Back to Home

Data Processing Agreement

Version: 2.1-draft · Effective date: [not yet in effect]

1. Introduction, Parties and Roles

1.1. This Data Processing Agreement (the "DPA") is entered into between:

• Elephants Production s.r.o., with its registered seat at Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic, Company ID (IČO): 23397292, registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391 (the "Provider"); and
• the Customer, being the salon business that holds an account for the Sended service (the "Service" or "Sended", available at sended.io) under the agreement concluded pursuant to the Provider's Terms of Service (terms-of-service.md), consisting of the documents listed in Section 3.4 thereof (the "Agreement").

1.2. This DPA is incorporated into and forms an integral part of the Agreement. It reflects the parties' agreement pursuant to Article 28(3) of Regulation (EU) 2016/679 (the "GDPR") with respect to the Processing of End Client Personal Data.

1.3. Roles. For the Processing described in Annex A, the Customer is the controller and the Provider is the processor. Where the Customer itself acts as a processor for a third-party controller, the Customer warrants that it is authorized to engage the Provider as a further processor and to agree to this DPA on that controller's behalf; in that case, references to the Customer's controller obligations apply to the Customer's underlying controller as appropriate.

1.4. Out of scope. This DPA does not apply to personal data that the Provider processes as an independent controller, namely: Authorized User account and authentication data, billing and subscription data, Service security and audit logs, support communications, the Provider's own website and in-product analytics, the global email suppression list described in Section 13.5, and the per-Customer email deliverability monitoring described in Section 13.7 (aggregate bounce and spam-complaint rates computed from delivery events, and the resulting pause or resumption of a Customer's marketing email). Such processing is described in the Provider's Privacy Policy (privacy-policy.md).

2. Definitions

2.1. In this DPA:

• "Provider" means Elephants Production s.r.o.
• "Sended" or "Service" means the platform operated by the Provider at sended.io.
• "Customer" means the salon business holding the account (the Service is offered to businesses only).
• "Authorized User" means an individual using the Customer's account.
• "End Client" means the Customer's client or prospective client whose personal data is processed through the Service on the Customer's behalf.
• "End Client Personal Data" means the personal data described in Annex A that the Provider processes on behalf of the Customer. It includes the limited work data of the Customer's staff members synchronized from the Customer's CRM (Annex A.4 and A.5).
• "Customer Data" has the meaning given in Section 2 of the Terms of Service, namely all data submitted to, generated in, or synchronized into the Service under the Customer's account, including End Client records synchronized from the Customer's booking system, message content, campaign configurations, and related metadata. Customer Data includes End Client Personal Data.
• "Data Protection Laws" means the GDPR, Czech Act No. 110/2019 Coll., on personal data processing, and any other data protection laws applicable to the Processing under this DPA.
• "SCCs" means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.
• "DPF" means the EU–U.S. Data Privacy Framework established by the European Commission's adequacy decision of 10 July 2023.
• "Sub-processor" means a further processor engaged by the Provider to process End Client Personal Data.
• "Sub-processor List" means the current, maintained list of Sub-processors published by the Provider at subprocessors.md.

2.2. "Personal data", "processing", "data subject", "controller", "processor", "personal data breach" and "supervisory authority" have the meanings given in the GDPR.

2.3. Capitalized terms not defined here have the meaning given in the Terms of Service (terms-of-service.md), in particular "Channels", "Customer Data", "Fees" and "Plan".

3. Subject Matter, Duration, Nature and Purpose of Processing

3.1. Subject matter. The Processing of End Client Personal Data necessary to provide the Service: a business-to-business communications platform through which the Customer manages, and communicates with, its own clients.

3.2. Duration. The Processing lasts for the term of the Agreement and thereafter only for the wind-down period necessary to complete deletion or return under Section 13.

3.3. Nature and purpose. Synchronization of the Customer's client records from the Customer's CRM (Altegio); storage and organization of those records; audience segmentation and scoring; rendering and personalization of messages; transmission of messages through the Channels described in Annex A (email via Amazon SES, WhatsApp via Meta's WhatsApp Business Platform, Telegram via the Customer's own connected Telegram account, and Instagram Direct where and when enabled); receipt and storage of inbound messages from the two-way Channels in a unified inbox (the email Channel is outbound only and the Service does not receive or store inbound email on the Customer's behalf); transcription of voice messages and AI-assisted conversation features where the Customer enables them, together with generation of campaign names and drafting of WhatsApp message templates, which operate independently of that setting; recording of delivery, engagement and opt-out events; aggregate counting of records for Fee metering and Plan-allowance enforcement; and related support and platform administration, all as further described in Annex A.

3.4. The categories of data subjects and of personal data are set out in Annex A. The Customer's obligations and rights are set out in this DPA and the Agreement.

