Data Processing Agreement (DPA)

Subject: the processing of personal data of the Controller's patients (and other data subjects who published a review on the Controller's Google Business Profile) for the purpose of operating DentalLocal — in particular:

• synchronisation of reviews and generation of AI response drafts, • storage of review content, patient names and ratings, • analysis of profile performance and monthly reports.

Duration of processing matches the duration of the main contract + 30 days (export window) + statutory accounting retention.

Categories of data processed:

• Patient's name (or nickname) as shown on Google, • public profile picture from Google, • review text (may contain health-related information about treatment, procedures, perception of care), • 1–5 star rating, • date the review was published.

Categories of data subjects: patients, possibly caregivers of patients, who voluntarily published a review on Google. Special-category data (health data under Art. 9 GDPR) is processed by the Provider only insofar as it is contained in the review text published by the data subject themselves; the Controller's legal basis is necessity for the establishment, exercise or defence of legal claims (Art. 9(2)(f)) or the explicit consent manifested by publishing the review.

The Provider undertakes to:

a) Process personal data solely on documented instructions from the Controller (including this DPA). b) Ensure that persons authorised to process the data are bound by confidentiality. c) Adopt appropriate technical and organisational measures under Art. 32 GDPR (encryption in transit and at rest, data isolation, access control, logging, incident response plan). d) Cooperate with the Controller in exercising data subjects' rights and in communication with the supervisory authority. e) After contract termination, at the Controller's choice, return or delete the data (within 30 days), except copies required by law (accounting documents). f) Provide the Controller with information necessary to demonstrate compliance with Art. 28 GDPR, including audits (see Art. 8 below).

The Controller grants the Provider general authorisation to engage the sub-processors listed in the Privacy Policy (dentallocal.cz/en/privacy, section 4). The Provider will notify the Controller of any changes at least 30 days in advance; the Controller may object to a new sub-processor and, in such case, terminate the main contract.

Where personal data is transferred outside the EEA, transfer takes place exclusively on the basis of:

• an adequacy decision by the European Commission (e.g. EU-US Data Privacy Framework), or • Standard Contractual Clauses 2021/914 (module 3 — processor-to-processor),

supplemented by additional measures (encryption, pseudonymisation) where required by local legislation of the recipient.

The Provider will notify the Controller of any personal data breach without undue delay, no later than 72 hours after becoming aware of it. The notification will include a description of the breach, expected consequences, measures taken and the contact person.

If a data subject contacts the Provider directly with a request to exercise their rights (access, rectification, erasure, objection, portability), the Provider will not respond to the request and will forward it to the Controller within 5 business days. The Controller is responsible for responding under GDPR.

The Controller has the right once every 12 months to audit DPA compliance at its own expense — on the basis of a written request with 30 days' notice, during normal business hours, in a manner that does not disrupt operation of the Service. The audit may be carried out by an independent auditor bound by confidentiality. In lieu of audit, the Controller may accept SOC 2 / ISO 27001 audit reports of sub-processors (Supabase, Vercel, Stripe) where available.

Liability is governed by the Terms of Service (Art. 12). Where GDPR imposes direct liability on the processor towards the data subject (Art. 82), the Provider bears liability only to the extent of obligations directly imposed by GDPR.

This DPA applies for as long as the Provider processes personal data for the Controller. Changes to this DPA take effect 30 days after notice by email; the Controller may object and, in such case, terminate the contract. In the event of conflict between this DPA and the main contract, this DPA prevails.