Data Processing Agreement
When you receive bookings, orders or messages through our website or service, we process your customers' data on your behalf. Effective from 27 October 2026.
This is a translation for information. In case of any discrepancy the Slovak version is binding.
Common to all products; the product part in Article 12 specifies the data, purposes and further processors. Version 1.3, effective from 27 October 2026. It replaces the agreement published on sferin.sk from 11 October 2026.
Article 1: Contracting parties and conclusion
1.1 The controller is the client who, through the provider's service, processes personal data of its customers (guests, patients, visitors, subscribers). The processor is WebiSfer s. r. o., Talinská 2388/9, 040 12 Košice, Slovakia, Company ID 57 475 687, info@webisfer.sk.
1.2 This agreement is concluded under Art. 28(3) of Regulation (EU) 2016/679 (GDPR) together with the Service Agreement (the order) and forms part of it. It lasts for the duration of the service and thereafter until the data is deleted or returned under Article 9. In matters of personal data protection it takes precedence over the GTC.
Article 2: Subject matter, nature and purpose
2.1 The processor processes personal data on behalf of the controller only to operate the ordered service, for the purposes set out in the product part (Article 12). The processing consists of collection through website forms and the administration, storage in a database, display in the administration and the application, sending e-mails and SMS messages on behalf of the controller, backup and the preparation of overviews. The data is not used for the processor's own purposes, in particular not for marketing or for training models.
Article 3: Instructions
3.1 The processor processes the data only on the basis of documented instructions from the controller (Art. 28(3)(a)): this agreement, the settings in the administration and requests by e-mail. If, in the processor's opinion, an instruction infringes the GDPR, it will inform the controller. Transfers to third countries take place only in accordance with Chapter V of the GDPR (Article 7).
3.2 The controller is responsible for the legal basis of the processing, for informing data subjects (Art. 13 GDPR) and for entering only the necessary data into the system. The processor will supply templates of the information texts.
Article 4: Confidentiality
Persons authorised to process the data are bound by confidentiality (Art. 28(3)(b), Section 79 of Act No. 18/2018 Coll. on Personal Data Protection), also after the agreement ends. The processor keeps a list of authorised persons and of access rights.
Article 5: Security (Art. 32 GDPR)
Encrypted communication (HTTPS); encryption of sensitive data in the database (AES-256-GCM: for SFERIN, identity documents and visas; for ORDINUJ, name, phone, e-mail, date of birth, notes and names of medicines); the encryption key stored separately from the database and backed up separately; servers in a data centre in the EU; daily backups kept for at least 7 days; access to the administration by password with the option of two-factor authentication; separation of the data of individual controllers (each sees only its own); Cloudflare protection against attacks and bots; continuous updates; logging of important interventions; regular vulnerability checks; restricted server access (SSH keys, passwords disabled); rules for administrator access and their review.
Article 6: Assistance and personal data breaches
6.1 The processor helps to handle requests from data subjects (access, rectification, erasure, restriction, portability, objection) and forwards requests delivered directly to it to the controller without undue delay (Art. 28(3)(e)). It assists with the obligations under Art. 32 to 36 (point (f)), including materials for a data protection impact assessment where necessary.
6.2 The processor will notify the controller of a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it; for the ORDINUJ product within 24 hours. The notification contains the nature of the breach, the data and persons concerned, the likely consequences and the measures taken. Notification to the supervisory authority and to data subjects is made by the controller; the processor supplies the materials.
Article 7: Further processors and transfers
7.1 The controller gives general authorisation for the further processors listed in the product part (Art. 28(2)). The processor will announce the addition or replacement of a processor by e-mail 30 days in advance; the controller may object and, if the parties do not agree, terminate the service with effect from the date of the change. Further processors are bound by the same obligations (Art. 28(4)).
7.2 Common to all products: Contabo GmbH (Germany, servers and backups in the EU), Cloudflare, Inc. (USA, DNS, protection against attacks, Turnstile; as a protective layer in front of the server it processes website traffic, including the content of submitted forms, only to deliver it and to protect against attacks, and does not store the content; EU-US Data Privacy Framework), Websupport s. r. o. (Slovakia, domains, e-mail mailboxes and sending e-mails where they go through a mailbox set up by the processor). The current list of further processors is published at webisfer.sk/sprostredkovatelia (in English at webisfer.sk/en/sub-processors).