4. Documented Instructions

4.1. The Provider shall process End Client Personal Data only on the Customer's documented instructions, including with regard to transfers of personal data to a third country or an international organisation, unless required to do otherwise by Union or Member State law to which the Provider is subject; in such a case, the Provider shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2. The Customer's complete documented instructions at the date of this DPA consist of: (a) this DPA, including its Annexes; (b) the Agreement; and (c) the Customer's configuration and use of the Service's features — including, without limitation, connecting a CRM or messaging Channel, creating and launching campaigns and automations, enabling AI-assisted features, and managing audiences — each of which constitutes a documented instruction to carry out the corresponding Processing. Additional or alternative instructions require the parties' written agreement.

4.3. The Provider shall immediately inform the Customer if, in the Provider's opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. The Provider is not obliged to perform a comprehensive legal review of the Customer's instructions, and may suspend performance of an instruction it reasonably believes to be unlawful until the instruction is confirmed or modified.

5. Customer Obligations

5.1. The Customer is responsible, as controller, for: (a) the lawfulness of the Processing, including a valid legal basis for each communication sent through the Service and compliance with applicable direct-marketing rules; (b) providing End Clients with the transparency information required by Articles 13 and 14 GDPR, including in respect of data obtained from the Customer's CRM; (c) the accuracy and quality of End Client Personal Data; and (d) responding to data subjects exercising their rights.

In discharging paragraph (b), the Customer shall make the Provider's privacy notice (privacy-policy.md) available to End Clients at the point at which their personal data is collected and, where the data was not obtained from the End Client directly — in particular where it is synchronized from the Customer's CRM — at the latest at first contact through the Service. The Provider keeps that notice available at a stable address so that the Customer can link to or reproduce it.

5.2. Special categories of personal data. The Service is not designed for special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR), and the Provider does not intentionally process them. The Customer is specifically warned that free-text fields synchronized from its CRM (client notes, appointment comments, custom fields) can capture such data — in a salon context typically health-adjacent information such as allergies, skin conditions, medication or pregnancy. Accordingly:

• (a) Functional need, not diagnosis. The Customer shall instruct its staff to record only the functional need relevant to the service to be performed (for example "use fragrance-free products", "extend patch-test interval") and never a diagnosis, health condition or other special-category detail.
• (b) Article 9(2) condition. Where a special category of personal data nevertheless enters the Service, directly or through such a field, the Customer warrants that a condition under Article 9(2) GDPR — in particular the End Client's explicit consent — applies in addition to its Article 6 legal basis, and the Customer remains the controller of that data.
• (c) Necessary scope only. Such data is processed by the Provider only in the scope necessary to provide the Service and under the protections of this DPA. It is not used for segmentation, scoring or any other analysis by the Provider.
• (d) Restrict and delete on discovery. Where the Provider becomes aware that special-category data is held in the Service, it shall inform the Customer, restrict access to that data, and — on the Customer's instruction, or where the Customer does not respond within a reasonable period — delete or irreversibly anonymize it without undue delay.

The Service's AI features do not read End Client CRM records: free-text client notes, appointment comments and custom fields are not transmitted to the AI Sub-processors listed in Annex C.

5.3. Where the Customer's clientele includes minors, the Customer is responsible for the lawfulness of processing minors' data and for any required parental consents.

6. Confidentiality

6.1. The Provider shall ensure that all persons authorized to process End Client Personal Data (employees, contractors and other personnel) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and process the data only for the purposes of providing the Service and on a need-to-know basis.

7. Security of Processing

7.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing, as well as the risks to data subjects, the Provider shall implement and maintain the technical and organisational measures required by Article 32 GDPR. The measures currently implemented are described in Annex B.

7.2. The Provider may update the measures in Annex B from time to time, including as part of its internally tracked security hardening programme, provided the updates do not materially degrade the overall level of protection.

7.3. The Provider shall ensure that any natural person acting under its authority who has access to End Client Personal Data does not process it except on the Customer's instructions, unless required to do so by Union or Member State law.

8. Sub-processing

8.1. General authorization. The Customer grants the Provider a general written authorization to engage Sub-processors for the Processing of End Client Personal Data. The Sub-processors authorized at the date of this DPA are listed in Annex C; the current, maintained Sub-processor List is published in subprocessors.md.

8.2. Notice of changes. The Provider shall inform the Customer of any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the account or billing contact email address held on the Customer's account and by updating the published Sub-processor List, thereby giving the Customer the opportunity to object. Where a Sub-processor must be replaced without delay for security or service-continuity reasons, the Provider may do so immediately and will notify Customers as soon as reasonably practicable, no later than the date the replacement takes effect; the objection right in Section 8.3 applies from the notice.

8.3. Objection. The Customer may object in writing, on reasonable data-protection grounds, within 30 days of the notice under Section 8.2 or, where a Sub-processor was replaced without prior notice, within 30 days of the notice given after the fact. The parties shall then discuss the objection in good faith. Where the objection concerns a replacement that has already taken effect, the Provider shall, pending resolution, limit the new Sub-processor's Processing to what is necessary for service continuity. If the objection cannot be resolved and the Provider elects to proceed with the change, the Customer may, as its remedy, terminate the affected portion of the Service — or, if the affected portion cannot reasonably be severed, the Agreement — by written notice, without penalty in respect of Fees for the period after termination.

