Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller") and Heartwood Digital operating as SlotWeave ("Processor"). This DPA applies to the processing of personal data that you submit to the SlotWeave platform on behalf of your end users.

1. Definitions

Controller: You, the SlotWeave operator, who determines the purposes and means of processing personal data collected through the booking widget.

Processor: Heartwood Digital (SlotWeave), which processes personal data on your behalf to provide the booking platform services.

Sub-processor: A third-party service provider engaged by SlotWeave to assist in processing personal data, such as infrastructure or email delivery providers.

2. Scope of Processing

SlotWeave processes the following categories of personal data on your behalf:

• End user names and email addresses provided during booking
• Phone numbers (when collected by your booking form)
• Booking details including dates, times, product selections, and group sizes
• Payment transaction references (not full card numbers)

Processing is performed solely for the purpose of providing the SlotWeave booking service, including storing bookings, sending confirmation and reminder emails, and generating reports within your operator dashboard.

3. Data Security Measures

SlotWeave implements appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Schema-level database isolation between operator accounts
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security reviews and dependency auditing
• Automated backups with encryption

4. Sub-processors

SlotWeave uses the following sub-processors:

• Amazon Web Services (AWS) — Infrastructure hosting (US/Canada regions)
• Stripe — Payment processing
• Postmark — Transactional email delivery

We will notify you at least 30 days before adding a new sub-processor. You may object to a new sub-processor by contacting us within that notice period. If we cannot reasonably accommodate your objection, you may terminate your account.

5. Data Subject Rights

SlotWeave will assist you in responding to data subject requests (access, correction, deletion, portability) to the extent that such requests relate to data processed through the platform. We provide data export tools in the operator dashboard. For deletion requests, we will remove the relevant personal data within 30 days of your instruction.

6. Data Breach Notification

In the event of a personal data breach, SlotWeave will notify you without undue delay and no later than 72 hours after becoming aware of the breach. Notification will include the nature of the breach, the categories of data affected, the approximate number of data subjects affected, and the measures taken or proposed to address the breach.

7. Data Transfer

SlotWeave infrastructure is hosted in Canada and the United States. Where personal data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent safeguards. We ensure all sub-processors maintain adequate data protection standards.

8. Termination

Upon termination of your SlotWeave account, we will delete or return all personal data processed on your behalf within 90 days, except where retention is required by law. You may export your data at any time before account deletion using the export tools in the operator dashboard.

For questions about this DPA, contact us at privacy@slotweave.com.