Data processing agreement

Scope

This data processing agreement ("DPA") sets out how OPALITH SAS, registered office 254 rue Vendôme, 69003 Lyon, France (RCS Lyon 991 600 156), processes personal data on behalf of its customers when they use rdv.dev, as required by article 28 of the General Data Protection Regulation ("GDPR").

It is part of the terms of service and applies automatically to every customer that accepts them, with no separate signature. Words defined in the terms (Service, Workspace, Owner, Host, Guest, Agent) have the same meaning here. If this DPA and the terms disagree about personal data processed on your behalf, this DPA prevails.

Roles

• You, the customer, are the controller of the personal data processed in your workspace for you: your guests' data, and the data of your members as they use the Service for your business (their event types, availability, bookings and calendar connections as configured in your workspace).
• OPALITH SAS is your processor for that data, and processes it only to provide the Service to you.
• OPALITH SAS is a controller of the data it processes for its own purposes: accounts and sign-in, security, billing, and its relationship with you. That processing is described in the privacy policy and is not covered by this DPA.

Details of the processing

Subject matter

Providing the Service: booking pages, availability, bookings, calendar events, confirmations and reminders, branding, and the public API, MCP server and webhooks.

Duration

For as long as the agreement lasts, then the 30-day retrieval window described in the terms, then deletion (see Deletion or return).

Nature

Collection through booking pages and the API, storage, organisation, consultation, live reading of calendar availability, writing of calendar events, transmission by email, text message, API and webhooks, and deletion.

Purpose

Letting your guests book, move and cancel meetings with your hosts; informing guests and hosts; keeping your hosts' calendars up to date; and giving your integrations and agents access to your scheduling data.

Data subjects

Your guests (for example prospects, customers, candidates and partners); your members and hosts; the people you invite to your workspace.

Personal data

Guests: name, email address, time zone, language, notes and answers given when booking, meeting details, and, only if the guest asks for text reminders, mobile number and consent. Members: name, email address, role, event types, weekly hours, busy times (read live, not stored), identifiers of the calendar events written for them. Visitors to booking pages: IP address, processed for security and rate limiting.

Special categories

None intended. Do not ask guests for sensitive data, such as health information, in booking questions.

Your instructions

• We process the personal data only on your documented instructions. Your instructions are the terms, this DPA, the way you configure and use the Service, and any further written instructions you send to hello@rdv.dev that the Service can reasonably carry out.
• We tell you if, in our opinion, an instruction infringes the GDPR or another data protection law.
• If European Union or French law requires us to process the data in another way, we tell you before we do, unless that law forbids it.

Confidentiality

Only people who need the data to run the Service can access it. Each of them is bound by a duty of confidentiality, by contract or by law.

Security measures

We protect the personal data with technical and organisational measures that fit the risk, including:

• Location. The database and the application's functions are in Frankfurt (Germany).
• Encryption. Encryption in transit (TLS) for every connection, and encryption at rest by our database and file storage providers.
• Access control. Every action in the Service checks, on the server, who is asking and what their role in the workspace allows. Access to production systems is limited to the people who run the Service.
• Secrets. Passwords, guests' manage links, invitation secrets and API keys are stored only as a hash. Calendar OAuth tokens are held by Nango and never reach our database or our code.
• Minimisation. Calendar free/busy information is read live and not stored; from Microsoft calendars we request only the start, end, free/busy status and cancellation of events. Guests' phone numbers are collected only for text reminders, with consent.
• Abuse protection. Rate limits per account and per hashed IP address; websites are fetched through a guarded transport that refuses private network addresses.
• Resilience. Managed database backups with point-in-time restore; daily removal of expired data.
• Review. We review these measures when the Service changes, and at least once a year.

Assistance

Taking into account the nature of the processing and the information available to us, we help you:

• answer requests from people exercising their rights (access, rectification, erasure, restriction, portability, objection). Most can be handled in the Service itself; if a request reaches us directly, we forward it to you without undue delay and do not answer it ourselves, unless you ask us to;
• meet your security obligations;
• carry out a data protection impact assessment, or consult a supervisory authority, when the processing requires it.

Personal data breaches

We notify you of a personal data breach affecting your data without undue delay, and at the latest 48 hours after becoming aware of it, by email to the owner of the workspace. The notice describes, as far as we know at the time, the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed. We complete it as we learn more, and we help you notify the supervisory authority and the people concerned where you must.

Sub-processors

You give us a general authorisation to use sub-processors. Today they are:

• Same obligations. Each sub-processor is bound by a written contract that gives the personal data the same level of protection as this DPA. We remain responsible to you for their work.
• Changes. We tell owners by email, and update this page, at least 30 days before a new sub-processor starts processing your data.
• Right to object. Within those 30 days, you can object on reasonable data protection grounds by writing to hello@rdv.dev. We will look for a solution with you. If we cannot find one, you can end the agreement before the change applies, and we refund the fees paid for the period after the end date.

Google and Microsoft are not our sub-processors: your hosts connect their own calendars, and Google and Microsoft act under their own terms with them.

International transfers

Your data is stored in the European Union. Where a sub-processor is located, or can be accessed from, a country without an adequacy decision of the European Commission, the transfer relies on the EU-US Data Privacy Framework when the recipient is certified, and otherwise on the Standard Contractual Clauses adopted by the European Commission (decision 2021/914), together with the measures described below.

Infrastructure and government access

Where your data is. The database (Neon) and the application's functions (Vercel) are in Frankfurt, Germany. Files are stored by Vercel Blob and delivered through Vercel's global network.

Who the providers are. Vercel, Neon, Nango, Mailtrap and Firecrawl are companies based in the United States, and ClickSend is based in Australia. Laws of those countries may allow their authorities to ask these providers for data they hold, even when it is stored in the European Union.

What we do about it.

• Encryption. Data is encrypted in transit and at rest.
• Minimisation. Each provider receives only what its job needs. Calendar tokens never reach our database, calendar free/busy is never stored, and text reminders are sent only to guests who asked for them.
• Requests to us. If an authority outside the European Union asks us for your data, we check that the request is lawful, challenge it where there are grounds to, and disclose only the minimum it legally requires.
• Telling you. We tell you about such a request before we answer it, unless the law forbids us to.
• Providers. We choose providers that commit to the same: to challenge unlawful requests and to tell their customers where they lawfully can.

Deletion or return at the end

When the agreement ends, you can export your data during the 30-day retrieval window described in the terms. After that window, we delete the personal data we process for you, unless European Union or French law requires us to keep it. Deleted data ages out of our database provider's restore history within 30 days. If you delete your workspace yourself, the deletion is immediate. We confirm deletion in writing on request.

Audits

• We make available to you the information needed to show that we meet our obligations under article 28 of the GDPR, starting with this DPA and answers to your reasonable questions.
• If that is not enough, you can audit our compliance once a year, with at least 30 days' written notice, during business hours, at your own cost, yourself or through an independent auditor bound by confidentiality. An audit must not give access to other customers' data or disrupt the Service.
• You can audit more often if a supervisory authority requires it, or after a personal data breach affecting your data.

Liability and duration

This DPA lasts as long as we process personal data for you. Between you and us, the liability clause of the terms applies to this DPA, to the extent the law allows. Nothing in it limits the rights of the people whose data is processed.

Contact

For anything about this DPA, write to hello@rdv.dev. OPALITH SAS, 254 rue Vendôme, 69003 Lyon, France.