8.4. Flow-down. The Provider shall impose on each Sub-processor, by written contract, data protection obligations materially equivalent to those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures. Where a Sub-processor fails to fulfil its data protection obligations, the Provider remains fully liable to the Customer for the performance of that Sub-processor's obligations.

9. Assistance with Data Subject Requests

9.1. Taking into account the nature of the Processing, the Provider shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to data subjects exercising their rights under Chapter III GDPR.

9.2. Forwarding. If the Provider receives a request from an End Client (or another data subject whose data is processed under this DPA) directly, it shall forward the request to the Customer without undue delay and at the latest within 5 business days, and shall not respond substantively to the data subject other than to refer them to the Customer, unless required by law.

9.3. Objection to marketing / opt-out. The Service automatically records and enforces marketing opt-outs, and enforcement is Channel-agnostic: an opt-out recorded by any route excludes that End Client from further marketing messages on every Channel. No instruction from the Customer is required for this, and the Customer cannot override a recorded opt-out through the Service. Each opt-out is recorded against the Customer whose message prompted it and silences that Customer's marketing only: an End Client who is a client of more than one Customer using the Service objects to each controller's marketing separately (Art 21(3) GDPR), and one Customer's opt-out records are never applied to, or disclosed to, another Customer. Separately from this per-Customer objection, the Provider maintains a service-wide email suppression list (hard bounces and spam complaints, applied across all Customers); the Provider operates that list in its own controller capacity to protect the shared sending infrastructure, as described in the Privacy Policy.

Refusal mechanisms differ by Channel. On email the refusal mechanism is provided by the Service: every marketing email carries a one-click unsubscribe header and a footer link. On WhatsApp the Service records a refusal signalled through the platform (Meta's user-preference stop signal for that recipient, or a delivery error reporting the same) and a refusal an Authorized User records on the End Client's behalf; a refusal that arrives only as a free-text reply is not detected automatically. On Telegram there is no automatic detection at all. On those two Channels the Customer must therefore include a working refusal instruction in the message or template content and must record the refusals it receives, which the Service then enforces on every Channel (Acceptable Use Policy, acceptable-use-policy.md, Sections 3.1(c), 5.7 and 6.4).

Evidentiary scope. The register records the current objection state, with the source and timestamp of the recording. An End Client may withdraw an objection only by an explicit confirmation on the unsubscribe page reached from that Customer's email unsubscribe link; withdrawal deletes the record, so the Provider does not retain a history of superseded objections and cannot evidence an objection that the End Client has since withdrawn. Neither the Customer nor the Provider can withdraw an objection on the End Client's behalf.

9.4. Access, portability, rectification, erasure, restriction. On the Customer's documented instruction sent to privacy@sended.io, the Provider shall manually carry out the requested action with respect to the relevant End Client Personal Data — including compiling an export of a data subject's personal data in a structured, commonly used and machine-readable format, rectifying data that cannot be corrected through the Service or the connected CRM, and deleting or irreversibly anonymizing a data subject's personal data — within 10 business days of the instruction, or within such shorter period as the Customer reasonably specifies in order to meet its own deadline under Article 12(3) GDPR. Where a request is manifestly complex and 10 business days is not achievable, the Provider shall say so within 3 business days of the instruction, give an estimated completion date and provide any partial results already available, so that the Customer may rely on the extension permitted by Article 12(3) GDPR. The Provider does not currently offer these operations as self-service features.

10. Personal Data Breaches; Assistance with Articles 32–36 GDPR

10.1. The Provider shall notify the Customer without undue delay after becoming aware of a personal data breach affecting End Client Personal Data, and shall use reasonable endeavours to notify within 48 hours. For this purpose, the Provider becomes aware when it has a reasonable degree of certainty that a security incident leading to a personal data breach has occurred. Where the facts are still being established, the Provider shall send an initial holding notification within that period and complete it in accordance with Section 10.2.

10.2. The notification shall, to the extent the information is available, include the content required by Article 33(3) GDPR: (a) the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; (b) the name and contact details of the Provider's contact point (privacy@sended.io); (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach and mitigate its possible adverse effects. Where and insofar as it is not possible to provide all information at the same time, the information may be provided in phases without undue further delay.

10.3. The Provider shall cooperate with the Customer and take reasonable steps to investigate, mitigate and remediate the breach, and shall document the breach in accordance with Article 33(5) GDPR. The Provider shall not notify a supervisory authority or data subjects on the Customer's behalf unless the Customer so instructs in writing or the Provider is required to do so by law. Notification under this Section is not an acknowledgement of fault or liability.

