Data Processing Agreement

Version 2026-10-03

This agreement is between the business that uses Revisit (“you”, the controller) and Lucas Kamdoum, [postal address in Malta] (“Revisit”, “we”, the processor). It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR). You accept it in Revisit when you set up your business. It is part of our Terms of Use; for anything about personal data, this agreement prevails.

1. What we process for you

• Purpose: providing Revisit to you: storing your customers and their bookings, showing your free slots, preparing confirmation, reminder, review and “come back” messages, and calculating your results.
• People concerned: your customers, including anyone who books on your booking page.
• Data: first name, last name, mobile number, whether they live in Malta, their “come back” consent and its date, their bookings and whether they were done, cancelled or missed, the messages prepared for them and when they were sent, and the date they replied STOP.
• Duration: as long as you have a Revisit account.

Revisit is not designed for sensitive data. Do not enter health information or any other special category of data in Revisit.

2. Your instructions

We process your customers' data only on your instructions: this agreement, the Terms of Use, and what you do and set in Revisit. We never use it for our own purposes, never sell it and never contact your customers. If we think an instruction breaks data protection law, we tell you. If a law of the EU or of an EU country requires us to process the data otherwise, we tell you first, unless that law forbids it.

3. Confidentiality

Everyone who can access the data on our side is bound by a duty of confidentiality.

4. Security

We protect the data with appropriate technical and organisational measures (Article 32 GDPR), including:

• encrypted connections (HTTPS) and data encrypted at rest by our database provider;
• access rules enforced by the database itself, so each business can only reach its own data;
• passwords never stored in plain text;
• access to the production systems limited to the people who run Revisit.

5. Sub-processors

You allow us to use the following sub-processors:

• Supabase Inc.: database, accounts and file storage. Data stored in the European Union.
• Vercel Inc. (USA): website hosting. Transfers covered by the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

Each one is bound by data protection obligations at least as strict as ours, and we remain responsible for them. We tell you by email at least 30 days before adding or replacing a sub-processor. You can object; if we cannot meet your objection, you can close your account before the change.

6. Transfers outside the EU

Data leaves the European Economic Area only with the safeguards required by Chapter V of the GDPR, as listed above.

7. Helping you with your customers' rights

Revisit lets you delete a customer and all their data in one click, and record a customer who replied STOP. For any other request (for example a copy of a customer's data), we help you within a reasonable time. If a customer contacts us directly, we pass the request on to you without delay.

8. Helping you meet your own obligations

We help you, as far as we reasonably can, with the security of the processing, data breaches, data protection impact assessments and any consultation of a data protection authority (Articles 32 to 36 GDPR).

9. Data breaches

If we become aware of a personal data breach affecting your customers, we tell you without undue delay, and where possible within 48 hours, with the information we have, so that you can meet your own deadline to notify the authority.

10. Deletion at the end

When you delete a customer in Revisit, their data is deleted at once. When you close your account, we delete all your customers' data within 30 days, unless a law requires us to keep it. Before that, you can ask us at [contact email] for a copy of your data.

11. Audits

We give you all the information needed to show that we meet this agreement. You, or an auditor you appoint and who is bound by confidentiality, can audit us with reasonable notice, at your cost, once a year or after a data breach. We first answer your questions in writing, which is often enough.

12. Your responsibilities

• You have a lawful basis to use your customers' data in Revisit.
• You tick the “come back” box only when a customer really agreed, and you record every STOP in Revisit.
• You tell your customers how their data is used. You can point them to our Privacy Policy, which describes it.
• You send messages yourself, from your own WhatsApp. That sending is outside this agreement: it is between you and WhatsApp.

13. Liability, changes and law

Liability is as set out in the Terms of Use, without limiting either party's responsibility under Article 82 GDPR. If this agreement must change (new law, new sub-processor), we will ask you to accept the new version in Revisit. This agreement is governed by the laws of Malta, like the Terms of Use.

Contact

For anything about this agreement or your customers' data: [contact email].