Data processing agreement

Updated: 26 October 2026

1. Parties and subject matter

This Data Processing Agreement (DPA) applies between the Business as controller and Reka Digital — Blendion Reka, Marktgasse 46, 4900 Langenthal, Switzerland, as processor ("Vilenno"). It forms part of the Terms of Service and governs the processing of personal data on behalf of the Business under Art. 9 FADP and, where applicable, Art. 28 GDPR. It applies for the term of the contract for the use of Vilenno.

2. Nature, purpose and scope

Vilenno processes the data exclusively to provide the agreed features to the Business: online booking, calendar, customer management, notifications, payments and vouchers, data export, and backup and restore.

Data subjects: customers and prospective customers of the Business, staff of the Business.
Types of data: contact data (name, email address, phone number), appointment and booking data, notes, consents, attendance and cancellation history, payment and voucher references, messages sent, and working hours, profile details and photos of staff.

Sensitive personal data, for example health data, does not belong in note fields unless the Business ensures it is lawful.

3. Instructions

Vilenno processes the data only on documented instructions from the Business. The instructions follow from the Terms, this DPA and the Business's settings and actions in the service. If Vilenno considers an instruction unlawful, it informs the Business.

4. Confidentiality

Persons at Vilenno with access to the data are bound by confidentiality. Vilenno accesses customer data only where necessary for operation, support or security.

5. Technical and organisational measures

Hosting in a data centre in Germany (EU)
encrypted transmission (HTTPS with HSTS)
strict separation of data per business through a tenant-bound data access layer
role-based access rights and mandatory two-factor sign-in for owners and administrators
logging of security-relevant actions
daily backups encrypted with AES-256-GCM, with rotation
restrictive firewall and administrative access only with keys or two-factor sign-in

Vilenno may adapt these measures to the state of the art without lowering the level of protection.

6. Sub-processors

The Business approves the service providers listed below under "Sub-processors and recipients". Vilenno contractually binds them to an equivalent level of data protection. Vilenno announces new or replacement sub-processors by email at least 30 days in advance. The Business may object for an important data protection reason; if no solution is found, it may terminate the contract effective on the date of the change.

7. Assistance

Vilenno assists the Business with requests from data subjects, in particular through the export and anonymisation features in the service, and within reason with data protection impact assessments and requests from authorities. Requests received directly by Vilenno are forwarded to the Business.

8. Personal data breaches

Vilenno notifies the Business of personal data breaches affecting its data without undue delay, where possible within 48 hours of becoming aware of them. The notification includes the available information on the nature, scope, likely consequences and measures taken.

9. Audit rights

On request, Vilenno provides the Business with the information needed to demonstrate compliance with this DPA. On-site audits are possible with reasonable notice, during business hours and at the Business's expense.

10. Location of processing

The data is stored in Germany. Processing outside Switzerland and the EU/EEA only takes place where adequate data protection or appropriate safeguards such as standard contractual clauses are in place. This currently concerns Stripe for payments.

11. Return and deletion

The Business can export its data at any time during the term. After the contract ends, Vilenno deletes the data once the 30-day export period has expired, unless a legal retention obligation applies. Encrypted backups are overwritten within at most 6 months.

12. Liability and precedence

Liability is governed by the Terms of Service. In the event of conflict between the Terms and this DPA, this DPA prevails on data protection matters.

Optional services are used only for businesses actively using the relevant channel: - seven communications GmbH & Co. KG (seven.io), Germany: SMS delivery; alternatively Twilio Ireland Limited, Ireland, only when configured - Meta Platforms Ireland Limited, Ireland: WhatsApp Business and Instagram messaging when the respective channel is used - Anthropic, PBC, USA: AI reception including trial chat, only when AI is used.

Without use of a channel, no data is sent to its provider for that purpose. Conversation retention follows the business configuration. Trial chats must contain fictional personal details only.

Sub-processors and recipients

Hetzner Online GmbH, Gunzenhausen, Germany: hosting, database, files and encrypted backups (data centre in Germany)
Brevo (Sendinblue SAS), Paris, France: sending emails
Stripe Payments Europe, Limited, Dublin, Ireland: payments, deposits and subscription billing; possible transfer to affiliates in the USA based on appropriate safeguards
Migadu-Mail GmbH, Schachen, Switzerland: mailbox for requests to info@vilenno.com
Push services of browser vendors (for example Google, Apple, Mozilla, Microsoft): encrypted delivery of push notifications to staff who enable them

Without use of a channel, no data is sent to its provider for that purpose. Conversation retention follows the business configuration. Trial chats must contain fictional personal details only.

Operator: Reka Digital — Blendion Reka, sole proprietorship (Switzerland), UID CHE-134.630.731, Marktgasse 46, 4900 Langenthal, Switzerland. Email: info@vilenno.com