10.4. Taking into account the nature of the Processing and the information available to it, the Provider shall assist the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36 GDPR, including by providing information reasonably necessary for the Customer's data protection impact assessments and prior consultations that concern the Service. On the Customer's request, this includes a description of the automated evaluation and scoring logic described in Annex A.1 and of the inputs it uses. The Provider may charge reasonable, pre-agreed costs for assistance that is materially in excess of what is described in this DPA, except for assistance related to a breach caused by the Provider.

11. International Transfers

11.1. The Provider's core infrastructure is hosted in the European Union (Amazon Web Services, region eu-central-1, Frankfurt). Email is dispatched via Amazon SES from the EU region. Two exceptions are stated in Annex C and in the Sub-processor List: the managed database that holds AI-assistant conversation history, whose region is recorded there, and the content-delivery network through which the Service's web applications and Customer-uploaded images are served from edge locations worldwide.

11.2. The Provider shall transfer End Client Personal Data outside the European Economic Area only (a) on the Customer's documented instructions (which include the Customer's use of Channels and features as described in Section 4.2 and Section 12), and (b) to the Sub-processors listed in Annex C, in each case subject to a valid transfer mechanism under Chapter V GDPR.

11.3. For Sub-processors established in the United States, the Provider relies on: (a) the DPF, where the Sub-processor holds a current DPF certification; and (b) the SCCs, Module 3 (processor to processor), entered into with the Sub-processor, as the mechanism where no DPF certification applies or as a fallback should the DPF adequacy decision be invalidated, together with supplementary measures where a transfer impact assessment shows they are needed.

11.4. If a transfer mechanism relied on under this Section is invalidated or suspended, the Provider shall inform the Customer and the parties shall cooperate in good faith to identify a lawful alternative; the Provider may suspend the affected transfers in the meantime.

11.5. Governmental access requests. On receiving a governmental or law-enforcement request for End Client Personal Data held for a Customer, the Provider shall, where not legally prohibited from doing so: notify the Customer without undue delay; direct the requesting authority to the Customer as controller; disclose only the minimum lawfully required; and challenge the request where it is not lawful under Union or Member State law, suspending disclosure while the challenge is pending to the extent the law permits. Where the Provider is prohibited from notifying the Customer, it shall use reasonable efforts to obtain a waiver of the prohibition and shall document its assessment.

12. Telegram and Other Customer-Directed Disclosures

12.1. Telegram. The Telegram Channel operates through the Customer's own Telegram account, which the Customer connects to the Service by authenticating with its own phone number (it is not a bot operated by the Provider). Messages sent through this Channel are sent from the Customer's own account, under the Customer's own contractual relationship with Telegram and subject to Telegram's own terms, which the Customer accepts independently of the Provider.

12.2. Accordingly, the parties agree that the disclosure of End Client Personal Data (in particular phone numbers and message content) to Telegram that results from the Customer's use of this Channel is a disclosure directed by the Customer, as controller, to a recipient selected and contracted by the Customer — it is not the engagement of a Sub-processor by the Provider. The Provider's role is limited to transmitting each message through the Customer's connected account on the Customer's documented instruction (Section 4.2).

12.3. The Customer acknowledges and instructs that delivering a Telegram message technically requires disclosing the recipient End Client's phone number to Telegram in order to determine whether the recipient can be reached. The Service first looks the number up without writing anything. Only where the Customer's account cannot otherwise reach the number does the Service add the End Client to the address book of the Customer's own connected Telegram account, with the phone number and the first and last name from the Customer's client record and no other data; where no name is on record, no contact is added and the message is not sent. Telegram stores that contact under its own terms and synchronizes it to the devices of the Customer's account. The Provider does not keep a separate copy and does not remove the contact afterwards: it remains until the Customer deletes it in the Telegram app, and it is not removed by disconnecting Telegram from the Service, by erasure of the Customer's data under Section 13, or by anonymization of the End Client. Telegram is a third-country service; the Customer is responsible for its lawful basis for, and transparency toward End Clients about, this disclosure.

12.4. WhatsApp. The WhatsApp Channel operates through the Customer's own WhatsApp Business account, which the Customer connects via Meta's embedded signup and which is subject to Meta's WhatsApp business terms (including Meta's business data processing terms) accepted by the Customer. Without prejudice to the Customer's direct relationship with Meta, the Provider transmits WhatsApp messages via Meta's Cloud API on the Customer's behalf and lists Meta/WhatsApp Ireland in Annex C for transparency.

12.5. AI-interaction disclosure. The Service prepends a disclosure identifying the sender as an automated assistant to the first AI-composed message of each conversation. In relation to its End Clients, the Customer is the deployer of that AI system within the meaning of Regulation (EU) 2024/1689 (the AI Act) and remains responsible for its own obligations under Article 50 of that Regulation; the allocation of AI responsibilities between the parties is set out in Section 11 of the Terms of Service. Neither party may remove, suppress or obscure such a disclosure, or any content marking applied by an AI model provider.

