Data Processing Agreement pursuant to Art. 28 GDPR

Version of 2 October 2026

between

the respective customer of the BookinX service, whose name or company name, address and contact details are provided during registration or contract administration,

hereinafter "Client" or "Controller",

and

Robert F. Craciun

Girardigasse 4/28

1060 Wien

Austria

Phone: +436641664446

E-mail: robert@x-orbit.app

Operator of the service BookinX and Xorbit

hereinafter "Contractor" or "Processor".

Together hereinafter the "Parties".

This Data Processing Agreement including its annexes is hereinafter referred to as the "DPA" (German: AVV, Auftragsverarbeitungsvertrag).

⸻

1. Subject Matter and Scope

1.1. The Contractor provides the Client with the appointment booking service BookinX. With BookinX, the Client can in particular set up booking pages, manage appointments and enable its end customers and prospects to book appointments.

1.2. Insofar as the Contractor processes personal data on behalf of the Client in the course of providing BookinX, the Client acts as controller pursuant to Art. 4(7) GDPR (German: DSGVO) and the Contractor as processor pursuant to Art. 4(8) GDPR.

1.3. This DPA specifies the data protection rights and obligations of the Parties and forms part of the main contract existing between the Parties on the use of BookinX.

1.4. This DPA applies exclusively to processing activities in which the Contractor processes personal data on behalf of the Client.

1.5. Insofar as the Contractor processes personal data for its own purposes and under its own responsibility under data protection law, in particular for contract administration, billing, IT security or compliance with its own legal obligations, these processing activities are not the subject of this DPA. They are governed by the BookinX Privacy Policy and the applicable statutory provisions.

1.6. On the booking pages, the Contractor operates, under its own responsibility, consent-based usage statistics on its own servers in Austria. Booking content is not included therein.

⸻

2. Electronic Conclusion of Contract

2.1. This DPA is concluded electronically as part of the contractual relationship on the use of BookinX.

2.2. The Client agrees to this DPA during registration by means of an express electronic declaration.

2.3. The version of the DPA applicable at the time the contract is concluded is provided with a version date or version identifier and made electronically accessible to the Client.

2.4. The Contractor documents the conclusion of the DPA in an appropriate manner. For this purpose, in particular the customer account, the contract version or version identifier used and the time of consent may be stored.

2.5. In the event of conflicts between this DPA and other agreements between the Parties, the provisions of this DPA shall prevail with regard to the processing of personal data on behalf, unless mandatory law provides otherwise.

⸻

3. Subject Matter, Nature and Purpose of the Processing

3.1. The subject matter of the processing is the provision and technical operation of the appointment booking service BookinX for the Client.

3.2. Insofar as necessary for the agreed service, the processing comprises in particular:

a. collection and receipt of booking data,

b. storage and management of bookings,

c. display and transmission of appointment and participant information,

d. sending of technically necessary e-mails in connection with bookings,

e. management of employees and their permissions,

f. management and display of appointment availability,

g. where calendar integration is activated, the technically necessary access to calendar information,

h. where the video conference function is activated, the technical provision or relaying of the data required for this,

i. backup and restoration of data,

j. security-related logging,

k. export, rectification and erasure of personal data.

3.3. The details of the subject matter and purpose of the processing, types of data and categories of data subjects are set out in Annex 1.

⸻

4. Duration of the Processing

4.1. The processing on behalf in principle takes place for the term of the main contract on the use of BookinX.

4.2. After termination of the main contract, the Contractor processes personal data only insofar as this is necessary for the return, export or erasure of the data or on the basis of mandatory legal obligations.

4.3. Before final erasure, the Client may request an export of the data controlled by it in a common machine-readable format, in particular CSV or JSON.

4.4. The personal data processed on behalf are deleted no later than six months after termination of the main contract or returned on the instruction of the Client, unless Union law or Austrian law requires further storage.

