Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Caly ("Processor") and the customer ("Controller") and governs the processing of personal data by Caly on behalf of the customer in connection with the Caly scheduling Service.

This DPA is entered into to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) (EU) 2016/679 and the UK GDPR.

1. Definitions

Terms used in this DPA shall have the meanings given to them in the GDPR unless otherwise defined here. “Personal Data” means any information relating to an identified or identifiable natural person processed by Caly on behalf of the Controller. “Processing” has the meaning given in the GDPR.

2. Roles of the Parties

The Controller determines the purposes and means of processing Personal Data. Caly acts as a Processor and processes Personal Data only on documented instructions from the Controller, including for transfers to third countries, unless required to do so by applicable law.

3. Nature and Purpose of Processing

Caly processes Personal Data for the following purposes:

• Providing scheduling and calendar management features
• Sending booking confirmations and reminders on behalf of the Controller
• Facilitating integrations with third-party services (calendars, conferencing, CRM)
• Supporting the Controller in responding to data subject requests

Types of Personal Data processed may include: names, email addresses, phone numbers, time zones, calendar availability data, and meeting notes where provided.

4. Obligations of Caly as Processor

Caly shall:

• Process Personal Data only on documented instructions from the Controller.
• Ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
• Implement appropriate technical and organisational measures to protect Personal Data.
• Assist the Controller in fulfilling data subject rights requests (access, rectification, deletion, portability).
• Delete or return Personal Data upon termination of the Service, at the Controller's option.
• Make available all information necessary to demonstrate compliance with this DPA.
• Notify the Controller without undue delay after becoming aware of a personal data breach.

5. Sub-processors

Caly may engage sub-processors to assist in providing the Service. Caly shall notify the Controller of any intended additions or replacements of sub-processors by updating our sub-processor list. The Controller may object to such changes within 30 days.

Current sub-processors include cloud infrastructure providers and, where enabled by the Controller, third-party calendar and conferencing integrations.

6. Security Measures

Caly implements appropriate technical and organisational security measures, including:

• Encryption of data in transit (TLS) and at rest
• Access controls and authentication requirements
• Regular security assessments and patching
• Incident response procedures

7. International Transfers

Where Personal Data is transferred outside the EEA, Caly shall ensure appropriate safeguards are in place in accordance with the GDPR, including the use of Standard Contractual Clauses where required.

8. Governing Law

This DPA shall be governed by the laws applicable to the Controller's jurisdiction, subject to the mandatory requirements of applicable data protection legislation.

Contact

To request a signed DPA or to raise questions about data processing, please contact us at hello@devino.ca.