13. Deletion or Return of Personal Data

13.1. Upon termination or expiry of the Agreement, the Provider shall, at the Customer's choice communicated in a written request, delete or return all End Client Personal Data and all other Customer Data, and delete existing copies, unless Union or Member State law requires storage of the personal data. The categories that the Provider processes in its own controller capacity (Section 1.4) are excepted; they are governed by the Provider's Privacy Policy. The Provider shall carry out the request within 30 days of receiving it, but not before the end of the 90-day retrieval window under Section 20.5 of the Terms of Service, unless the Customer expressly waives the remainder of that window in its request. Return is provided as a manually compiled export in a structured, commonly used and machine-readable format (such as CSV or JSON); deletion is likewise carried out manually by the Provider.

13.2. If the Customer makes no request within the 90-day retrieval window that runs from termination under Section 20.5 of the Terms of Service, the Provider shall delete the End Client Personal Data and the remaining Customer Data in the ordinary course within 30 days after that window has expired, without prejudice to Sections 13.3 and 13.4.

13.3. Scope of deletion. Deletion covers production systems. In addition:

• (a) Backups. Residual copies may persist in backup copies for a limited period; such copies remain protected under this DPA and are deleted or overwritten as backups are rotated.
• (b) Uploaded images. Images uploaded by the Customer for use in messages and pages are stored as content-addressed objects that remain retrievable after deletion of the associated records, because messages already delivered continue to reference them, and they are cached at content-delivery-network edge locations for up to one year. The Customer must not upload images containing End Client personal data (acceptable-use-policy.md, Section 8); that condition is what keeps this retention proportionate.
• (c) AI conversation history. The conversation history of the Service's AI features is held in a separate managed database (Annex C) and is automatically deleted 90 days after the last message in the conversation, independently of any request under this Section.
• (d) Sub-processors. The Provider shall procure that its Sub-processors delete or return End Client Personal Data on the same terms (Section 8.4).

13.4. Statutory retention. Where Union or Member State law requires the Provider to retain particular data (for example accounting or tax records, or records evidencing compliance with marketing-communication rules), the Provider shall retain only the data and for only the period so required, shall continue to protect it in accordance with this DPA, and shall not process it for any other purpose.

13.5. Email suppression list. The Provider maintains a global email suppression list (email addresses that have hard-bounced or generated spam complaints, with the suppression reason and timestamp) as its own controller obligation, to protect email deliverability for all customers and to defend legal claims. This minimal dataset is retained after termination on the basis of the Provider's legitimate interests (Article 6(1)(f) GDPR), is not used for any other purpose, and is described in the Provider's Privacy Policy (privacy-policy.md).

13.6. Upon the Customer's written request, the Provider shall confirm completion of deletion in a written deletion certificate.

13.7. Email deliverability monitoring. For each Customer, the Provider computes aggregate bounce and spam-complaint rates from the delivery events generated by that Customer's email, and warns, pauses or resumes that Customer's marketing email accordingly; transactional and service messages are not affected by a pause, and a pause may be lifted by the Provider's authorized personnel with the reason recorded in an audit log. The Provider carries out this monitoring as its own controller obligation, on the basis of its legitimate interests in protecting the shared sending infrastructure and the deliverability of all Customers' email (Article 6(1)(f) GDPR); it therefore falls outside this DPA (Section 1.4), is described in the Provider's Privacy Policy (privacy-policy.md), and its thresholds and consequences are set out in the Acceptable Use Policy (acceptable-use-policy.md, Section 4.2). Delivery events are attributed by recipient email address: where two Customers have messaged the same address, an event on that address is counted for both, which is a property of the design that the Customer cannot switch off. The computation returns counts only, and no Customer ever sees another Customer's data.

14. Audits and Demonstrating Compliance

14.1. The Provider shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

14.2. Audits are subject to the following conditions: (a) no more than one audit in any 12-month period, except following a personal data breach affecting the Customer's End Client Personal Data or where required by a competent supervisory authority; (b) at least 30 days' prior written notice; (c) conducted during business hours, with minimal disruption to the Provider's operations; (d) at the Customer's cost; (e) the auditor must not be a competitor of the Provider and must enter into a reasonable confidentiality undertaking; and (f) the audit shall not extend to data of the Provider's other customers or to information whose disclosure would compromise the security of other customers' data.

14.3. In the first instance, the Provider will respond to a written security questionnaire within 20 business days, provide the current description of measures in Annex B and, where the Customer's concern relates to the underlying cloud infrastructure, the relevant AWS compliance reports available to the Provider under its AWS agreement. Where the Provider later obtains its own third-party audit report or certification covering the relevant controls (such as a SOC-type report or an ISO 27001 certificate), it may offer that instead, together with written responses to reasonable follow-up questions. The Provider holds no such report or certification of its own at the date of this DPA. The Customer may proceed to an on-site audit under Section 14.2 only if such materials do not reasonably address its documented concerns.