4.5. Insofar as personal data, after their deletion from the production systems, remain only in backup copies and selective deletion is technically impossible or would involve disproportionate effort, they may remain stored until the regular expiry of the respective backup retention period. During this period, they may not be processed for other purposes and must be protected against regular productive access.

⸻

5. Binding Nature of Instructions

5.1. The Contractor processes personal data exclusively on documented instructions from the Client, unless it is required to carry out a specific processing operation by Union law or Austrian law.

5.2. Documented instructions include in particular:

a. this DPA and the main contract,

b. the settings and configurations made by the Client within BookinX,

c. the activation of optional functions and integrations by the Client or its authorised users,

d. instructions from the Client in text form.

5.3. If the Contractor is obliged to carry out processing on the basis of Union law or Austrian law, it shall inform the Client of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5.4. If the Contractor is of the opinion that an instruction from the Client infringes the GDPR or other applicable data protection provisions, it shall inform the Client without undue delay.

5.5. The Contractor may suspend the execution of an obviously unlawful instruction until the matter has been clarified.

⸻

6. Obligations of the Client

6.1. The Client is responsible for the lawfulness of the processing of personal data and for safeguarding the rights of data subjects.

6.2. The Client ensures in particular that there is a sufficient legal basis for the processing carried out via BookinX and that data subjects receive the legally required data protection information.

6.3. The Client issues only lawful instructions.

6.4. The Client decides in particular on the purpose and essential means of processing its end customer, prospect and employee data and on the activation of optional integrations.

6.5. The Client informs the Contractor without undue delay if it detects errors, irregularities or possible personal data breaches in connection with the processing on behalf.

⸻

7. Confidentiality and Data Secrecy

7.1. The Contractor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.2. Personal data may only be processed in accordance with the documented instructions of the Client and only to the extent necessary to perform the respective tasks.

7.3. The obligation of confidentiality continues to apply after the respective activity has ended.

7.4. The Contractor and its employees observe, where applicable, data secrecy pursuant to § 6 of the Austrian Data Protection Act (Datenschutzgesetz, DSG).

⸻

8. Technical and Organisational Measures

8.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity, the Contractor implements appropriate technical and organisational measures pursuant to Art. 32 GDPR.

8.2. The agreed technical and organisational measures are described in Annex 2.

8.3. The Contractor may further develop the technical and organisational measures during the contract term and replace them with equivalent or more effective measures, provided that the agreed level of security is not reduced as a result.

8.4. Material security-relevant changes are appropriately documented.

⸻

9. Tenant and Access Separation

9.1. The Contractor uses technical and organisational mechanisms to separate the data of different clients.

9.2. Access to personal data is restricted according to the need-to-know and least-privilege principles.

9.3. Roles and permissions are controlled on the server side.

9.4. Database access takes tenant and resource assignments into account in order to prevent unauthorised cross-tenant access.

⸻

10. Assistance with Data Subject Rights

10.1. Taking into account the nature of the processing, the Contractor assists the Client by appropriate technical and organisational measures in fulfilling its obligations towards data subjects.

10.2. This concerns in particular the rights to:

a. access,

b. rectification,

c. erasure,

d. restriction of processing,

e. data portability,

f. objection, where applicable.

10.3. If a data subject addresses a request directly to the Contractor and this request concerns personal data processed on behalf of a client, the Contractor forwards the request without undue delay to the client concerned, insofar as an assignment is possible.

10.4. The Contractor does not respond to the substance of such a request independently, unless it has been instructed to do so by the Client or is legally obliged to do so.

⸻

11. Further Assistance Obligations

11.1. Taking into account the nature of the processing and the information available to it, the Contractor assists the Client in complying with the obligations pursuant to Art. 32 to 36 GDPR.

11.2. The assistance comprises in particular:

a. the security of processing,

b. the investigation and assessment of personal data breaches,

c. the fulfilment of statutory notification and communication obligations,

d. data protection impact assessments pursuant to Art. 35 GDPR,

e. prior consultations with the competent supervisory authority pursuant to Art. 36 GDPR.

