

10.2 Some Sub-processors process Provider Data outside the European Economic Area, as shown in Annex III. TimeNow makes such transfers only on the basis of an adequacy decision under Article 45 GDPR — including the EU-US Data Privacy Framework for certified US recipients — or of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, with any supplementary measures needed.

10.3 If an adequacy decision TimeNow relies on is invalidated, TimeNow will move the affected transfers to another valid mechanism, or stop them, and will inform the Provider.

11.1 TimeNow will notify the Provider without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Provider Data. The notice is sent to the email address of the Provider's account owner.

11.2 The notice will describe, as far as is then known: what happened; the categories and approximate number of people and records concerned; the likely consequences; the measures taken or proposed; and a contact person. Where not everything is known yet, TimeNow will send the information in stages as it becomes available.

11.3 TimeNow will take reasonable steps to contain the breach and limit its effects, and will help the Provider meet its own obligations to notify ANSPDCP within 72 hours and, where required, the people affected. Whether and how to notify them is the Provider's decision, unless the parties agree otherwise.

11.4 Notifying a breach is not an admission of fault or liability by TimeNow.

12.1 While its account is active, the Provider can delete Provider Data using the Platform.

12.2 When the Provider's account is closed, the Provider can ask TimeNow, within 30 days, for an export of its client, booking and sales data in a structured, commonly used, machine-readable format such as CSV.

12.3 TimeNow will delete Provider Data within 90 days after the account is closed, unless EU or Romanian law requires TimeNow to keep part of it. In that case TimeNow keeps only that part, only for as long as required, and continues to protect it under this DPA.

12.4 Deleted data may remain in database backups and operational logs for up to 30 days, until they are overwritten. TimeNow does not restore it to active use.

13.1 TimeNow makes available the information needed to demonstrate compliance with Article 28 GDPR: this DPA, its annexes, and written answers to a reasonable security questionnaire once a year, or more often after a personal data breach.

13.2 If that information is not enough, or a supervisory authority requires it, the Provider — or an independent auditor bound by confidentiality who is not a competitor of TimeNow — may audit TimeNow's compliance, including by inspection. The Provider gives at least 30 days' written notice; audits take place during business hours, no more than once every 12 months unless after a personal data breach or at an authority's request, and must not compromise the security of the Platform or the confidentiality of other Providers' data. Each party bears its own costs.

14.1 Each party is liable for damage caused by its own breach of this DPA or of Data Protection Law, in accordance with Article 82 GDPR.

14.2 Between the parties, the limitation of liability in the Terms also applies to this DPA, except where the law does not allow liability to be limited.

15.1 This DPA applies for as long as TimeNow processes Provider Data, including after the Terms end, until the data is returned or deleted under clause 12.

15.2 TimeNow may update this DPA to reflect changes in the law, guidance from supervisory authorities, or changes to the Platform. It will publish each new version on this page with its date and, for changes that materially affect Providers, will email the account owner at least 30 days before they take effect, unless the law requires a change sooner. Changes to Annex III follow clause 7.

15.3 This DPA is governed by Romanian law. Disputes are settled by the competent courts in Romania.

15.4 If any provision of this DPA is found invalid, the rest of it remains in force.

15.5 Questions about this DPA, objections under clause 7 and requests under clauses 9 and 12 go to contact@timenow.ro.