Data Processing Agreement (DPA)

Between the customer under the Terms of Service, hereinafter “controller”,

and roblens Media as the provider of Timeveo, hereinafter “processor”. Full provider details are in the Imprint.

This agreement gives effect to the obligations under Art. 28 GDPR for the processing of personal data that the processor carries out on behalf of the controller under the service contract. It forms part of the Terms of Service and is incorporated in text form on completion of registration, which satisfies the form requirement of Art. 28(9) GDPR.

Where this agreement and the Terms of Service conflict, this agreement prevails on questions of data protection.

1. Subject matter and duration

1.1 The subject matter is the processing of personal data by the processor in the course of providing and operating the Timeveo software.

1.2 The duration corresponds to the term of the service contract. This agreement ends when that contract ends, subject to section 11.

2. Nature and purpose of the processing

Processing covers collecting, recording, organising, storing, adapting, retrieving, consulting, using, transmitting to the services selected by the controller, restricting, erasing and destroying personal data. The purpose is exclusively to provide the contractually agreed services, in particular appointment booking and calendar management, customer management, sending notifications, payment and point-of-sale functions, and reporting for the controller.

The processor does not process the data for its own purposes.

3. Categories of data subjects

• the controller’s clients and, where recorded, persons accompanying them
• the controller’s staff who use the application or appear in its planning
• prospective clients who have started the booking process

4. Categories of personal data

• Master data: name, form of address, address, email address, phone number, and date of birth where recorded
• Appointment and transaction data: services booked, times, assigned staff, status, history
• Communication data: content and delivery status of email, SMS and WhatsApp messages
• Contract and payment reference data: invoice items, payment status, payment references. Full payment card details are not stored in Timeveo; they remain with the respective payment provider.
• Consent records: time, purpose, origin and withdrawal of a consent
• Usage and log data: time and type of operations, acting account
• Free-text entries the controller records itself, such as notes about clients or answers in its own forms

Special categories under Art. 9 GDPR: the application provides no mandatory fields for such data. If the controller records it anyway, for instance as a treatment note or in its own form, the processor processes it under this agreement. The legal basis under Art. 9(2) GDPR and the necessity of collecting it are the controller’s sole responsibility.

5. Instructions

5.1 The processor processes personal data only on documented instructions from the controller, unless required to process by Union or Member State law. In that case the processor informs the controller of the legal requirement before processing, unless that law prohibits it.

5.2 The settings the controller makes in the application, together with this agreement and the service contract, constitute documented instructions. Further individual instructions are given by the controller in text form to the contact address in the Imprint.

5.3 If the processor considers an instruction unlawful, it says so without undue delay. It may suspend execution until the controller confirms or amends the instruction.

6. Confidentiality

The processor engages only persons who are bound to confidentiality or under an appropriate statutory obligation of secrecy, and who have been familiarised with the relevant data protection rules. The obligation continues after their work ends.

7. Technical and organisational measures

7.1 The processor implements the measures described in Annex 1 under Art. 32 GDPR and maintains them for the term of the agreement.

7.2 The measures are subject to technical progress. The processor may develop them further as long as the agreed level of protection is not reduced. It documents material changes and presents them on request.

8. Subprocessors

8.1 The controller grants general authorisation to engage subprocessors under Art. 28(2) sentence 1 GDPR. The subprocessors engaged at the time of conclusion are listed in Annex 2 and are published on an ongoing basis at https://legal.timeveo.com/en/subunternehmer.

8.2 The processor announces the engagement of a new subprocessor, or the replacement of an existing one, at least 30 days before activation in text form to the administrator address stored in the account.

8.3 The controller may object within the notice period on important data protection grounds. If the objection cannot be resolved within a reasonable period, either party may extraordinarily terminate the service contract with effect from the intended date of the change.

8.4 The processor contractually binds every subprocessor to data protection obligations equivalent to those in this agreement and remains responsible to the controller for their compliance.

8.5 Ancillary services the processor obtains from third parties without those parties having intended access to personal data from the platform, such as telecommunications services or equipment maintenance, do not constitute subprocessing.

9. Assistance to the controller

9.1 The processor assists the controller with appropriate technical and organisational measures in responding to requests to exercise data subject rights under Art. 12 to 23 GDPR. For this purpose it provides an access export and erasure functions in the application.

9.2 If a data subject contacts the processor directly, the processor forwards the request to the controller without undue delay and does not answer it itself.

9.3 The processor assists the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular the security of processing, notifications to the supervisory authority and to data subjects, and data protection impact assessments, taking into account the nature of processing and the information available to it.