11.3. For this purpose, the Contractor provides the Client, to an appropriate extent, with the information available to it and required for the respective assessment.

⸻

12. Personal Data Breaches

12.1. If the Contractor becomes aware of a personal data breach affecting data processed on behalf of the Client, it shall inform the Client without undue delay and in any event no later than 48 hours after becoming aware of it.

12.2. The notification contains, insofar as the relevant information is available:

a. a description of the nature of the breach,

b. the categories of personal data and data subjects concerned,

c. where possible, the approximate number of data subjects and data records concerned,

d. the known or likely consequences of the breach,

e. the remedial measures already taken or proposed,

f. contact details for further information.

12.3. If not all information is available at the same time, it will be supplemented in phases without undue further delay.

12.4. The decision as to whether a notification to a supervisory authority pursuant to Art. 33 GDPR or a communication to data subjects pursuant to Art. 34 GDPR is required rests with the Client as controller.

12.5. The Contractor documents data breaches concerning it in an appropriate manner and assists the Client in the necessary clarification of the facts.

⸻

13. Sub-processors

13.1. The Client grants the Contractor a general authorisation to engage the sub-processors listed in Annex 3.

13.2. The Contractor informs the Client at least 30 days before the intended engagement of a new sub-processor or the replacement of an existing one.

13.3. The information may be provided in particular by e-mail or via the BookinX customer account.

13.4. The Client may object to a change within the 30-day period on objectively justified grounds relating to data protection.

13.5. If the Parties are unable to resolve a justified objection and the sub-processor concerned is necessary for the provision of the service, the affected service or the main contract may be terminated in accordance with the agreed termination provisions.

13.6. The Contractor contractually obliges sub-processors to comply with data protection obligations that, with regard to the processing activities assumed, meet the requirements of Art. 28(4) GDPR.

13.7. The Contractor remains responsible to the Client for the fulfilment of the data protection obligations of its sub-processors to the extent provided by law.

⸻

14. Third-Country Transfers

14.1. The processing of personal data in principle takes place within the European Union or the European Economic Area, unless otherwise stated in Annex 3.

14.2. A transfer of personal data to a third country or an international organisation takes place only if the requirements of Art. 44 et seq. GDPR are met.

14.3. Where necessary, a third-country transfer is based in particular on an adequacy decision of the European Commission or appropriate safeguards pursuant to Art. 46 GDPR.

14.4. Insofar as Standard Contractual Clauses or supplementary safeguards are required for a third-country transfer, these are put in place before the start of the transfer concerned.

⸻

15. Evidence and Audit Rights

15.1. Upon request, the Contractor provides the Client with all information necessary to demonstrate compliance with the obligations pursuant to Art. 28 GDPR.

15.2. Evidence may be provided in particular by:

a. descriptions of the technical and organisational measures,

b. security or audit reports,

c. documented internal reviews,

d. other suitable evidence.

15.3. The Client is entitled to carry out audits itself or through an independent auditor bound to confidentiality, insofar as this is necessary to verify compliance with this DPA.

15.4. On-site audits in principle take place after reasonable prior notice during normal business hours.

15.5. Prior notice is not required insofar as a serious security incident or a justified suspicion of a significant data protection violation objectively makes a short-notice audit necessary.

15.6. Audits are to be carried out in such a way that business secrets, security interests and personal data of other clients remain appropriately protected.

15.7. The Contractor cooperates with the competent data protection supervisory authority to the extent required by law.

⸻

16. Return and Erasure

16.1. After the end of the processing on behalf, the Contractor, at the choice of the Client, deletes the personal data processed on behalf or returns them to the Client, unless there is a legal obligation to continue storing them.

16.2. Before final erasure, the Client may request an export of the data stored for it in CSV and/or JSON.

16.3. If the Client does not issue a different instruction, the Contractor is entitled to delete the data in accordance with Clause 4.

16.4. Data that must continue to be stored due to statutory retention obligations are blocked for other purposes or their processing is restricted to the extent required by law.

