slotmein

Data Processing Addendum (DPA)

The Processor is Whitney Solutions LLC, a limited liability company formed in the State of Idaho, USA.

1. Roles & scope

Controller determines purposes and means of processing attendee and host personal data through the Service; Processor processes it solely on Controller's documented instructions (which are: operate the Service per the Terms) and this DPA.

2. Processing details (Annex I)

  • Subjects: the Controller's hosts/admins; attendees who book or submit forms; anyone who exchanges SMS messages with the Controller through the Service.
  • Categories: name, email, telephone number, timezone, language, booking times and answers, routing-form answers, the full text of SMS messages sent to or from the Controller through the Service, encrypted calendar credentials of hosts, payment status (no card data), and IP addresses processed for rate limiting.
  • Special categories: none intended; Controller shall not direct processing of any. Note that free-text fields (booking answers, SMS message bodies) accept whatever a data subject types, and the Controller is responsible for not soliciting special-category data through them.
  • Duration: the term of the Terms plus the deletion window below.

2.1 Processing by an AI subprocessor

Where the Controller enables the AI receptionist, the Processor transmits the text of the relevant SMS conversation to the AI subprocessor identified in the Privacy Policy §3 for the sole purpose of generating a reply. Phone numbers and contact names are not transmitted. The Controller enables this feature at its own discretion and is responsible for having a lawful basis for it; it is off by default.

2.2 Controller-configured destinations

The Controller may direct the Service to transmit personal data to systems the Processor does not select, namely outbound webhook endpoints and CalDAV calendar servers of the Controller's choosing. Those are transfers made on the Controller's instruction to recipients of the Controller's own choosing; the Processor does not assess them and they are outside the subprocessor list in §4.

3. Processor obligations

Confidentiality of personnel; security measures per Annex II; assistance with data-subject requests (Controller can answer access and erasure requests without contacting the Processor, from Admin → Privacy in the dashboard, or programmatically via GET /v1/admin/attendees/:email/export and DELETE /v1/admin/attendees/:email; the same screen exports all of Controller's data and deletes the account); assistance with DPIAs and supervisory consultations; breach notification to Controller without undue delay and within 48 hours of awareness; deletion or return of personal data within 30 days of termination (backups purged on rotation, within the retention window in Annex II).

4. Subprocessors

Controller authorizes the subprocessors listed in the Privacy Policy §3 table. Processor will notify Controller 30 days before adding or replacing a subprocessor; Controller may object on reasonable data-protection grounds.

5. International transfers

Where personal data is transferred outside the EEA/UK, the parties rely on the EU Standard Contractual Clauses (Module Two), incorporated by reference, together with the UK International Data Transfer Addendum.

6. Audits

Processor will make available information reasonably necessary to demonstrate compliance and allow audits once annually, on 30 days' written notice, during business hours, at Controller's cost, and without access to other customers' data.

Annex II — Technical & organizational measures

TLS in transit; AES-256-GCM encryption of calendar credentials at rest; hashed login tokens; signed, unguessable manage links; org-scoped authorization on every admin API; rate limiting; least-privilege service-to-service secrets; immutable audit trail via database timestamps.

Backups. The database is dumped nightly. Every dump is verified by restoring it into a throwaway database and comparing per-table row counts against the source before it is kept, so an archive that cannot be restored is detected on the night it is written rather than during an incident. Dumps are retained for 14 days, and the most recent dump is never deleted by the retention rule. The key that decrypts stored calendar credentials is held separately from the dumps, so a backup on its own does not disclose them.

Access control. Production database access is limited to the Processor's own named operator accounts. Application services authenticate to one another with per-service secrets rather than shared credentials, and no subprocessor in §4 is granted standing access to the database.

Incident response. Suspected incidents are triaged on discovery: the affected credential or integration is disabled first, scope is established from the audit trail, and Controllers are notified under §3. Credentials that may have been exposed are rotated as part of closing out the incident, not after it.