15. Liability

15.1. Each party's liability arising out of or in connection with this DPA (including the SCCs, where applicable, and whether in contract, tort or otherwise) is subject to the limitations and exclusions of liability set out in the Agreement (see the Terms of Service, Section 16), and liability under the Agreement and this DPA together counts toward the single aggregate cap set out there.

15.2. Nothing in this DPA limits any data subject's rights or either party's liability to data subjects under Article 82 GDPR. As between the parties, each party is responsible for the part of any compensation or administrative fine corresponding to its share of responsibility, and Article 82(5) GDPR applies to recovery between them.

16. Term, Precedence and Final Provisions

16.1. This DPA takes effect upon the Customer's acceptance of the Agreement and remains in force for as long as the Provider processes End Client Personal Data.

16.2. In the event of conflict on the subject matter of personal data processing, the following order of precedence applies: (a) the SCCs, where they apply; (b) any individually negotiated written agreement between the parties, but only to the extent it expressly amends this DPA by reference to the affected clause; (c) this DPA; (d) the remaining documents of the Agreement. This mirrors the order of precedence in Section 3.4 of the Terms of Service.

16.3. The Provider may update this DPA to the extent required to reflect changes in Data Protection Laws or in binding guidance of supervisory authorities, following the notice mechanism set out in the Agreement; updates shall not materially reduce the level of protection for End Client Personal Data.

16.4. If any provision of this DPA is held invalid, the remainder remains in force, and the parties shall replace the invalid provision with a valid one that most closely reflects its purpose.

16.5. Governing law and jurisdiction. This DPA is governed by the laws of the Czech Republic, and the courts of Prague, Czech Republic have exclusive jurisdiction, in each case except where the GDPR or the SCCs mandatorily provide otherwise.

16.6. Contacts.

Elephants Production s.r.o. Rybná 716/24, Staré Město, 110 00 Prague 1, Czech Republic Company ID (IČO): 23397292 Registered in the Commercial Register maintained by the Municipal Court in Prague, File No. C 426391

General inquiries: contact@sended.io Privacy and data subject requests, and the contact point for personal data breaches under Section 10.2: privacy@sended.io

---

Annex A — Description of Processing

A.1 Subject matter and nature of processing

Provision of Sended, a business-to-business communications platform for salon businesses, comprising the following processing operations performed on the Customer's behalf:

• synchronization (collection) of client, staff, service and appointment records from the Customer's connected Altegio CRM account, and writing of bookings, client updates and related records back to that CRM on the Customer's instruction;
• storage, organization, structuring and segmentation of client records;
• recurring automated evaluation and scoring: re-evaluation of each End Client record against the Customer's segment rules (currently every four hours), recency/frequency/monetary (RFM) scoring of each End Client and the segment suggestions derived from it, and daily evaluation of each End Client's date of birth and last-visit date to decide whom to contact through the Customer's date-based and inactivity-based automations, which initiate messages without staff action;
• rendering and personalization of outbound messages (campaigns, automations, replies);
• transmission of messages through the connected Channels: email via Amazon SES (EU region, eu-central-1); WhatsApp via Meta's WhatsApp Business Platform (Cloud API); Telegram, sent from the Customer's own connected Telegram account (not a bot — see Section 12); and Instagram Direct, only where and when enabled (this Channel is in development);
• storage and distribution of images the Customer uploads for use in its messages and pages, which are served from a public, content-addressed content-delivery-network URL: when a recipient's mail or messaging client loads such an image, the edge location serving it — which may be outside the EEA — receives that recipient's IP address and client metadata;
• receipt, storage and display of inbound messages (including media and voice messages) from the two-way Channels in a unified inbox; the email Channel is outbound only and the Service does not receive or store inbound email on the Customer's behalf;
• automated transcription of voice messages, and AI-assisted conversation features (autonomous conversational replies to End Clients, with booking-system actions held for the Customer's approval in the default mode), in each case only where the Customer enables them. Conversation content, message-intent classification and voice transcription are processed by OpenAI; where the Service's AI features use their booking tools, the results returned to the model include the Customer's staff records and the End Client's appointment records, but not the End Client's CRM record and not the free-text client note. Drafting of WhatsApp message templates (also processed by OpenAI) operates on template text the Customer is composing, irrespective of whether the Customer has enabled the AI assistant. The Service's AI features are disabled platform-wide at the Effective Date, and no data is sent to the AI Sub-processor until the Provider enables them. The AI Sub-processor is listed in Annex C;
• recording of delivery and engagement events (delivery, bounce and complaint events; read receipts; per-recipient link-click records; WhatsApp pricing and conversation-category records) and of booking attribution, including the appointment that followed a message and whether it was attended;
• recording and enforcement of marketing opt-outs and of per-recipient frequency caps;
• aggregate counting of the Customer's synchronized staff, client and appointment records in order to compute the Fee and enforce Plan allowances (Terms of Service, Section 7.1a) — counts only; no record content is evaluated for this purpose;
• administration and support access by the Provider's authorized personnel on a need-to-know basis, including reading the Customer's workspace data, inspecting and replaying stored integration payloads, requeuing synchronizations and reconciling delivery outcomes; such access is bound by confidentiality (Section 6) and recorded in an audit trail (Terms of Service, Section 12.5);
• deletion, anonymization and export operations carried out on the Customer's documented instruction (Section 9.4).

