Data Processing Agreement

Version 1.1 · effective from 19 October 2026

This is a translation. In case of any discrepancy, the Polish version prevails.

This agreement is entered into between the Clinic that has opened an account on the Frontlo platform and accepted this agreement (the “Controller”) and WEBSITTERS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Wrocław, ul. Aleksandra Hercena 10, 50-453 Wrocław, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000946109, tax ID (NIP) 8992915384, REGON 521002056 (the “Processor”), pursuant to Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”). This agreement forms part of the service agreement concluded on the basis of the Terms of Service (the “Main Agreement”).

§1. Subject matter

1. The Controller entrusts the Processor with the processing of personal data to the extent and for the purpose set out in this agreement, and the Processor undertakes to process the data in accordance with this agreement, the GDPR and Polish law.
2. The purpose of processing is to provide the services under the Main Agreement: running the calendar and bookings, patient records, sales and payments, the loyalty programme, the Controller’s website and mobile app, communication with patients (e-mail, SMS, push), treatment records and — if the Controller enables them — AI features and ad measurement (§5).
3. Nature of processing: collection, recording, storage, structuring, making available to the Controller, sending messages, erasure — by automated means, in IT systems.

§2. Categories of data subjects and data

1. Categories of data subjects: the Controller’s patients and clients, visitors to its website, persons contacting the Controller (leads), voucher recipients, members of the Controller’s team.
2. Categories of data: identification and contact data (first name, last name, phone number, e-mail, date of birth, gender, delivery address), history of appointments, purchases and payments, vouchers, packages and points, the content of correspondence and reviews, consents (including consents to ad measurement), technical data (notification tokens, IP address, browser, identifiers from advertising platforms’ cookies) and — if the Controller keeps treatment records — data concerning health, which is a special category of data (Article 9 GDPR): the medical questionnaire, treatment notes including the products used, signed treatment consents and photos.

§3. Duration and deletion of data

1. This agreement remains in force for the term of the Main Agreement. After it ends, the Processor, as decided by the Controller, returns the data (by providing a copy in a commonly used electronic format) and deletes it within 30 days, together with any existing copies — backups are deleted in their rotation cycle, within no more than 90 days — unless the law requires further retention.
2. The Controller downloads the medical records by exporting them from the panel (PDF files, signed consents and photos). The Processor deletes them only after the Controller has confirmed their transfer (e.g. to a new system or to the entity taking over the records) — until then it stores them without the possibility of changes. The obligation to retain records for 20 years (Article 29 of the Polish Act on Patients’ Rights and the Patients’ Rights Ombudsman) rests with the Controller.
3. When a patient deletes their account, the Platform anonymises their data in accordance with the Controller’s instruction expressed in the Main Agreement; it retains billing data without contact details and the medical records together with the data identifying the patient. The Processor keeps the phone number hash retained after account deletion (preventing abuse of promotions for new clients, 3 years) as a controller, in accordance with the Frontlo privacy policy.

§4. Medical data and support access

1. Data from treatment records is available only in the Controller’s panel, to people to whom the Controller has granted permission. It is not made available in the patient app, on the website or via the public API.
2. The Processor’s staff have no access to medical data in the panel, including in technical support mode. Access is possible only after it has been granted by the owner of the Controller’s account in the panel, for a selected period (1, 24 or 72 hours), on a read-only basis; the owner may revoke it at any time, and every access is recorded in a log visible to the Controller.
3. Persons administering the infrastructure have technical access to the databases and backups only to the extent necessary to maintain or restore the system or to handle an incident, and do not view medical data for any other purpose.

§5. Ad measurement (Meta, Google, TikTok)

1. If the Controller enables in the panel pixels or server-side events to Meta, Google (Google Analytics 4, Google Ads) or TikTok, it thereby instructs the Processor to transmit events (forms, bookings, purchases) to those platforms together with matching data: SHA-256 hashes of the e-mail address, phone number and account identifier, and from the website also the IP address, browser and identifiers from the platforms’ cookies.
2. The Processor transmits this data only with the patient’s consent recorded in the Platform: from the consent banner on the website (for website events) or the patient’s most recent decision saved in their account (for events from the app and subscription renewals). Without consent, the event is not sent.
3. Meta, Google and TikTok are not sub-processors of the Processor. They process the data under agreements and terms entered into by the Controller (in part as independent controllers, in part as the Controller’s processors). The Controller is responsible for those agreements, for the content of the consent banner and for informing patients in its privacy policy.

