Data processing agreement
This agreement is part of the Terms of use and applies for the duration of the subscription.
1. Parties and roles
Section titled “1. Parties and roles”- Controller: the business using Tempact.
- Processor: Saša Gašparović, a private individual, Novi Sad, Serbia, email [email protected], phone +381 60 151 0099.
2. Subject and purpose
Section titled “2. Subject and purpose”The processor processes personal data only to provide the booking service, on the controller’s documented instructions. The instructions are this agreement and the settings the controller makes in the panel.
3. Types of data and data subjects
Section titled “3. Types of data and data subjects”- Data subjects: the controller’s clients, staff and partners, and people in portfolio photos.
- Data: name, contact (email, phone), appointments and services, booking history, portfolio photos.
- Special categories of data are not processed, and the controller must not enter them.
4. Processor obligations
Section titled “4. Processor obligations”- Processes data only on the controller’s instructions.
- Ensures that people with access to the data are bound by confidentiality.
- Applies appropriate technical and organizational measures, described in section 6.
- Helps the controller respond to data subject requests (access, rectification, erasure, export).
- Notifies the controller of a personal data breach without undue delay, and no later than 48 hours after becoming aware of it.
- When the service ends, allows data export within 30 days and then deletes the data, unless the law requires retention.
- Makes available to the controller the information needed to demonstrate compliance.
5. Sub-processors
Section titled “5. Sub-processors”The controller gives general authorization to engage sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | EU |
| Cloudflare, Inc. | Domain, protection, backups | EU and US (standard contractual clauses) |
| Brevo (Sendinblue SAS) | Sending email to clients | EU |
We announce new or changed sub-processors at least 30 days in advance. The controller may object, and if we cannot agree, may cancel the subscription.
6. Security measures
Section titled “6. Security measures”- Encrypted transfer (HTTPS, HSTS), hashed passwords, role-based access.
- Data separated per business; partners cannot see client data.
- Regular encrypted backups.
- Access logs and restricted administrative access to the server.
- Removal of location data (EXIF, GPS) from portfolio photos.
7. Transfers outside the EU and Serbia
Section titled “7. Transfers outside the EU and Serbia”Transfers outside the EU and Serbia take place only with appropriate safeguards, such as standard contractual clauses.
8. Governing law
Section titled “8. Governing law”The Serbian Law on Personal Data Protection and, where applicable, the GDPR apply.
Draft version: 10 November 2026.