GDPR FrameworkGDPR-Megfelelési Keretrendszer

Depoflow as Data Controller. Depoflow acts as a data controller where it determines the purposes and means of processing personal data for its own purposes, such as account administration, authentication, billing, customer support, security, fraud prevention, legal compliance, and operation of the Platform.

Depoflow as Data Processor. Where a business Customer uses Depoflow to process personal data of its End Clients in connection with appointments, booking records, policies, payment-related events, or dispute evidence, Depoflow may act as a processor on behalf of that Customer, subject to the actual service configuration and applicable Data Processing Agreement.

The Customer, where acting as Data Controller, remains responsible for determining the purposes and legal basis of its processing, providing appropriate privacy information to End Clients, establishing appropriate retention periods, responding to data-subject requests, and ensuring that personal data is collected and processed lawfully.

Depending on the circumstances and the relevant processing activity, processing may be based on a legal ground under Article 6 GDPR, including performance of a contract, compliance with a legal obligation, legitimate interests, or consent where appropriate. Processing of special-category data may additionally require an applicable Article 9 GDPR condition. Depoflow does not select or determine the Customer's legal basis for its own customer relationships.

Customers should configure and use the Service so that only personal data necessary for the relevant business purpose is processed. Customers should not enter unnecessary sensitive information, raw payment-card credentials, passwords, authentication secrets, or other unrelated personal information into appointment descriptions, notes, or other fields.

Depoflow is not intended to be a general-purpose system for storing special categories of personal data under Article 9 GDPR, including health, biometric, or similar sensitive information. Customers remain responsible for preventing unnecessary entry of such information and for determining whether any processing of special-category data is lawful and subject to additional safeguards.

Individuals may have rights under Chapter III GDPR, including rights of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent where consent is the applicable legal basis. The availability and scope of a particular right depend on the circumstances and applicable law.

Where the processing concerns a Customer's End Clients and Depoflow acts as processor, End Clients should generally direct their requests to the relevant Customer as Data Controller. Depoflow will provide the assistance required of a processor under applicable law and the relevant Data Processing Agreement.

Where required by applicable law and the applicable DPA, Depoflow may assist Customers with data-subject requests, security obligations, personal-data breach management, and other processor obligations. The scope of assistance depends on the nature of the processing and the technical capabilities of the Service.

Depoflow may use third-party service providers to operate components of the Platform, such as authentication, payment infrastructure, calendar synchronization, hosting, storage, communications, or monitoring. The final list of subprocessors must reflect the providers actually used in the production environment and should be maintained in the applicable DPA or subprocessor documentation.

Where Depoflow processes personal data on behalf of a Customer, the parties should enter into a Data Processing Agreement meeting the requirements of Article 28 GDPR. The DPA should address, among other matters, processing instructions, confidentiality, security, subprocessors, assistance, deletion or return of data, and audit or compliance information as applicable.

Depoflow is intended to implement appropriate technical and organisational measures proportionate to the risks associated with the processing. Depending on the actual architecture, these measures may include access controls, encryption in transit, authentication controls, logging, backups, environment separation, and incident response procedures. The final description should be verified against the production implementation.

Where Depoflow becomes aware of a personal-data breach affecting Customer data processed on the Customer's behalf, Depoflow will handle the incident in accordance with applicable law and the relevant DPA, including providing information and assistance where required. Customers remain responsible for their own controller-level notification obligations.

Personal data should be retained only for as long as necessary for the applicable purpose or as required by law or contractual obligations. Different categories of data may require different retention periods, including account records, billing records, security logs, booking information, and dispute-related evidence. Final retention periods must be documented based on the actual production system and legal requirements.

Where personal data is transferred outside the European Economic Area, Depoflow will rely on an applicable lawful transfer mechanism where required, such as an adequacy decision, EU Standard Contractual Clauses, or another mechanism recognised under applicable data protection law. The actual transfer locations and mechanisms should be documented according to the production infrastructure and subprocessors.

Where a Customer connects Google Calendar, Depoflow processes the calendar information made available through the authorised integration to provide the applicable calendar synchronization functionality. Access should be limited to the scopes and data necessary for the enabled functionality. Calendar information is not intended to be sold or used for advertising purposes by Depoflow.

Payment-card processing is performed through the applicable payment provider. Where the production implementation uses Stripe-hosted or tokenized payment components, Depoflow is intended to avoid storing full card numbers and CVV security codes. Depoflow may nevertheless process payment-related metadata, such as transaction identifiers, authorization status, amounts, timestamps, and related booking information, depending on the implementation.

Evidence Dossiers may bring together relevant booking records, policy-acceptance information, timestamps, payment events, and other available records to assist Customers with payment disputes. The Customer remains responsible for determining the lawful purpose and appropriate use of such evidence and for complying with applicable data-protection requirements.

Customers remain responsible for assessing whether their processing activities require a Data Protection Impact Assessment under Article 35 GDPR. Depoflow may provide information about its processing activities or technical measures where reasonably necessary for a Customer's assessment and where required under the applicable contractual arrangements.

The Platform may maintain technical records and audit logs relating to account actions, booking events, payment-related events, integration activity, and security events. Such records support platform operation, troubleshooting, security, accountability, and dispute evidence where applicable. Retention should be limited according to the applicable purpose and documented retention policy.

Depoflow aims to incorporate data-protection principles into the design and operation of the Platform, including data minimization, purpose limitation, access controls, separation of authentication and application functionality, and appropriate Customer controls.

Customers are responsible for maintaining the security of their accounts, controlling internal access, using appropriate authentication practices, protecting credentials and integration secrets, and ensuring that authorised personnel use the Platform appropriately. Customers should promptly address suspected unauthorised access or security incidents.

Depoflow acts as a Data Controller for personal data processed for its own business purposes, which may include Customer account information, authentication information, billing records, support communications, security records, and other information necessary to operate and administer the Platform.

In Hungary, the national data-protection supervisory authority is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). Depending on the circumstances of a particular processing activity, individuals may have rights to lodge a complaint with a competent supervisory authority under applicable GDPR rules.

Privacy and data-protection inquiries concerning Depoflow can be directed to support@depoflow.hu.

This GDPR framework should be read together with the applicable Privacy Policy, Terms of Service, Cookie Policy, Payment Processing Disclosure, and any Data Processing Agreement entered into with a Customer.

Depoflow may update this framework when its services, infrastructure, processing activities, contractual arrangements, or applicable legal requirements materially change. The displayed revision date should be updated when a new version is published.

This page describes Depoflow's intended data-protection framework and does not constitute legal advice, a certification of GDPR compliance, or a substitute for a Customer's own legal assessment. The final version should be reviewed against the actual production architecture, data flows, subprocessors, retention periods, international transfers, and contractual arrangements before publication.