⸻

17. Liability

17.1. The statutory provisions, in particular Art. 82 GDPR, apply to the liability of the Parties for infringements of the GDPR.

17.2. Mandatory statutory liability provisions remain unaffected.

17.3. Limitations of liability in the main contract do not apply insofar as such a limitation is inadmissible under the GDPR or other mandatory law.

⸻

18. Amendments to this DPA

18.1. Amendments to this DPA are communicated to the Client in text form or via another durable electronic communication channel.

18.2. Material changes to the rights and obligations of the Parties are announced with reasonable advance notice.

18.3. Changes regarding the engagement or replacement of sub-processors are, irrespective of this, subject to Clause 13.

18.4. The versions of this DPA applicable to the Client are provided with a version date or version identifier and documented in a traceable manner.

⸻

19. Applicable Law and Place of Jurisdiction

19.1. This DPA is governed by Austrian law, unless mandatory Union law or other mandatory law provides otherwise.

19.2. Insofar as an agreement on the place of jurisdiction is legally permissible, the jurisdiction of the courts having subject-matter jurisdiction in Vienna, Austria, is agreed for disputes arising from or in connection with this DPA.

19.3. Mandatory statutory places of jurisdiction and the rights of data subjects under the GDPR are not restricted thereby.

⸻

20. Final Provisions

20.1. Annexes 1 to 3 form an integral part of this DPA.

20.2. This DPA in principle ends with the main contract. Provisions on confidentiality, data protection, return, erasure, evidence and liability continue to apply beyond the end of the contract where necessary.

20.3. Should individual provisions of this DPA be or become invalid or unenforceable, the remaining provisions shall remain unaffected. The invalid or unenforceable provision shall be replaced by the applicable statutory provisions.

⸻

Annex 1 – Subject Matter of the Processing, Types of Data and Data Subjects

1. Subject Matter

Provision and operation of the appointment booking service BookinX.

The Client can set up booking pages and enable its end customers and prospects to book appointments. Employees of the Client can manage bookings and, where activated, use calendar and video conference functions.

2. Purpose of the Processing

The processing takes place in particular for:

• receiving and managing appointment bookings,
• coordinating and displaying availability,
• communication in connection with appointments,
• managing the employees involved in the booking process,
• synchronisation with connected calendars,
• preparing appointments (agenda, meeting objectives, documents),
• booking of rooms by employees of the Client,
• technical provision of video conferences, where activated,
• recording, transcription and summarisation of video conferences, where started by the organising person,
• display of public profiles of employees, where released,
• import of user lists by the Client,
• keeping a change log for the Client's administrators,
• ensuring the security, availability and recoverability of the service.

3. Categories of Data Subjects

3.1. End Customers and Prospects of the Client

Persons who book an appointment via a BookinX booking page or interact with the Client in connection with an appointment booking.

3.2. Employees of the Client

Employees, freelancers or other users authorised by the Client who offer, manage or participate in appointments via BookinX.

4. Categories of Personal Data

4.1. End Customers and Prospects

Depending on the configuration:

• salutation,
• title,
• first name,
• last name,
• e-mail address,
• company,
• message or booking information entered by the end customer,
• appointment time,
• time zone,
• language,
• time of consent, insofar as consent is documented via BookinX,
• technical delivery data in connection with e-mails,
• information on appointment preparation, in particular agenda additions and own meeting objective,
• views of the appointment preparation page,
• where recording of a video conference has been started: video and audio (briefly), audio recording (until transcription), transcript, summary as well as display name and speaking times.

