Data Processing Agreement

1. What this agreement is

This is the data processing agreement required by article 28(3) of the General Data Protection Regulation (EU) 2016/679. It is an annex to the Terms of Service and is accepted together with them, at the moment the organisation is created.

It is between the Customer as data controller and Piklo Systems, Tjebberupvej 101, 4300 Holbæk, Denmark, company registration number 32709192, as data processor. Where the two documents disagree, this one governs the processing of personal data.

2. Subject matter, duration, nature and purpose

Subject matter. Piklo processes personal data on behalf of the Customer so that the Customer can run its bookings, contact its own customers and take payments — that is, so that the Customer can use the product described in section 2 of the Terms of Service.

Duration. For as long as the Customer has an organisation in Piklo, and afterwards for the period in section 11.

Nature of the processing. Storing, organising, retrieving, transmitting, correcting and deleting; sending email on the Customer's behalf; passing payment details to the payment provider the Customer has connected; operating, maintaining and troubleshooting the service; keeping backups.

Purpose. Only the provision of the service. Piklo does not use the Customer's data for its own purposes, does not sell it, does not share it with anyone but the sub-processors listed in section 8, and does not use it to train models.

3. Categories of data subjects and personal data

Data subjects

• The Customer's own customers — the people who book.
• The Customer's staff and other people it gives access to its organisation.

Personal data

• Contact details: name, email address, phone number, language, and the address of the Customer's own locations.
• Bookings: what was booked, when, with whom, its status and its history, class and course participation, waiting-list entries.
• Notes the Customer's staff write about a customer, in a free-text field. What goes in that field is the Customer's decision, and Piklo neither reads nor structures it.
• Consents: that a person accepted the Customer's booking terms, when, and which version of the wording.
• Payment references: amounts, currency, status, the payment provider's own identifiers and receipt address, and — where a card has been stored for a deposit or a no-show charge — the card's brand and last four digits only.
• Loyalty: points earned and spent, gift cards and multi-visit cards.
• Sign-in details for the Customer's staff: email address and the authentication data behind it.
• Health data — when enabled. Piklo Clinic, which adds a clinical record, does not exist today, and no part of the current product is designed for or intended to hold health data. From the day it exists, the record and the special categories of data in it are covered by this agreement and by any additional terms it requires.

Piklo never receives or stores a full card number, expiry date or security code. Card details are entered on the payment provider's own hosted page and never reach Piklo's systems.

4. The Customer's instructions

Piklo processes personal data only on the Customer's documented instructions. The instructions are the Terms of Service, this agreement, and the Customer's own use of the product — every setting the Customer chooses, every field it fills in, every message it sends and every export it asks for is an instruction.

Piklo tells the Customer if, in Piklo's opinion, an instruction infringes the GDPR or other applicable data protection law, and may suspend the processing concerned until the instruction is withdrawn or confirmed.

Where a legal obligation requires Piklo to process data beyond the Customer's instructions, Piklo informs the Customer of that requirement before processing, unless the law forbids telling them.

5. Confidentiality

Everyone Piklo authorises to process the Customer's personal data is bound by a duty of confidentiality that continues after their work for Piklo ends, whether by employment contract, by a written confidentiality undertaking, or by a professional duty. Access is granted only to those who need it to provide the service or to answer a support request.

6. Security

Piklo implements appropriate technical and organisational measures under article 32. They are set out in annex A to this agreement, which is part of it. Annex A describes the measures that are in place; measures Piklo may add later are not promised here.

Piklo may change a measure for one that is equivalent or better. It does not lower the overall level of protection without telling the Customer.

7. Assistance to the Customer

Taking into account the nature of the processing, Piklo assists the Customer with:

• Requests from data subjects under articles 12 to 22. The product's own screens are the first answer: the Customer can find, correct, export and delete a customer's record itself. Where a request cannot be answered that way, Piklo helps on request. Piklo does not answer a data subject directly on the Customer's behalf; a request that reaches Piklo about one of the Customer's customers is passed to the Customer.
• Security, breach notification and impact assessments under articles 32 to 36, with the information Piklo holds.