7.2a Card payments are processed by Stripe as an independent controller (data of the paying client, not of its customers). Other services that process personal data of the client's customers only marginally or not at all: push notifications of the application (Google FCM, Apple, Mozilla, only the device identifier of the application user); a photo compression service (Tinify, no personal data); artificial intelligence tools for sorting photographs when preparing website previews (OpenAI, no personal data). If we switch on a function that sends messages from guests or patients to artificial intelligence tools (for example a suggested reply), we will add the provider to the list in advance in accordance with clause 7.1.
7.3 Services called directly by the visitor's browser (OpenStreetMap maps, Photon, Nominatim, Google Maps after a click, Google Analytics and Meta Pixel if the controller switches them on and only with the visitor's consent) receive the IP address and the text entered, not data from the database; the controller is responsible for switching them on.
Article 8: Information and audit
The processor will provide the information needed to demonstrate compliance with Art. 28 and will allow an audit by the controller or an auditor it appoints (point (h)), first by means of a written questionnaire; an on-site inspection at most once a year, on an agreed date and at the controller's expense, without compromising the security of other clients' data.
Article 9: After the end of the service
On request within 30 days of the end of the service, the processor will return the data as an export (CSV/JSON); no later than 90 days after the end it will delete the data, including copies and backups in the normal cycle, unless Union law or Slovak law requires it to be retained (Art. 28(3)(g)). This corresponds to Art. 13 of the GTC.
Article 10: Liability
Liability for damage resulting from an infringement of the GDPR is governed by Art. 82 GDPR. Towards a controller that is a business, the processor's liability for damage under this agreement is limited in accordance with Art. 15.1 of the GTC, except in cases of intent, gross negligence and fines imposed on the controller solely for a breach of the processor's obligations.
Article 11: Final provisions
This agreement is governed by the GDPR, Act No. 18/2018 Coll. on Personal Data Protection and the law of the Slovak Republic. It is concluded electronically together with the order (Signi). It is valid from the signing of the order.
Article 12: Product part
A. SFERIN (accommodation)
- Data subjects: guests and persons making a booking.
- Data: first name and surname, date and place of birth, nationality, e-mail, phone, address, type and number of identity document, for foreign nationals data under Act No. 404/2011 Coll. on Residence of Foreigners (visas, purpose of stay), dates, number of guests, price, payments, notes and communication, and for the client zone and newsletter the e-mail and consent. Special categories (Art. 9) are not processed.
- Purposes: operation of the website and the booking form, management of bookings, the guest register and guest records including online check-in, materials for the municipal accommodation tax and for reporting foreign guests, e-mails to guests (confirmation, advance invoice, instructions, review request), newsletter with consent.
- Further processors: the common ones (7.2).
B. ORDINUJ (medical practices)
- Data subjects: patients and persons making the appointment (parent, guardian), for veterinarians the owners of the animals.
- Data: first name and surname, phone, e-mail, health insurance company, chosen doctor, procedure and time, the patient's note (without diagnosis and without birth number), appointment status, waiting list; for a prescription request also the date of birth and the name of the medicine. Information about booking a procedure is data concerning health (Art. 9); it is processed under the professional secrecy of a healthcare professional, Art. 9(2)(h) and (3).
- Purposes: booking an appointment, confirmation and reminder by e-mail and SMS, cancellation and rescheduling, waiting list, forwarding prescription requests, administration for staff.
- Further processors: the common ones (7.2) plus the SMS gateway smsfarm.sk (Slovakia, delivery of reminders; it receives the phone number and the text of the SMS without the procedure or medicine).
- Specific provisions: breach notification within 24 hours; patient data encrypted; access only for the practice's staff accounts; access logs kept for 12 months and then deleted; patient data deleted automatically 12 months after the last appointment, unless the controller sets a shorter period; no consents where there is a legal basis (exception: a psychologist outside the healthcare system); template patient information and form texts with a version number at ordinuj.sk/dokumenty; any data protection impact assessment (DPIA) will be prepared by us as a template for all practices.
C. Business websites and custom websites
- Data subjects: website visitors, persons submitting forms, e-shop customers.
- Data: data from contact and order forms (name, e-mail, phone, message, address and order for an e-shop), IP address for protection against abuse.
- Purposes: delivery of the form to the client, processing of the order, protection against spam.
- Further processors: the common ones (7.2) plus, depending on the website (payment gateway, carrier), those listed in the order.
D. Operation and hosting of a third-party website
- The processor processes data only to the extent of storing and backing up the website's files and database and the e-mail mailboxes; the content and purposes are determined by the controller. Articles 4, 5, 6, 7.2, 8 and 9 apply.
| WebiSfer s. r. o. (processor) | Controller |
|---|---|
| date, signature | date, signature |