4.2. Employees of the Client

Depending on use and configuration:

• name,
• e-mail address,
• phone number,
• role and permission,
• profile photo, optional,
• short introduction, optional,
• introduction video, optional,
• function or position and department,
• salutation and language, including from a user list imported by the Client,
• public profile information, optional: greeting, „Über mich“ (About me) text, motto, company description, company video, profile banner,
• QR code and digital contact card (name, company, phone number, e-mail address), optional,
• calendar busy times where a calendar is connected (Microsoft 365, Google Calendar or Apple Calendar),
• appointments and absences written or entered where a calendar is connected,
• room bookings (room, title, start, end, booking person),
• entries in the change log (who changed what and when, without the changed content),
• where recording of a video conference has been started: video and audio (briefly), audio recording (until transcription), transcript, summary as well as display name and speaking times,
• access tokens for connected services, stored encrypted.

5. Special Categories of Personal Data

Within the scope of its regular functions, BookinX is not designed to collect special categories of personal data pursuant to Art. 9 GDPR. In recordings of video conferences, voices are not analysed to identify persons; speakers are assigned solely via the display name in the conference.

Insofar as the Client allows such data to be transmitted, in particular via free-text fields or other input options, the Client is responsible for the existence of a corresponding legal basis and for fulfilling the additional data protection requirements.

The Contractor processes such data exclusively in accordance with the documented instructions of the Client and within the scope of the agreed BookinX functions.

6. Processing Operations

Depending on use, in particular:

• collection,
• recording,
• organisation,
• storage,
• retrieval,
• display,
• transmission,
• synchronisation,
• updating,
• backup,
• export,
• restriction,
• erasure.

7. Primary Place of Processing

The primary processing takes place on the Contractor's own servers in Austria.

Further places of processing are set out in Annex 3.

⸻

Annex 2 – Technical and Organisational Measures

1. Transport Encryption

• Encryption of external connections using TLS.
• Prevention or redirection of unencrypted access, insofar as technically possible.
• Encrypted communication with connected external services.

2. Password Security

• No storage of passwords in plain text.
• Password hashing using Argon2id.
• Selection and regular review of appropriate Argon2id parameters.

3. Protection of External Access Tokens

• Encrypted storage of access tokens for connected services.
• Encryption using AES-256-GCM.
• Separation of the encryption keys from the encrypted payload data.
• Key rotation.
• Restriction of access to keys to technically necessary components and authorised persons.

4. Access Control and Permissions

• Role-based access control.
• Server-side verification of permissions.
• Tenant separation at database level.
• Resource separation and verification of the assignment of resources to a tenant.
• Application of the need-to-know and least-privilege principles.

5. Session Management

• Server-side sessions.
• Defined expiry times.
• Possibility of server-side invalidation of sessions.
• Security-related handling of existing sessions in the event of relevant changes.

6. Protection against Automated Attacks and Abuse

• Rate limits for security-relevant endpoints.
• Limitation of automated requests, in particular for authentication and publicly accessible booking functions.
• Server-side validation of relevant inputs.

7. Logging

• Logging of security-relevant and administratively relevant operations in an audit log.
• Change log for the Client's administrators: time, person, action and object concerned, never the changed content; visible only to administrators of the respective tenant.
• Retention period of the audit log: in principle 12 months.
• Restriction of access to audit information.
• No use of audit logs for advertising or advertising profiling.

8. Data Backup

• Daily encrypted backups.
• Additional backup copy outside the primary server.
• Retention of daily backups for 14 days.
• Retention of weekly backups for 8 weeks.
• Restriction of access to backups.
• Regular restore tests.

9. Availability and Recoverability

• Measures to restore personal data after technical or physical incidents.
• Verification of the recoverability of backups.
• Performance and documentation of restore tests.

10. Security Reviews

• Security reviews before releases.
• Review of security-relevant changes before deployment to production.
• Risk-based prioritisation and remediation of identified security deficiencies.
• Regular review of the effectiveness of the security measures.

11. Data Minimisation

• Restriction of processing to the data required for the respective function or provided by the Client within the intended functions.
• Optional profile data are processed only if the corresponding functions are used.
• Calendar integrations are activated only after express connection by an authorised user.

12. Tracking and Advertising

• No advertising trackers within the processing on behalf.
• No use of the booking or employee data processed on behalf for personalised advertising.