Assistance is provided at no charge for requests that are proportionate. Piklo may charge a reasonable fee for repeated or manifestly excessive requests, and says so before doing any work.

8. Sub-processors

The Customer gives Piklo general authorisation to use the sub-processors below. Each is bound by data protection terms no less protective than this agreement.

• Supabase — the database, authentication and file storage. All customer data is held here. Region: EU, Frankfurt (`eu-central-1`).
• Vercel — hosting of Piklo's three web applications, and measuring how they are used: page views and referrers, counted without cookies and without identifying anybody, and reported to the same site the visitor is already on. The application functions run in the EU, Frankfurt (`fra1`); the content delivery network remains global for static files.
• Stripe Payments Europe, Limited, Ireland — payments. Piklo passes the amount, the currency, the description of what was bought and, where it has one, the customer's email address. Card details go directly from the customer's browser to Stripe.
• Resend — sending the emails the product sends on the Customer's behalf, and the sign-in emails for the customer portal. Region: EU, Ireland (`eu-west-1`).
• TOPefekt s.r.o. (trading as BulkGate), B. Němcové 767/13, 787 01 Šumperk, Czech Republic, ID No. 294 44 268 — sending the text messages the product sends on the Customer's behalf. Piklo passes the recipient's mobile number, the text of the message and the sender name. BulkGate hands the message to mobile operators, SMS aggregators and other telecommunications providers in order to deliver it, and its own terms permit transfers to third countries where delivery requires it. Source: BulkGate's Terms and Conditions and its Agreement on Personal Data Processing, read on 5 September 2026 at `bulkgate.com/en/legal/`.
• Sentry. Error reporting for all three applications. Error reports may contain fragments of a request; Piklo's own scrubbing rules remove the headers, cookies and query parameters that could identify anybody before an error leaves the system, session replay is not used, and the SDK is configured not to attach a visitor's IP address or request headers of its own accord.

Changes. Piklo tells the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within those 30 days. If the objection cannot be resolved, the Customer may terminate the agreement with no further payment obligation, and section 11 applies to the data.

9. Transfers outside the EU and the EEA

Personal data is processed outside the EU and the EEA in one place today: by Piklo's suppliers, when their support staff outside the EU handle a fault. Neither the database, the application functions nor the sending of email sits outside the EU.

Those transfers take place under the European Commission's Standard Contractual Clauses, as incorporated in each supplier's own data processing terms, together with the supplementary measures described in annex A — in particular that everything in transit is encrypted and that no supplier outside the EU holds the database.

Piklo does not transfer personal data to a third country without a valid transfer basis.

10. Personal data breaches

Piklo notifies the Customer of a personal data breach affecting the Customer's personal data without undue delay and no later than 48 hours after Piklo becomes aware of it, by email to the organisation's owner.

The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where all of that is not available at once, it is given in stages without further undue delay.

It is the Customer, as controller, who notifies the supervisory authority and, where required, the data subjects. Piklo assists.

11. Deletion and return of data

On termination of the agreement, and at the Customer's choice, Piklo returns or deletes the personal data it processes for the Customer.

The Customer has 30 days from termination to export its data or to ask for it to be returned. Piklo provides it in a commonly used, machine-readable format. After those 30 days the data is deleted from Piklo's live systems.

Copies in the backups of Piklo's suppliers are not deleted individually; they are overwritten as the backups age out. The database backups are kept for 7 days, so a deletion is complete in the backups within 7 days of the deletion itself. Until then those copies are protected by the same measures as the live data and are not used for anything but restoring the service.

The same applies to a single deletion during the agreement: a record the Customer deletes is gone from the live system at once, and out of the backups within 7 days.

Piklo keeps nothing after that, except what a legal obligation requires it to keep and the records of its own invoicing to the Customer, which are Piklo's own data.

12. Audit and documentation

Piklo makes available to the Customer the information needed to demonstrate compliance with article 28 — this agreement, annex A, and the sub-processor list, all published and versioned at this address.