A.2 Duration

For the term of the Agreement and the wind-down period under Section 13.

A.3 Purpose

Enabling the Customer to manage relationships and communications with its own clients: client-base management, appointment-related and service communications, direct marketing by the Customer to its own clients, two-way conversations, and related analytics for the Customer. In addition, and to the limited extent described in Annex A.1, the Provider counts records in aggregate in order to compute the Fee payable by the Customer and to enforce the allowances of the Customer's Plan, and its authorized personnel access workspace data for support, incident response and platform administration.

A.4 Categories of data subjects

• End Clients: the Customer's clients whose records are synchronized from the Customer's CRM or created through the Service, and recipients of the Customer's messages;
• individuals who contact the Customer through a connected messaging Channel (including prospective clients not yet recorded in the CRM);
• the Customer's staff members, whose limited work data is synchronized from the CRM for scheduling and attribution purposes, is counted in aggregate for Fee metering, and — where the Customer enables the AI assistant's booking tools — is returned to the AI Sub-processor listed in Annex C.

Data subjects may include minors where the Customer provides services to minors; the Customer is responsible for the lawfulness of such processing (Section 5.3).

A.5 Categories of personal data

A.6 Special categories of personal data

None are intended to be processed, and the Service is not designed for them (Section 5.2). Warning: free-text notes, appointment comments and custom fields controlled by the Customer can carry special-category data, in particular health-adjacent information such as allergies, skin conditions, medication or pregnancy. Under Section 5.2 the Customer records only the functional need and never a diagnosis; where a special category nevertheless arrives, the Customer warrants an Article 9(2) condition and bears controller responsibility for it, the Provider processes it only in the scope necessary to provide the Service, and on discovery the Provider restricts access and deletes or anonymizes it as set out in Section 5.2(d). Such fields are not transmitted to the AI Sub-processors listed in Annex C.

A.7 Frequency

Continuous, for the duration of the Agreement.

---

Annex B — Technical and Organisational Measures (Article 32 GDPR)

The Provider implements and maintains the following measures. The Provider may update them in accordance with Section 7.2; updates shall not materially degrade the overall level of protection. Specific controls are additionally reviewed and strengthened under the Provider's internally tracked security hardening programme.

Where a measure below is expressed as applying "from first production deployment", it describes the committed configuration of the production environment, which is provisioned from version-controlled infrastructure definitions. Pre-launch development environments are not used to process Customer Data or End Client Personal Data.

1. Hosting and physical security. The Service is hosted on Amazon Web Services in the European Union (region eu-central-1, Frankfurt), relying on AWS's physical and environmental security controls and industry certifications (e.g. ISO 27001, SOC reports). The Service's web applications and the images the Customer uploads are served through Amazon CloudFront's worldwide edge network; the edge location serving a request receives the requester's IP address and client metadata, and no message text or other End Client data (see the Sub-processor List, subprocessors.md, Section 3.1).

2. Encryption in transit. TLS is enforced for connections to the Service and for connections to third-party providers. Credentials are transmitted to third-party providers in request headers, never in URL query strings.

3. Protection of stored credentials and data. From first production deployment the relational database is encrypted at rest with managed keys (AWS KMS); object storage is encrypted at rest. In addition, at field level, all four classes of Channel connection credential are encrypted with AES-256-GCM: Altegio API credentials, WhatsApp access credentials, Telegram session strings and Instagram page access tokens. Encrypted values carry a versioned envelope so that the format can be changed, and rows written before field-level encryption was introduced are upgraded when they are next written. Authentication, refresh, password-setup and password-reset tokens are stored only as SHA-256 hashes; raw tokens are never persisted server-side. Application secrets are held in a managed secrets store, not in code. Error reports transmitted to the error-monitoring service are automatically scrubbed of email addresses and phone numbers before they leave the Provider's systems.

4. Access control and authentication. Role-based access control; session credentials delivered only in httpOnly, Secure cookies and never exposed to scripts running in the page (not returned in responses, not kept in browser storage); 15-minute access tokens renewed automatically; revocable refresh tokens (90 days in the Customer-facing application, 7 days in the administrative plane); a separated administrative plane with its own authentication; access to production systems restricted to authorized personnel on a need-to-know basis. From first production deployment the relational database has no public endpoint and is reachable only from within the Provider's virtual private cloud, and deletion protection is enabled on it.

5. Tenant separation. Logical (application-level) multi-tenant isolation: every request is resolved to a tenant, membership is verified before access, and all data access is scoped to the tenant (and branch) concerned.