13. Review and Further Development

The technical and organisational measures are reviewed regularly as well as after material changes or security incidents and further developed in line with the risk and the state of the art.

⸻

Annex 3 – Sub-processors

The Client grants its general authorisation for the sub-processors listed below.

1. netcup GmbH

Provider: netcup GmbH

Registered office: Germany

Service: Technical sending of e-mails

Data processed: E-mail addresses, sender and recipient information as well as technically necessary e-mail and delivery data

Processing: European Union or European Economic Area

Use: Component of the BookinX e-mail sending

⸻

2. Microsoft Ireland Operations Limited

Provider: Microsoft Ireland Operations Limited

Registered office: Ireland

Service: Microsoft Graph, Microsoft 365 and Microsoft Teams

Data processed: Depending on the activated function, employee data, calendar busy times, appointments as well as technically necessary identification, authentication and connection data

Use: Only insofar as an authorised user connects or activates a corresponding Microsoft integration with BookinX.

Insofar as personal data are transferred outside the EEA in the course of providing the service, this takes place exclusively in compliance with the requirements of Art. 44 et seq. GDPR.

⸻

3. Google Ireland Limited

Provider: Google Ireland Limited

Registered office: Ireland

Service: Google Calendar API

Data processed: Depending on the activated function, calendar busy times, appointments, e-mail address of the Google account as well as technically necessary authentication and connection data

Use: Only insofar as an authorised user connects their Google Calendar with BookinX.

Insofar as personal data are transferred outside the EEA in the course of providing the service, this takes place exclusively in compliance with the requirements of Art. 44 et seq. GDPR.

⸻

4. Apple Distribution International Ltd.

Provider: Apple Distribution International Ltd.

Registered office: Ireland

Service: iCloud Calendar (CalDAV)

Data processed: Depending on the activated function, calendar busy times, appointments, Apple ID as well as technically necessary connection data

Use: Only insofar as an authorised user connects their Apple Calendar with BookinX.

Insofar as personal data are transferred outside the EEA in the course of providing the service, this takes place exclusively in compliance with the requirements of Art. 44 et seq. GDPR.

⸻

5. Backup Infrastructure

Contractor's own infrastructure

Service: Encrypted external backup copy

Data processed: Encrypted backup of the data stored by BookinX

Use: Data backup and restoration

If the second copy is operated exclusively on the Contractor's own infrastructure and no further processor is involved, this entry does not apply.

⸻

Contractor's own infrastructure (no sub-processors)

• Video conference (Xorbit Meeting): own Jitsi Meet instance at meet.x-orbit.app on the Contractor's servers in Austria.

• Recording and transcription (optional): recording via the own Jitsi instance (Jibri), speech recognition with Whisper and summarisation with the language model Qwen 2.5 via Ollama, all on the Contractor's servers; no transfer to third parties and no training of models with customer data. Video file deleted immediately after the recording, audio recording deleted after transcription; transcript and summary encrypted, deletion 30 days after the end of the recording or of the appointment.

• Appointment and conference control (MeetinX): internal component of BookinX on the same servers in Austria; generates conference rooms and calendar entries. Participant e-mail and conference links are stored encrypted, the participant e-mail is deleted 30 days after the end of the appointment.

• Data backup: daily, encrypted backup (GPG, AES-256) to a server at netcup and an encrypted second copy on a device of the Contractor in Austria; retention 14 days daily, 8 weeks weekly.

⸻

Electronic Consent

The following declaration may be used during registration:

Ich akzeptiere die Nutzungsbedingungen und den Auftragsverarbeitungsvertrag (AVV) und bestätige, dass ich zum Abschluss für den angegebenen Kunden berechtigt bin. (I accept the Terms of Use and the Data Processing Agreement (DPA) and confirm that I am authorised to conclude them on behalf of the specified customer.)

The Terms of Use and this DPA are made electronically accessible before the declaration is submitted.

BookinX documents the DPA version or version identifier applicable at the time the contract is concluded and the time of consent.