Version 1.3, in force since Oct. 28, 2026.
This agreement governs how DameHora processes the personal data of the business's customers and team on the business's behalf, in line with Article 28 of the General Data Protection Regulation (GDPR). It forms part of the terms of service and is accepted by the business's owner on its behalf.
1. Parties
- Controller, the business that uses DameHora.
- Processor, Teodoro Salas García, tax ID 43141584R, holder of DameHora, email info@damehora.com.
2. Subject matter, nature, purpose and duration
DameHora processes the data only to provide the business with the calendar, online booking, customer records, payments, notices and reminders service, for as long as the subscription and the read-only period that follows it last.
The operations are those the service needs. Collecting the data the business and its customers enter, recording, organising, storing, consulting and modifying it, sending it to the customer and the team by email or in app notifications, showing it in the app, backing it up and deleting it.
3. Data and data subjects
- Data subjects, the business's customers and its team members.
- Customer data, their name, phone, email, appointments, services, payments, history and any notes the business decides to record.
- Team data, their name, email, schedules, absences, services they provide and activity in the app.
- If the business records health data, for example allergies, it is a special category of data. Besides a basis under Article 6 GDPR, the business needs an exception under Article 9(2), for example the customer's explicit consent, and is responsible for having it. DameHora processes it only under this agreement and with the same measures as the rest. The public booking form does not ask for health data.
4. Instructions
DameHora processes the data only on the business's documented instructions, which are those it gives by using the app and those in this agreement. If an instruction seems to it to infringe data protection law, it will tell the business immediately. DameHora does not use this data for its own purposes, except for the processing in section 9, which it carries out as a controller and which is not part of this agreement.
5. Confidentiality
DameHora ensures that the people who access the data have committed to confidentiality or are under a statutory obligation of confidentiality.
6. Security
DameHora applies the measures of Article 32 GDPR, among them encrypted connections, encrypted passwords, separation of each business's data, role-based permissions, logging of important actions, a database that cannot be reached from the internet, regular backups in the European Union and limited support access, read-only, with a reason and logged.
7. Assistance to the business
- DameHora helps the business respond to requests for access, rectification, erasure, objection, restriction and portability from its customers and team.
- It helps it, where relevant, with impact assessments and consultations with the supervisory authority.
- It makes available the information needed to demonstrate compliance with this agreement.
8. Personal data breaches
DameHora will notify the business without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting its data. It will provide the information available about what happened, the data and people affected, the likely consequences and the measures taken or proposed, and will complete it as it becomes available.
9. What DameHora processes as a controller
DameHora carries out, as a controller and not as a processor, this processing with some calendar data, and explains it to customers in its privacy policy:
- The overall security of online booking and the prevention of abuse, for example checking the email of the person booking with a code and stopping automated or repeated bookings. It uses the booking's contact details and technical data, such as a fingerprint of the IP address.
- Verified reviews, which means inviting those who allow it when booking to review their visit, publishing their review and moderating it. It uses their name, their email and the completed appointment.
Beyond this processing, the security measures DameHora applies to the business's data are part of this agreement.
10. Sub-processors
The business authorises DameHora to use these sub-processors, all under contract and with obligations equivalent to those in this agreement:
- Hetzner Online GmbH (Gunzenhausen, Germany). Hosts the servers, the database and the backups. It processes all the service's data, only in its European Union data centres, and makes no transfers.
- Mailjet SAS (Paris, France), part of the Sinch group. Sends emails to customers and the team. It processes the name, email and content of each message, stored in Google Cloud data centres in Germany and Belgium. A company of its group in the United States and some support providers may access it, under the European Commission's standard contractual clauses and, for that company, also the EU-US Data Privacy Framework.
- Google, with Firebase Cloud Messaging. Delivers the app's notifications to the team devices that turn them on. It processes the device identifier and the content of the notification, for example a new appointment, and may do so in any country where Google has facilities, under the EU-US Data Privacy Framework for the United States and the standard contractual clauses for other countries. On iPhone and iPad, the notification arrives through Apple's notification service.
These are not sub-processors under this agreement, because they do not process the business's data on its behalf:
- Google reCAPTCHA, which DameHora uses for its own booking security (section 9).
- Stripe, which charges the business its subscription with DameHora.
- Google Maps, which receives the address of the locations when the business places them on the map, as an independent controller.
- Bilteo, which the business subscribes to and connects on its own account for invoicing. DameHora sends it the data of each sale on the business's instruction.
DameHora will notify the business of any new sub-processor at least 30 days in advance, and the business may object on reasonable grounds. If no agreement is reached, it may cancel.
11. Audits
DameHora allows and contributes to audits and inspections carried out by the business or an auditor it appoints, with reasonable prior notice, during working hours and without access to other businesses' data.
12. The business's obligations
To provide DameHora with the data needed for the service, inform its customers and team of the processing, have a legal basis for the data it keeps and supervise the processing.
13. End of the processing, return and deletion
When the subscription ends, the business has 90 days of read-only access to review its data and ask for a copy, which DameHora will deliver in a structured format. If it prefers, it can ask us to delete it earlier. When that period ends, DameHora deletes it and asks its sub-processors to delete what they keep. It disappears from the backups at most 15 days later, and if a backup had to be restored before then, DameHora would apply the deletions again. What a law requires to be kept is stored blocked for the legal period and not used for anything else.