6. Logging and monitoring. Activity logging with automatic purging after 90 days; audit logging of administrative and security-relevant changes, purged after 24 months; an append-only audit trail for platform-administrator actions, purged after 24 months; error and availability monitoring.

6a. Storage limitation. Automatic retention schedules, run daily: the rendered text of messages is blanked 180 days after sending (a message never sent: 180 days after it was last due) and review-request conversations are deleted after 180 days; message engagement events and link clicks are deleted after 13 months; email delivery events after 90 days; unified-inbox messages, with the media files received with them, after 24 months, with raw provider payloads cleared after 30 days; the WhatsApp inbound mirror after 90 days; an End Client deleted in the Customer's CRM is anonymized 30 days later. Erasure of a terminated Customer and the anonymization of a single End Client follow tested, documented procedures; anonymization overwrites the End Client's personal data and the content sent to them while keeping aggregate delivery and booking counts.

7. Integrity of inbound integrations. Inbound provider callbacks (CRM webhooks, email delivery events, payment events, messaging webhooks) are authenticated by provider-appropriate mechanisms, including signature verification, verify tokens, secret URLs and source allowlists.

8. Data minimization in messaging. No email open-tracking pixels are used; unsubscribe and click-tracking links are stateless signed tokens that carry no personal data in the URL; click records store no IP addresses; unsubscribe pages are free of third-party resources.

9. Deliverability and abuse controls. Automatic global suppression of hard-bounced and complaining email addresses; per-Customer bounce and spam-complaint monitoring with warning and pause thresholds, affecting marketing email only and reversible by authorized personnel with the reason recorded (Section 13.7); enforced unsubscribe mechanisms in every marketing email; per-recipient frequency capping; quiet-hours handling.

10. Availability and resilience. Managed cloud infrastructure with the redundancy and recovery facilities of the underlying managed services; automated database backups with a 7-day retention period; from first production deployment, deletion protection and a final snapshot on destruction of the production database; queue-based message delivery with retry handling; fail-closed entitlement checks before dispatch.

11. Organisational measures. Confidentiality commitments for persons authorized to process personal data (Section 6); need-to-know access; documented incident-response handling for personal data breaches (Section 10); Sub-processor due diligence and contractual flow-down (Section 8); an internally tracked programme of security review and hardening.

12. Testing and assessment. Automated dependency and vulnerability scanning on every build; a documented policy for applying security patches; a periodic restore test of the automated database backups; and an annual review of these measures against the risks to data subjects. Results are recorded and feed the Provider's security programme (Article 32(1)(c) and (d) GDPR).

---

Annex C — Authorized Sub-processors

C.1 The Customer grants a general authorization for the Sub-processors listed below (Section 8.1). The current, maintained Sub-processor List — which prevails in case of divergence from this snapshot as to the identity of the Sub-processors, their locations and their transfer mechanisms — is published in subprocessors.md; the terms of this DPA prevail over that page in all other respects. Changes are notified at least 30 days in advance (Section 8.2).

C.2 Snapshot as at the date of this DPA:

C.3 Where a United States Sub-processor holds a current DPF certification, the Provider relies on the DPF; the SCCs (Module 3, processor to processor) are maintained or entered into as a fallback, with supplementary measures where a transfer impact assessment shows they are needed (Section 11.3). The bracketed items above are open verification points recorded in the Sub-processor List; they are to be resolved and removed before this DPA takes effect.

C.3a Content sent to the AI Sub-processor. Content sent to OpenAI is processed only to produce the requested output. It is not used to train or improve OpenAI's models, and is retained by OpenAI only for the limited abuse-monitoring period provided in its data processing terms [TO VERIFY: current OpenAI API retention terms — to be confirmed before the AI features are first enabled]. Where the Service's AI features use their booking tools, the results returned to the model include the Customer's service catalogue and prices, its staff records (name, position, work phone and email) and the End Client's appointment records; they do not include the End Client's CRM record, date of birth, gender, spend history, tags, custom fields or free-text client note.

C.3b Sentry — dual regime. Sentry processes diagnostic data primarily in the Provider's own controller capacity (Section 1.4), which falls outside this DPA. To the extent an error report incidentally contains End Client Personal Data, Sentry acts as a Sub-processor and this DPA and the Sub-processor List apply to that data.

C.4 Telegram is not a Sub-processor. Delivery via Telegram occurs from the Customer's own connected Telegram account and constitutes a Customer-directed disclosure, as set out in Section 12.

C.5 Recipients that are not Sub-processors. Stripe processes Customer billing data only — no End Client Personal Data — and falls outside the scope of this DPA (Section 1.4); Stripe's role as an independent controller is described in the Provider's Privacy Policy (privacy-policy.md). Altegio is the Customer's own CRM, engaged by the Customer under the Customer's own agreement with Altegio; it is a source and recipient of End Client Personal Data at the Customer's direction, not a Sub-processor engaged by the Provider — see subprocessors.md, Section 4.4.