Data Processing Agreement

Version 1.0 — Effective 20 October 2026

This DPA forms part of the Terms between the Practitioner ("Controller") and Bojana Radulović PR Računarsko programiranje Rainbowit Dragon Ledinci (trade name: Rainbowit Dragon), Provalije 24A, Ledinci, Novi Sad, Republic of Serbia ("Processor"), and applies to personal data of the Controller's clients processed in Ophelion. It is accepted electronically at sign-up.

1. Subject matter & duration: provision of Ophelion for the term of the subscription + 30-day export period. 2. Nature & purpose: hosting, storage, scheduling, record keeping, client portal, AI-assisted summaries, chat and transcription — only to provide the service. 3. Categories of data subjects: Controller's clients/prospective clients, their contacts, Controller's staff. 4. Categories of data: identification and contact data, appointment data, notes, homework, documents, payment records, portal messages, audio recordings/transcripts; special categories (health, mental-health and wellbeing data; possibly religious/beliefs or sex-life data if entered by the Controller). 5. Controller instructions: Processor processes data only on documented instructions (these Terms, DPA and in-app configuration), unless required by law (in which case it informs the Controller unless prohibited). (Art. 28(3)(a)) 6. Confidentiality: persons authorised to process data are bound by confidentiality. (28(3)(b)) 7. Security: Processor implements measures under Art. 32 — Annex 1. (28(3)(c)) 8. Subprocessors: Controller gives general authorisation for subprocessors listed at /subprocessors. Processor notifies changes at least 30 days in advance (email/in-app); Controller may object and terminate if unresolved. Processor imposes equivalent obligations and remains liable. (28(2), 28(4)) 9. Data subject requests: Processor assists via in-app tools (export, edit, delete) and forwards requests it receives. (28(3)(e)) 10. Assistance: with security, breach notification, DPIAs and prior consultation (Arts. 32–36). (28(3)(f)) 11. Personal data breach: Processor notifies Controller without undue delay and in any case within 48 hours of becoming aware, with available details (Art. 33(2)). 12. Deletion/return: at end of service Controller can export; data deleted within 30 days, backups within 35 days, unless law requires retention. (28(3)(g)) 13. Audits: Processor provides information necessary to demonstrate compliance and allows reasonable audits (primarily by documentation/questionnaire, on-site max once a year with 30 days' notice, at Controller's cost). (28(3)(h)) 14. International transfers: Processor is established in Serbia; for transfers from the EU the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (Controller→Processor) [and Module 3 for subprocessors], incorporated by reference [VERIFY WITH LAWYER]. 15. AI: client data is not used to train AI models; OpenAI API data is not used for training per OpenAI policy and may be retained up to 30 days for abuse monitoring. 16. Controller obligations: lawful basis and explicit consent for special-category data and AI processing; informing clients; not using Ophelion for emergencies. 17. Liability: as in the Terms. 18. Precedence: DPA prevails over Terms for data protection matters.

Annex 1 – Technical & organisational measures: TLS 1.2+; AES-256 encryption at rest (Supabase); Postgres Row Level Security per practice; MFA available; least-privilege admin access; service-role keys server-only; webhook signature verification; daily backups [on Supabase Pro]; logging & monitoring; secure development (code review, dependency updates); incident response procedure.

Annex 2 – Subprocessors: see /subprocessors.