1. SUBJECT MATTER AND SCOPE
1.1. This Data Processing Agreement (hereinafter the ‘DPA’) is concluded in accordance with Article 28 of the EU General Data Protection Regulation (GDPR / Regulation EU 2016/679) and constitutes integral Annex No. 1 to the yemisce.com Public Offer.
1.2. The DPA governs the legal relationship between the User as the Data Controller and the Provider (Individual Entrepreneur Marchenko A.V.) as the Data Processor in relation to the processing of the personal data of the User’s End Clients within the Service’s software environment.
1.3. The terms of this DPA are accepted automatically upon acceptance of the Public Offer (Click-wrap consent) on the order placement page.
2. CATEGORIES OF DATA AND DATA SUBJECTS
2.1. Personal data subjects: The User’s End Clients who book online or whose data is entered by the User into the system in connection with the provision of services.
2.2. Categories of personal data: First name, surname, contact telephone number, email address, visit history and status, selected services, text notes.
2.3. Controller’s warranties: The User warrants that they have all necessary legal bases (including consents or contractual obligations) for collecting and entering their clients’ personal data into the yemisce.com Service.
3. OBLIGATIONS OF THE PROCESSOR (INDIVIDUAL ENTREPRENEUR MARCHENKO A.V.)
3.1. Controller’s instructions: The Processor processes personal data solely on the documented direction and instructions of the Controller, expressed through use of the Account’s technical functionality in the Service.
3.2. Confidentiality: The Processor ensures that all personnel authorised to provide technical support and administration of the Service are bound by strict obligations not to disclose confidential information.
3.3. Technical and organisational measures (TOMs): The Processor implements appropriate security measures, including end-to-end encryption (SSL/TLS), access rights separation, regular backups and protection against virus/cyberattacks.
4. SERVER INFRASTRUCTURE AND SUB-PROCESSORS
4.1. Database location (EU / Germany): Personal data is stored and initially processed on cloud servers in the Federal Republic of Germany (EU), ensuring compliance with Art. 28 GDPR.
4.2. Authorised Sub-processors: The Controller grants general authorisation to engage the following sub-processors:
- JSC UNIVERSAL BANK (monobank acquiring) — for secure processing of payment transactions in UAH;
- Data centres and cloud providers in Germany — for the physical hosting of databases;
- SMS/Push providers — for delivery of booking notifications to clients.
4.3. Remote technical administration from Ukraine: Technical support provided by Individual Entrepreneur Marchenko A.V. from the territory of Ukraine qualifies as remote access and is performed using EU Standard Contractual Clauses (SCCs).
5. PERSONAL DATA BREACH NOTIFICATION (ART. 33 GDPR)
5.1. If a security incident (a breach, unauthorised access or loss of personal data) is detected, the Processor must notify the Controller without undue delay, but no later than within 48 hours of detecting the incident.
5.2. The notification must contain a description of the nature of the breach, the approximate number of records affected and the compensating security measures taken.
6. ASSISTANCE IN THE EXERCISE OF DATA SUBJECT RIGHTS
6.1. The Processor provides the Controller with technical capabilities within the system to fulfil End Clients’ requests to exercise their rights under Art. 12-22 GDPR (in particular, a function for exporting data in JSON format and a button for deleting records).
7. PROCEDURE FOR DELETION AND RETURN OF DATA
7.1. Following termination of the Public Offer or closure of the Account, the Processor provides the ability to export databases for 3 (three) months. Upon expiry of this period, all End Client databases are subject to irreversible deletion from the servers in Germany.
8. DETAILS AND SIGNATURES OF THE PARTIES
The Agreement takes effect upon acceptance of the Public Offer by the User and remains in force throughout the period of use of the yemisce.com Service.
ON BEHALF OF THE PROCESSOR:
Individual Entrepreneur Marchenko A.V. (ФОП Марченко А.В.)
Taxpayer registration number (RNOKPP): 3142116891
Legal address: Ukraine, 08324, Kyiv Region, Boryspil District, Hora village, 60 Kyivska Street
Email: hello@yemisce.com
Tax status: Group 3 single tax payer