Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is part of the Terms and Conditions between the business that uses Moneo (the "Controller", "you") and [Legal name], a sole proprietor, [Address], North Macedonia (the "Processor", "we"). You accept it when you create an account.

It applies to the personal data we process on your behalf when we provide the Service. Our Privacy Policy covers the data for which we are the controller, such as your account and billing details.

2. Subject matter and duration

Subject matter: providing the Service, which means keeping your client records and appointments, sending SMS reminders, renewal notices and follow-ups, and reporting their delivery.

Duration: as long as your account is open, and afterwards until the data is deleted as described under "Deletion or return".

3. Nature and purpose of processing

We store, organise, display, transmit by SMS or email, and delete personal data, only to provide the Service to you. We do not use it for our own purposes, sell it or use it for advertising.

4. Data subjects and categories of data

Data subjects: your clients (for example patients or customers) and the members of your team.

Client data: names, mobile numbers, SMS language, appointments (date, time, service, staff member), expiry dates and reference numbers such as a plate or policy number, notes, and the text and delivery status of each SMS.

Team data: names, email addresses, roles and working hours.

Special categories: a clinic's appointments, services or notes may reveal health information. You are responsible for having a legal basis for it and should enter only what the reminders need.

5. Your instructions

We process the data only on your documented instructions: these terms, this DPA and the way you set up and use Moneo. If we think an instruction breaks data protection law, we will tell you.

If the law requires us to process the data in another way, we will tell you first, unless the law forbids it.

6. Confidentiality

Everyone who can access the data on our side is bound by confidentiality, by contract or by law.

7. Security

We protect the data with technical and organisational measures that fit the risk, including:

Hosting in the European Union, on Microsoft Azure in the West Europe region (Netherlands).

Encryption in transit (HTTPS/TLS) and at rest (Azure's encrypted database and storage).

Access control: each business can see only its own data, every request is checked, passwords are hashed, and access to the production systems is limited to the people who run Moneo.

Automated database backups, kept in the EU.

8. Sub-processors

You allow us to use the following sub-processors. Each is bound by a contract with data protection obligations at least as strict as this DPA.

Microsoft Azure (Microsoft Ireland Operations Ltd): hosting and database, in the EU (West Europe).

GatewayAPI (Denmark) and BulkGate (Czech Republic): sending SMS. They receive the phone number and the text of each SMS.

Resend (United States): sending emails to your team, such as invitations, password resets and usage alerts.

Paddle (Paddle.com Market Ltd, United Kingdom): billing, as our reseller and merchant of record. Paddle handles your business's billing details and never receives your clients' data.

We will tell you at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds and we cannot address it, you may cancel the Service before the change.

9. Transfers outside the EU

The data is stored in the EU. Where a sub-processor is in the United Kingdom or the United States, the transfer relies on an adequacy decision or on Standard Contractual Clauses approved by the European Commission.

10. Helping you with requests

Most requests from your clients can be handled in the app: you can correct or delete a client, and mark them as opted out of SMS. If you need more help to answer a request to access, correct, delete, restrict or port data, we will assist you.

If a data subject contacts us directly about data you control, we will forward the request to you without answering it ourselves.

We will also give you reasonable help with data protection impact assessments and consultations with a supervisory authority.

11. Personal data breaches

If we become aware of a breach affecting your data, we will notify you without undue delay and in any case within 48 hours.

We will tell you what we know: what happened, which categories and roughly how many people and records are affected, the likely consequences, and what we have done or propose to do. We will keep you updated and help you meet your own duty to notify the authority and the people affected.

12. Deletion or return

Before your account is closed, you can ask us for a copy of your clients' data in a common format such as CSV.

After the account is closed, we delete the data within 90 days. Copies in backups are overwritten in the normal backup cycle. We keep data longer only where the law requires it.

13. Audits

We will give you the information you need to show that we meet this DPA. You, or an independent auditor bound by confidentiality, may audit our compliance once a year, or more often after a breach or when a supervisory authority asks, with at least 30 days' notice. Audits are at your own cost and must not disrupt the Service or expose other customers' data.

14. Liability and precedence

The limits of liability in our Terms and Conditions also apply to this DPA, as far as the law allows. If this DPA and the Terms disagree on the protection of personal data, this DPA prevails.

15. Contact

Questions about this DPA or a data protection request: info@moneo.mk.