Once a year, and after a personal data breach affecting the Customer, the Customer may ask for further documentation of Piklo's measures. An on-site or hands-on audit is agreed at least 30 days in advance, is limited to what is necessary, must not disrupt the service or reach another customer's data, and is at the Customer's cost. Piklo may satisfy an audit request with an independent report where it has one.

13. Complaints

If you disagree with how Piklo or the Customer processes your personal data, you can complain to a data protection supervisory authority.

Piklo Systems is established in Denmark, and our supervisory authority is Datatilsynet, the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark (datatilsynet.dk).

You can always complain to the data protection authority in the country where you live or work. Overview of all authorities in the EEA: edpb.europa.eu.

14. Liability

Liability under this agreement is governed by section 10 of the Terms of Service, except where the GDPR itself allocates liability between controller and processor, in which case the GDPR applies.

15. How this agreement is entered into and changed

This agreement is accepted electronically, together with the Terms of Service, when the organisation is created. The version accepted, the language it was read in, the person who accepted it and the date are recorded, and the organisation can see them under Settings → Subscription at any time.

Piklo may change this agreement with 30 days' notice by email, on the same terms as section 12 of the Terms of Service. A change that would lower the level of protection requires the Customer's agreement.

This agreement is available in several languages. The English version is the binding one; a translation is provided for convenience, and in case of any discrepancy the English version prevails.

Annex A — technical and organisational measures

This annex describes what is in place. It is deliberately specific, and it does not claim measures the product does not have.

Access control in the database

• Row level security is enabled on every table in the application schema, without exception. A table with no policy grants nothing to anyone.
• Access is scoped to the organisation a person is a member of. A member of one organisation cannot read another organisation's rows, and there is no query that crosses organisations.
• Roles inside an organisation — owner, administrator, staff — decide what a member may read and change. Billing and subscription data is readable by owners and administrators only.
• The public booking page has no session and no general read access. Everything a visitor can see or write goes through a small number of named database functions with narrow arguments, each granted explicitly. Functions are created without permissions and given exactly the ones they need, with the reason written next to the grant; an automated check in the build fails if a function is left open.
• A small number of operations run with a service credential that bypasses row level security — sending reminders, recording the result of a message, writing a payment after the provider's webhook. Each is a named function, none touches a table directly, and the credential is never present in anything sent to a browser.

Encryption

• All traffic is over HTTPS/TLS, including between Piklo and every sub-processor.
• The database and the backups are encrypted at rest by the database provider.
• Session cookies are set by Piklo for Piklo's addresses only, marked `SameSite=Lax` so they are not sent from other sites, and travel over HTTPS. They are not marked `HttpOnly`, because the sign-in library reads them in the browser; the privacy policy names each one.

Logging

• An append-only audit log records overrides of the booking rules and reversals of a booking's status: who, when, on what. No client can write to it, and it has no update path.
• Every email the product sends is logged with its recipient, its template, its result and the provider's own reference, so a failed message is visible to the Customer rather than silent.
• The database provider retains platform and authentication logs for 7 days; the hosting provider retains runtime logs for 1 day. Neither is under Piklo's control beyond the choice of plan.

Payment data

• Piklo never receives a full card number, an expiry date or a security code. Payment pages are hosted by the payment provider.
• What Piklo stores about a stored card is the brand and the last four digits, so that a person can recognise which card it is.
• Money moves directly to the Customer's own account with the payment provider. Piklo does not hold funds.

Backups

• The database provider takes a backup daily and keeps it for 7 days on Piklo's current plan.
• Backups are encrypted at rest and are used only to restore the service.

Development and operation

• Changes reach production through a version-controlled repository and an automated pipeline that runs the test suite and a set of guards on every change. A red pipeline does not deploy.
• Credentials are held as environment secrets at the hosting provider, are write-only there, and are not in the repository.
• Database schema changes are written as migrations, reviewed as text and applied deliberately.

What is not in place today, and is therefore not claimed

• There is no two-factor authentication on staff accounts.
• There is no independent security certification and no penetration test report.
• There is no service level agreement and no guaranteed uptime.