Data Processing Agreement

Effective: 1 October 2026

concluded between:

the Company using the AgroBooker platform under the Terms of Use and/or a Service Agreement (the "Controller")

and

E. F. COMPUTERS j.d.o.o., Donji Srbani 137, 52474 Brtonigla, Croatia, OIB 71347174941, info@agrobooker.app (the "Processor").

This Agreement is made under Article 28 of Regulation (EU) 2016/679 ("GDPR") and forms an integral part of the Terms of Use. It is deemed concluded upon acceptance of the Terms of Use; at the Controller's request the parties may also sign it separately.

1. Subject matter and duration

1.1. The Processor processes personal data on behalf of the Controller in order to provide the AgroBooker platform (management of bookings, guests, wine club and notifications).

1.2. This Agreement lasts as long as the platform is used and ends once all data has been deleted or returned under section 10.

2. Nature and purpose of processing

Processing comprises collection through public booking forms, storage, organisation, viewing, modification, searching, export, sending notifications (email, SMS, WhatsApp), messaging and deletion — solely for:

• receiving and managing bookings for visits and tastings,
• keeping records of guests and wine club members,
• recording membership fees, payments and packages,
• sending notifications and messages to guests as enabled by the Controller,
• communication between the Controller's staff and guests.

Types and categories of data and data subjects are listed in Annex 1.

3. Controller's instructions

3.1. The Processor processes data only on documented instructions from the Controller. Instructions consist of this Agreement, the Terms of Use, the settings the Controller selects in the platform, and written requests sent by email.

3.2. The Processor will inform the Controller without delay if it believes an instruction infringes the GDPR or other data protection law.

3.3. If EU or Croatian law requires the Processor to process data otherwise, it will inform the Controller beforehand unless the law prohibits this.

4. Controller's obligations

The Controller is responsible for the lawfulness of processing, in particular:

• the legal basis for processing and informing data subjects (Arts. 13 and 14 GDPR), including displaying a notice on the booking form,
• obtaining consent where required — especially for promotional messages under the Croatian Electronic Communications Act (NN 76/22) and for any special categories of data (e.g. allergies or dietary requirements collected through custom fields),
• the accuracy of the data it enters and granting permissions to its staff,
• not entering unnecessary data into free-text fields.

5. Processor's obligations

The Processor:

• ensures that persons authorised to process the data are bound by confidentiality,
• implements the technical and organisational measures in Annex 2 (Art. 32 GDPR),
• accesses the Controller's data only when necessary for support, maintenance, security, or at the Controller's request,
• does not use the data for its own purposes, sell it, or disclose it to third parties other than the sub-processors under section 6,
• keeps a record of processing activities as a processor (Art. 30(2) GDPR),
• assists the Controller in meeting its obligations under Arts. 32–36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of processing and the information available.

6. Sub-processors

6.1. The Controller gives general written authorisation for the engagement of sub-processors. The sub-processors as at the effective date are listed in Annex 3.

6.2. The Processor will notify the Controller by email or in the app at least 30 days in advance of any intended addition or replacement of a sub-processor.

6.3. The Controller may object on reasonable data protection grounds within 14 days of the notice. If the parties cannot agree on a solution, the Controller may terminate the contract without notice before the new sub-processor starts processing its data, with a refund of prepaid fees for the unused period.

6.4. The Processor imposes on sub-processors data protection obligations equivalent to those in this Agreement and remains fully liable to the Controller for their performance.

7. International transfers

Data is stored primarily in the EU (Germany). Transfers outside the EU/EEA are permitted only with appropriate safeguards under Chapter V GDPR — an adequacy decision (e.g. the United Kingdom, the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses. Details are in Annex 3.

8. Assistance with data subject requests

8.1. The Processor assists the Controller in responding to data subject requests (Arts. 15–22 GDPR) primarily through platform features: viewing and correcting guest data, exporting all data about a guest in a machine-readable format (JSON), permanently erasing a guest's personal data (anonymisation that keeps bookings and payments for statistics and accounting), unsubscribing guests from optional notifications, and switching notification channels on and off.

8.2. Where platform features are insufficient, the Processor will carry out the necessary action on the Controller's written request within 10 business days.

8.3. If a data subject contacts the Processor directly, the Processor will not respond itself but will forward the request to the Controller without delay.

9. Personal data breaches

9.1. The Processor will notify the Controller of a personal data breach without undue delay and in any event within 48 hours of becoming aware of it.

9.2. The notice will include, as far as known: a description of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken and proposed, and a contact person. Information not immediately available will be provided later without delay.

9.3. The Processor will take reasonable steps to contain the breach and assist the Controller in notifying AZOP and data subjects. A breach notice is not an admission of liability.

