Data Processing Agreement (DPA)

1. Roles

For end clients’ data entered or collected via the platform (client records, appointments, group first names, addresses for at-home appointments), the professional is the data controller and Daytio (Bâti Breizh, SASU) acts as processor, on the professional’s documented instructions.

2. Purpose and nature of the processing

Hosting, storage, display and management of appointments and client records; sending confirmation, cancellation and rescheduling emails; synchronising appointments to calendars connected by the professional; automatic anonymisation of inactive records; issuing quotes, invoices and credit notes at the professional’s request, sending them to the professional’s clients and keeping evidence that a quote was accepted.

3. Data and data subjects concerned

• Data subjects: the professional’s end clients.
• Categories of data: identity (first name, last name), contact details (email, phone), postal address for at-home appointments, appointment history, notes entered by the professional, quotes, invoices and credit notes (services, amounts, billing address), evidence that a quote was accepted (fingerprint of the IP address, browser, timestamp). No sensitive data is requested by the platform; the professional undertakes not to enter any in free-text fields (notes).

4. Daytio’s obligations (as processor)

• Only process data to provide the service;
• Guarantee confidentiality (strict isolation between accounts, encryption in transit, least privilege);
• Assist the professional in responding to requests to exercise rights (access, rectification, erasure, portability);
• Notify the professional without undue delay in the event of a data breach concerning them;
• At the end of the contract: return the data (export) then delete it, in accordance with article 8 of the Terms of Sale.

5. Sub-processors

The professional generally authorises the use of the following sub-processors, which offer appropriate guarantees:

• Supabase (database, authentication, storage — EU, AWS eu-west-1);
• Vercel (application hosting);
• Resend (transactional email sending);
• Google (only if the professional connects Google Calendar).

Any change to this list is notified to the professional, who may raise legitimate objections.

6. Transfers outside the EU

Data is hosted within the European Union. Where certain providers (application hosting, emails) involve a transfer outside the EU, this is governed by the European Commission’s standard contractual clauses entered into with the providers concerned (notably Vercel and Resend).

7. Professional’s obligations (as data controller)

• Have a legal basis for its processing and inform its clients (Daytio’s privacy policy contributes to this information);
• Respond to its clients’ requests to exercise their rights — the platform notably allows it to rectify and delete a client record at any time;
• Not enter sensitive or irrelevant data.

8. Retention period

Unless otherwise instructed by the professional, inactive client records are automatically anonymised 36 months after the last appointment (see the privacy policy). Issued invoices and credit notes are not affected by this anonymisation: keeping them for ten years is the professional’s legal obligation. They are kept as long as the professional’s account exists, and the professional can export them at any time.

9. Audit

Daytio makes available the information necessary to demonstrate compliance with this agreement and allows, under reasonable conditions (frequency, notice, confidentiality), the audits required by applicable regulations.