9.4 Assistance going significantly beyond the contractually owed functional scope and requested by the controller may be charged by the processor on a time and materials basis, after notice and with the controller’s agreement.

10. Personal data breaches

10.1 The processor notifies the controller of any personal data breach that comes to its attention without undue delay, and in any event within 48 hours of becoming aware, in text form.

10.2 The notification contains, where available, the information required by Art. 33(3) GDPR: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, a contact point for further information, the likely consequences, and the measures taken or proposed.

10.3 The processor takes appropriate measures without undue delay to secure the data and to mitigate possible adverse effects, and documents the incident.

11. Deletion and return

11.1 The controller may export its data at any time during the term through the application’s export functions.

11.2 After the service contract ends, export remains possible for 30 days. The processor then deletes the personal data within 90 days, including existing copies in backups within the respective backup cycles.

11.3 Excluded from deletion is data subject to statutory retention duties, in particular till, invoice and accounting data under AO, HGB and KassenSichV. That data is restricted in processing until the periods expire and deleted afterwards.

11.4 On request the processor confirms deletion in text form.

12. Evidence and audits

12.1 On request the processor demonstrates compliance with this agreement through appropriate documentation, in particular documentation of the measures in Annex 1 and self-assessment.

12.2 Where that evidence is insufficient, the controller may carry out checks itself or through an auditor bound to secrecy who is not a competitor of the processor. The audit is announced with reasonable notice of at least four weeks, takes place during normal business hours, disrupts operations as little as possible, and takes place at most once a year unless there is specific cause.

12.3 The controller bears the cost of such an audit unless the audit reveals a material breach by the processor.

13. Transfers to third countries

Processing outside the European Union or the European Economic Area takes place only where the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision, the European Commission’s Standard Contractual Clauses, or the EU-US Data Privacy Framework. Which safeguard applies to which service is set out in Annex 2.

14. Liability and final provisions

14.1 Art. 82 GDPR governs liability. Otherwise the liability provisions of the Terms of Service apply.

14.2 Amendments to this agreement require text form. Section 12 of the Terms of Service applies accordingly to amendments.

14.3 German law applies. The language of the contract is German; translations are for information only.

14.4 Should any provision be invalid, the validity of the remaining provisions remains unaffected.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

As at 20 August 2026. A plain-language version is on the Security page.

1. Confidentiality

Physical access control. The application runs in the data centres of a professional hosting provider in France. Physical access is controlled by that provider; the processor operates no server rooms of its own.

System access control. Administrative access to the systems is exclusively through personal key pairs, not passwords. Access to the application requires a sign-in with username and password; passwords are stored only as hashes. Two-factor authentication is available. Sign-in and verification attempts are rate limited.

Data access control. Within each tenant a role and permission system governs which accounts may use which areas and operations. Permissions can be granted per area. The processor’s access to tenant data is limited to what is necessary for operation and support.

Separation control. The application is multi-tenant. Every record belongs to one tenant, and access is restricted to the active tenant centrally and automatically rather than in each individual query. Automated tests check this separation continuously and flag cross-tenant access as a failure.

Pseudonymisation and data minimisation. In the outbound API logs, credentials and sensitive content are stripped according to a fixed rule before the entry is stored.

2. Integrity

Transfer control. All traffic between browser, application and connected services is encrypted with TLS. Security-relevant credentials for connected services are additionally encrypted at the application layer.

Input control. Security and privacy relevant operations are logged with timestamp, acting account and affected record, so it remains traceable who entered, changed or removed which data and when.

3. Availability and resilience

Operations run on professionally administered infrastructure with protection against overload and network-level attacks through an upstream service. Database backups are taken regularly; the backup and restore concept is being documented and will be added to the next version of this annex with concrete intervals.

4. Procedures for review and evaluation

Engagement control. Subprocessors are selected, contractually bound and disclosed in Annex 2; changes are announced.

Change and release process. Changes to the application are version controlled, reviewed by a second pair of eyes, and covered by an automated test suite that must pass in full before anything is merged into the main branch. Static analysis runs across the domain modules in addition.

Data protection by default. Marketing messages are sent only where consent for the respective purpose is on record. Consents are stored with time, purpose and origin so they can be demonstrated; withdrawals take effect immediately. Logs and consent records are deleted automatically once their retention period expires.

Annex 2: Subprocessors

The binding, continuously updated version of this annex is at https://legal.timeveo.com/en/subunternehmer. Below is the state as at 20 August 2026.

Version 1.0, effective 20 August 2026.