§6. Obligations of the Processor

1. The Processor processes the data only on documented instructions from the Controller. Such instructions include, in particular, the Main Agreement, this agreement and the Controller’s actions in the panel. If the law requires other processing, the Processor informs the Controller before such processing begins, unless the law prohibits this.
2. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
3. It allows only authorised persons to process the data, who are bound by confidentiality, also after their employment or cooperation has ended.
4. It applies the security measures required by Article 32 GDPR, described in §8.
5. Taking into account the nature of the processing, it assists the Controller in fulfilling its obligation to respond to requests from data subjects (Articles 15–22 GDPR) — in particular by providing features in the panel for viewing, correcting and deleting data — and forwards requests addressed directly to it to the Controller without undue delay.
6. It assists the Controller in meeting its obligations under Articles 32–36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of the processing and the information available to it.
7. It maintains the record of categories of processing activities referred to in Article 30(2) GDPR.

§7. Personal data breaches

The Processor notifies the Controller of a personal data breach without undue delay, and no later than 36 hours after becoming aware of it, to the e-mail address of the account owner. The notification contains the information required by Article 33(3) GDPR, to the extent available; any missing information is provided without delay. The Processor takes measures to mitigate the effects of the breach.

§8. Security measures

• encryption of data in transit (TLS) and storage of passwords only as hashes;
• logical separation of the data of individual Controllers and role-based access control;
• administrative access to servers only for authorised persons, with key-based authentication;
• private file storage in the EU (Cloudflare R2) with access via signed, temporary links;
• separate permissions for medical records, no support access without the Controller’s consent (§4), and a log of access to and changes in the records;
• regular backups and a restore procedure;
• monitoring of system operation and errors, logging of significant operations;
• software updates and security reviews when the system changes.

§9. Sub-processing

1. The Controller gives general authorisation for the Processor to engage sub-processors. The current list is set out below. Advertising platforms to which data is sent on the Controller’s instructions (§5) are not sub-processors.
2. The Processor informs the Controller by e-mail or in the panel at least 14 days in advance of any intended addition or replacement of a sub-processor. Within that period the Controller may raise a justified objection; if the parties do not reach an agreement, the Controller may terminate the Main Agreement with immediate effect.
3. The Processor imposes on sub-processors the same data protection obligations as in this agreement and remains liable to the Controller for their performance.
4. Data is transferred to a third country only using the mechanisms set out in Chapter V of the GDPR (an adequacy decision, including the EU–US Data Privacy Framework, or standard contractual clauses).

§10. Right to audit

1. The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and enables audits, including inspections, to be carried out by the Controller or an authorised auditor bound by confidentiality.
2. An audit takes place after prior notice given at least 14 days in advance, during working hours, without disrupting the operation of the platform and without access to the data of other Controllers. In the first instance, the parties rely on answers to written questions and on documentation.

§11. Obligations of the Controller

1. The Controller is responsible for the lawfulness of the processing of data entrusted to the Processor, including having legal bases and consents in place and fulfilling its information obligations towards patients.
2. The Controller enters into the platform only data necessary for the purposes set out in §1 and ensures the security of its users’ access (passwords, team permissions).

§12. Liability and final provisions

1. The parties’ liability is governed by Article 82 GDPR and the Main Agreement, provided that the limitations of liability in the Main Agreement do not exclude liability towards data subjects.
2. Matters not regulated herein are governed by the GDPR, the Polish Personal Data Protection Act and the Polish Civil Code.
3. In the event of a conflict between this agreement and the Main Agreement with regard to personal data protection, this agreement prevails.
4. This agreement is concluded in electronic form when it is accepted on opening the account. Contact on matters relating to this agreement: [email protected].