10. Deletion and return of data

10.1. On termination, the Controller may within 30 days request an export of its data in a machine-readable format (CSV or JSON).

10.2. After that period the Processor permanently deletes all of the Controller's personal data. Data is removed from backups by rotation within a further 30 days at the latest. On request, the Processor confirms deletion in writing.

10.3. During the term, notification delivery records are automatically deleted after 12 months. The Controller retains and deletes other data according to its own retention rules.

11. Audits

11.1. On request, the Processor makes available to the Controller all information necessary to demonstrate compliance with this Agreement, normally in the form of written answers, documentation and sub-processor certifications.

11.2. If this is insufficient, the Controller or an independent auditor bound by confidentiality may conduct an audit no more than once a year (except after a data breach or at the request of a supervisory authority), with at least 30 days' notice, during business hours and without compromising other customers' data. The Controller bears the cost of the audit.

12. Liability and final provisions

12.1. Liability of the parties is governed by Art. 82 GDPR and the liability provisions of the Terms of Use.

12.2. In case of conflict on matters of personal data protection, this Agreement prevails over the Terms of Use.

12.3. Croatian law applies; the court with subject-matter jurisdiction in Pazin has jurisdiction.

12.4. In case of any discrepancy between the Croatian and English versions, the Croatian version prevails.

Annex 1 – Categories of data subjects and data

Categories of data subjects

• guests booking visits and tastings (directly, via staff or via an agency) and persons named in a booking,
• the Controller's recorded guests (customers),
• wine club members,
• recipients of club shipments and gift packages,
• persons exchanging booking-related messages with the Controller.

Categories of personal data

• Identification and contact data: name, email address, phone number, country, communication language.
• Booking data: date and time, location and visit type, number of guests, table/seating, ordered products, price, status (pending, confirmed, cancelled, checked in, no-show, completed), intermediary agency, security token for changing or cancelling the booking.
• Answers to custom fields defined by the Controller (e.g. dietary notes, age, country) and table notes.
• Guest profile: date of birth, marketing consent flag, VIP flag, last visit time, internal staff notes.
• Club membership: membership tier, member number, status, start and expiry dates, notes, external subscription identifier.
• Payments: amount, currency, payment method, reference, date, notes (no payment card data).
• Packages: status, shipping and delivery dates, courier, tracking number, notes.
• Communications: content of messages and notes between staff and the guest, including guests' email replies to booking notifications.
• Unsubscribes from optional notifications: email address and time of unsubscribing.
• Notification records: recipient address (email or phone number), notification type, channel, delivery status, provider message ID, cost, time.
• Technical data: IP address and browser data when accessing public forms.

Special categories of data

The platform is not designed to process special categories of data (Art. 9 GDPR). If the Controller collects health data (e.g. allergies) through custom fields or notes, it alone is responsible for the legal basis (normally explicit consent) and for limiting such data to the minimum necessary.

Annex 2 – Technical and organisational measures (TOMs)

Confidentiality

• All communication with the platform is encrypted via HTTPS/TLS.
• Passwords are stored only as bcrypt hashes; in production a password of at least 10 characters with letters and numbers is required, and passwords found in known breaches are rejected (k-anonymity check).
• Each Company's data is logically separated; every request verifies that the user belongs to the Company.
• Role-based access control with individual permissions within each Company; Agencies see only the bookings and visit types the Company has granted them.
• Session cookies are encrypted and flagged HttpOnly, Secure and SameSite=Lax; CSRF protection.
• Access through the API uses revocable access tokens.
• Only authorised Processor personnel have access to servers and the database, authenticated with SSH keys.

Integrity

• Rate limiting on login, the contact form, and public booking changes and cancellations.
• Input validation and HTML sanitisation of inbound email content.
• Links for changing or cancelling a booking are protected by a random secret token.
• Notification delivery records and technical logs for tracking errors and incidents.

Availability and resilience

• Hosting on Hetzner Online GmbH servers in data centres in Germany (ISO/IEC 27001 certified).
• Daily backups of the database and uploaded files, kept for 14 days and additionally copied to separate storage outside the production server (Hetzner Storage Box, Germany).
• Background queue processing with retries, and protection against duplicate notifications.

Data minimisation and retention

• Automatic deletion of notification records older than 12 months.
• Automatic session expiry and deletion.
• Soft deletion with permanent deletion available on request.

Organisational measures

• Confidentiality obligations for everyone with access to data.
• Data processing agreements with all sub-processors.
• Procedures for handling data breaches and data subject requests.
• Regular software and security updates, and code review before release.

Annex 3 – Sub-processors