Data processing agreement

1. Parties and roles

Controller: the customer organisation that accepted the Terms and conditions ("Customer").

Processor: Viallo s. r. o., Šustekova 3697/49, 851 04 Bratislava – Petržalka, Slovak Republic, IČO 57 859 043 ("Processor").

Terms not defined here have the meaning given in the GDPR (Regulation (EU) 2016/679) and in our Terms and conditions. If this agreement and the Terms conflict on data protection, this agreement prevails.

2. Subject matter, nature and purpose

The Processor processes personal data only to provide the booking service to the Customer: user accounts and sign-in, desk and parking bookings, check-in, carpooling, team visibility, notifications, support, and the security and operation of the service.

3. Processing on documented instructions

The Processor processes personal data only on the Customer's documented instructions. The Terms, this agreement and the Customer's configuration of the workspace (for example check-in rules, allowed email domains, sign-in methods) are the Customer's complete instructions. Further instructions must be given in writing.

The Processor tells the Customer immediately if it believes an instruction infringes data protection law. If the law requires processing beyond the instructions, the Processor informs the Customer before processing unless the law prohibits it.

4. Confidentiality

Everyone at the Processor with access to personal data is bound by confidentiality, receives appropriate instruction in data protection, and has access only as far as their role requires.

5. Security of processing

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, costs and risks. The current measures are listed in the annex at the end of this agreement. The Processor may update them as long as the overall level of protection does not decrease.

6. Sub-processors

The Customer gives general authorisation for the Processor to engage sub-processors. The current list:

The Processor notifies the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if no solution is found, the Customer may terminate the affected service with a pro-rata refund of prepaid fees.

The Processor imposes data protection obligations on each sub-processor that are equivalent to this agreement, and remains responsible to the Customer for their performance.

7. Transfers outside the EEA

Personal data is hosted in the European Union. A transfer outside the European Economic Area happens only where an adequacy decision applies or with appropriate safeguards under Chapter V GDPR, such as the European Commission's standard contractual clauses.

8. Assistance to the Customer

Taking into account the nature of the processing, the Processor assists the Customer:

• in responding to data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). Requests received directly are forwarded to the Customer without undue delay;
• with security, breach notification, data protection impact assessments and prior consultation with the supervisory authority (Articles 32 to 36 GDPR).

Reasonable assistance is included in the subscription. Extensive assistance beyond what the service ordinarily provides may be charged at agreed rates.

9. Personal data breaches

The Processor notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed. Information is provided in stages if not all of it is available at once.

10. Deletion and return of data

When the contract ends, the Processor deletes the Customer's personal data within 30 days, unless Union or Slovak law requires storage. Before that, the Customer may request an export in a common machine-readable format.

11. Demonstrating compliance and audits

The Processor makes available the information necessary to demonstrate compliance with Article 28 GDPR, primarily by answering written security questionnaires and providing documentation of its measures.

Where this is not sufficient, the Customer may carry out an audit, or have one carried out by an independent auditor bound by confidentiality, once per year with at least 30 days' notice, during business hours and without disrupting operations. Each party bears its own costs, unless the audit reveals a material breach by the Processor.

12. Liability and term

Liability under this agreement follows Article 82 GDPR and the limitations in the Terms and conditions, to the extent the law permits.

This agreement applies for as long as the Processor processes personal data on the Customer's behalf.

13. Annex: technical and organisational measures

Confidentiality

• All traffic encrypted in transit with TLS; plain HTTP redirects to HTTPS.
• Logical separation of each customer's data: every database query is scoped to the organisation it belongs to, enforced centrally in the application's data layer and covered by automated tests.
• Passwords stored only as salted hashes; optional sign-in with Google or Microsoft.
• Session cookies are HTTP-only, secure and bound to the customer's own address.
• Server access only with SSH keys, with password login disabled; firewall allowing only web and SSH traffic.
• Access to production limited to named personnel who need it.

Integrity

• Changes to the application are tested automatically and deployed through a controlled pipeline, never edited by hand on servers.
• Database schema changes are versioned migrations.
• Input validation on every API request; rate limiting on sign-in and password reset.

Availability and resilience

• Operating system security updates applied automatically.
• Automated health checks run after every deployment, and failures are reported.
• Database backup schedule, encryption and retention, and restore testing

Regular testing and evaluation

• Automated test suites verifying tenant isolation, sign-in rules and booking rules run before release.
• Measures reviewed at least once a year and after any significant incident.