Data Processing Agreement (DPA)
Enterprise-grade GDPR and international privacy safeguards: our binding commitment to protect personal data processed through Semiora's scheduling infrastructure.
Data Processing Standard for Organizations
This Data Processing Agreement ("DPA") supplements the Semiora Terms of Service for customers subject to the European Union General Data Protection Regulation (GDPR), UK GDPR, or similar data privacy frameworks. It establishes that you remain the Data Controller, while Semiora processes data strictly pursuant to your instructions.
1. Parties & Scope
This DPA is entered into by and between Semiora Cloud Inc. ("Semiora", "Processor") and the customer organization ("Customer", "Controller"). It governs all processing of personal data provided by Customer or booking attendees through the Semiora scheduling platform.
2. Controller & Processor Roles
Customer is the Data Controller of all attendee information submitted to booking pages (including guest names, emails, meeting titles, answers to custom booking questions, and meeting timestamps). Semiora acts strictly as Data Processor, processing information solely in accordance with Customer's documented configuration.
3. Scope & Nature of Processing
- Subject Matter: Provision of calendar scheduling, availability management, workflow automation, and booking coordination.
- Categories of Data Subjects: Customer team members, clients, candidates, and meeting guests who schedule appointments.
- Categories of Personal Data: Names, email addresses, meeting schedules, form responses, and technical security metadata (IP address, user agent).
- Duration: For the duration of Customer's active subscription until account deletion.
4. Processor Obligations
Semiora agrees and covenants to:
- Process personal data exclusively to provide the scheduling services, adhering strictly to Customer's instructions.
- Ensure that all personnel authorized to access customer data have committed to binding confidentiality.
- Never sell, rent, monetize, or utilize customer data for behavioral advertising or third-party training.
- Assist Controller in responding to data-subject requests (access, rectification, erasure, and portability).
5. Security Incident Notification (72h)
In the event of a confirmed personal data breach affecting Customer data, Semiora will notify Customer without undue delay, and in any event within 72 hours of confirmation. The notice will describe the nature of the breach, affected data categories, likely consequences, and remediation actions taken.
6. Technical & Organizational Security Measures
We maintain comprehensive technical safeguards:
- Database Isolation: Native PostgreSQL Row-Level Security (RLS) guaranteeing strict cross-tenant data isolation.
- Encryption: End-to-end TLS 1.3 in transit; AES-256 for persistent database volume storage.
- Credential Hashing: Scrypt cryptographic memory-hard key derivation for credentials.
- Concurrency Controls: PostgreSQL transactional advisory locking preventing race conditions or slot double-bookings.
7. Authorized Sub-Processors
Customer provides general written authorization for Semiora to engage the following infrastructure sub-processors:
| Sub-processor | Role | Purpose | Location |
|---|---|---|---|
| Cloudflare, Inc. | Processor | Edge application hosting, CDN, R2 object asset storage, and Turnstile automated bot protection. | Global (Anycast Edge) |
| Supabase Inc. | Processor | Managed PostgreSQL database hosting, Hyperdrive connection pooling, and multi-tenant Row-Level Security isolation. | United States / EU |
| Upstash, Inc. | Processor | Serverless Redis cache storage for sub-millisecond rate-limiting and anti-abuse verification. | United States / EU |
| Resend, Inc. | Processor | Transactional email delivery for booking confirmations, calendar invites, and reschedule notices. | United States |
| Paddle.com Market Ltd | Processor | PCI-DSS Level 1 certified payment processing, Merchant of Record services, and billing compliance. | United Kingdom / EU / US |
User-Connected Integrations: External services that you explicitly connect (Google Calendar, Microsoft Outlook, Zoom, Slack) process meeting data based on your direction and are governed by your contracts with those services.
8. International Data Transfers
Where transfers of personal data outside the European Economic Area (EEA), United Kingdom, or Switzerland take place, the parties agree to incorporate by reference the European Commission Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum.
9. Data Deletion & Return
Upon termination of the service, Customer may export a full JSON dump of account and booking history. Following account deletion, Semiora permanently removes all personal data from active database instances within 30 days.
10. California (CCPA/CPRA) Compliance
To the extent the California Consumer Privacy Act applies, Semiora acts as a Service Provider. We do not sell or share personal information and will not retain, use, or disclose personal data for any purpose other than providing the scheduling services.
11. Contact & DPO
To execute a countersigned copy of this DPA or submit data protection inquiries, email our privacy desk:
Privacy & DPO: privacy@semiora.app
Compliance Desk: compliance@semiora.app
Entity: Semiora Cloud Inc.
Review our comprehensive platform agreements, refund rules, and data handling safeguards: