Data Processing Agreement

This Data Processing Agreement ("DPA") describes how Write Me TG ("Processor") processes personal data on behalf of a Business ("Controller") using the Platform to manage its own Customers' bookings, as described in our Privacy Policy (Section 6). It is incorporated by reference into our Terms of Service and applies automatically to every Business Account, without a separate signature, for as long as the Business uses the Platform to process Customer booking data.

The subject matter is the processing of Customer booking data through the Platform's scheduling, notification, and booking-management functions. Processing continues for as long as the Business Account is active, and ends on account deletion as described in our Privacy Policy (Section 13).

Write Me TG processes Customer booking data solely to provide the booking, scheduling, notification, and related administrative functions the Business configures and uses — storing, displaying, and transmitting that data as instructed by the Business through its use of the Platform. We do not process it for our own separate purposes.

Data subjects:the Business's Customers (people who book appointments) and, where relevant, the Business's own Staff Members.

Categories of data: Customer name and phone number; Telegram identifiers (Telegram ID, username, first/last name) where a Customer books via the Telegram Mini App; appointment details (service, staff member, date, time, status); and notification delivery records related to those appointments.

Write Me TG processes Customer booking data only on the Business's documented instructions, which are given by the Business's configuration and use of the Platform (the services, staff, and schedules it sets up, and the bookings it manages). We will inform the Business if an instruction, in our reasonable opinion, infringes applicable data protection law.

Write Me TG ensures that any person authorized to process Customer booking data (including our own staff and any subprocessor's personnel) is subject to an appropriate duty of confidentiality.

We apply technical and organizational measures appropriate to the risk, including: database-level tenant isolation so one Business's data is never readable by another; hashed password storage; HttpOnly, Secure session cookies for the Owner Dashboard; and access controls limiting who can act on a Business Account. See our Privacy Policy (Section 14) for further detail.

The Business authorizes Write Me TG to engage the subprocessors listed on our Subprocessors page to support the Platform. We will update that page when a subprocessor materially relevant to Customer booking data is added or removed, and remain responsible for a subprocessor's performance of its data protection obligations to the same extent we are directly responsible.

Dodo Payments, our selected Merchant of Record for paid subscriptions (see our Terms of Service, Section 8), is not engaged under this DPA and does not process Customer booking data as our subprocessor. Dodo's role is limited to payment, subscription, and related Merchant-of-Record functions for a Business's own subscription to the Platform, handled under Dodo's own terms as an independent party, and is listed separately on our Subprocessors page once that integration is live.

Where processing Customer booking data involves a transfer outside the European Economic Area — for example through Cloudflare's global network, or Telegram's own infrastructure — we rely on the transfer safeguards available from the provider involved, such as the European Commission's Standard Contractual Clauses where applicable, as distinct from the Article 28 processing terms in this DPA. See our Privacy Policy (Section 11) and Subprocessors page for details by provider.

Where the Business is established in the European Economic Area (EEA) and Write Me TG processes Customer booking data outside the EEA, the parties agree that the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) are hereby incorporated into this DPA by reference.

Taking into account the nature of the processing, Write Me TG will assist the Business, insofar as reasonably possible, in responding to requests from its Customers to exercise their data protection rights, and in the Business's obligations regarding security, breach notification, and (where applicable) data protection impact assessments, by providing relevant information about how the Platform processes the data in question.

Write Me TG will notify the affected Business without undue delay and, where feasible, within 48 to 72 hours after becoming aware of a personal data breach affecting that Business's Customer booking data, and will provide the information reasonably available to us to help the Business meet its own notification obligations.

On termination of the Business Account, Write Me TG deletes Customer booking data as described in our Privacy Policy (Section 13), except where retention is required by applicable law. A Business may request an export of its own Customer booking data in a structured, commonly used format (such as JSON or CSV) before closing its account by contacting [email protected].

Write Me TG will make available to the Business the information reasonably necessary to demonstrate compliance with this DPA, and will respond to reasonable written requests for information about our processing of Customer booking data. Given the size and stage of our operation, we do not currently support on-site audits; we will consider reasonable requests for a remote review on a case-by-case basis.

The Business remains responsible for: having a valid legal basis to collect and use its Customers' data; the accuracy of the instructions it gives through its use of the Platform; and its own compliance obligations toward its Customers, independent of Write Me TG's role as processor.

This DPA covers only Write Me TG's role as processor of Customer booking data. For its own Business Owner/Staff Member account data, security and audit logging, and (once introduced) subscription billing records, Write Me TG acts as an independent controller in its own right, as described in our Privacy Policy (Section 6) — those activities are not delegated by, or performed on behalf of, the Business.

Questions about this DPA can be sent to [email protected].