Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) supplements the Terms of Service (“Agreement”) entered into by and between ItGuysCan Mirosław Farajewicz, Zbożowa 3/14, Kraków, Poland, VAT ID: PL6842536537 (“Processor”, “we”, “us”) and the entity or individual subscribing to the Service (“Controller”, “you”).

1. Purpose and scope

1. Roles. The Controller acts as the Data Controller and the Processor acts as the Data Processor pursuant to Article 28 of the General Data Protection Regulation (GDPR).
2. Subject matter. The Processor provides an automated iCal feed monitoring and webhook delivery service as described in the Terms of Service.
3. Categories of data. iCal feed URLs (which may contain embedded personal access tokens), calendar event metadata (summaries, timestamps, locations, UIDs), and target webhook callback URLs.
4. Categories of data subjects. Individuals whose calendar events or personal data are contained within the monitored iCal feeds.

2. Obligations of the Processor

1. Instructions. The Processor shall process personal data solely on documented instructions from the Controller, including with respect to transfers of personal data outside the EEA.
2. Confidentiality. The Processor ensures that personnel authorized to process personal data are bound by strict obligations of confidentiality.
3. Security measures. The Processor implements appropriate technical and organizational measures to ensure data security, including payload encryption in queue buffers, transient in-memory processing, and hash-based change detection at rest.
4. Data minimization (notify_only mode). The Processor offers a notify_only mode wherein only feed change alerts (without calendar event payload content) are processed and transmitted.

3. Sub-processors

1. The Controller provides general authorization for the Processor to engage third-party sub-processors to support the execution of the Service.
2. Authorized sub-processors:
   • Hetzner Online GmbH — cloud infrastructure and server hosting, located in the EU.
   • Stripe, Inc. — payment processing and billing services.
3. The Processor shall inform the Controller of any intended changes or additions regarding sub-processors, giving the Controller the opportunity to object.

4. Data security and log retention

1. Transient processing. Event diff payloads stored temporarily in queues during delivery retries or outage windows are encrypted and handled transitively.
2. Retention. Webhook delivery logs, execution histories, and diagnostic data are automatically deleted after 30 days.
3. SSRF and network protection. The Processor uses isolated outbound proxies and request validation to mitigate Server-Side Request Forgery (SSRF) and related security risks.

5. Data subject rights and breach notification

1. Assistance. Taking into account the nature of processing, the Processor shall assist the Controller in responding to requests from data subjects exercising their rights under the GDPR.
2. Breach notification. The Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach affecting the Controller's data.
3. Audits. The Processor shall provide the Controller with the necessary information to demonstrate compliance with Article 28 of the GDPR.

6. Termination and data deletion

Upon termination of the Agreement or deletion of the account, the Processor shall delete or return all personal data processed on behalf of the Controller, unless EU or Polish law requires continued storage.