1. Scope & Applicability
This Data Processing Addendum (“DPA”) supplements the Slotwise Terms of Service entered into betweenSlotwise, Inc. (“Slotwise”) and the customer organization or team (“Customer”).
This DPA applies whenever and to the extent that Slotwise processes personal data on behalf of Customer in the course of providing calendar booking, team round-robin routing, and custom domain scheduling services subject to Applicable Data Protection Law (including the EU GDPR, UK GDPR, and India DPDP Act 2023).
2. Roles of the Parties
Customer as Data Controller / Fiduciary
Customer is the Data Controller (under GDPR) or Data Fiduciary (under DPDP) with respect to attendee personal data collected through Customer's published scheduling links.
Slotwise as Data Processor
Slotwise acts as a Data Processor on Customer's behalf, processing attendee names, emails, and booked timestamps strictly in accordance with Customer's configured settings.
3. Documented Instructions
Slotwise shall process personal data solely on documented instructions from Customer, including regarding transfers of personal data, unless required to do so by applicable statutory law. The Terms of Service and Customer's active dashboard configurations constitute Customer's complete, documented processing instructions.
4. Technical & Organizational Measures (TOMs)
Slotwise implements and maintains appropriate technical and organizational measures designed to protect customer personal data against accidental, unauthorized, or unlawful access, alteration, disclosure, or destruction:
- Pseudonymization & Encryption: All sensitive tokens encrypted with AES-256-GCM; database traffic TLS 1.3 enforced.
- Resilience & Restorability: Automated daily backups with point-in-time recovery capabilities.
- Access Control: Strict least-privilege administrative access guarded by multi-factor authentication.
5. Sub-processor Governance
Customer grants Slotwise general written authorization to engage third-party sub-processors to support infrastructure operations (e.g. Cloudflare, Stripe, transactional email systems). Slotwise imposes data protection terms on each sub-processor that are no less protective than those contained in this DPA.
6. Data Incident Notification (72-Hour SLA)
In the event of a confirmed Personal Data Breach affecting Customer personal data, Slotwise shall notify Customer without undue delay and, where feasible, not later than 72 hours after becoming aware of the incident, providing details regarding the nature of the breach, affected records, and remedial actions taken.
7. Audits & Data Subject Rights Assistance
Taking into account the nature of the processing, Slotwise assists Customer by providing technical features (such as dashboard deletion, export tools, and cancellation endpoints) enabling Customer to respond to Data Subject / Data Principal requests.
8. DPA Execution & Legal Contact
If your organization requires a countersigned enterprise copy of our Data Processing Addendum with EU Standard Contractual Clauses (SCCs):
Slotwise Legal & Enterprise Contracts
Direct address for custom enterprise addenda, procurement questionnaires, and security schedules.