Data processing agreement

Last updated: 3 November 2026

This agreement (under Article 28 of the GDPR) is between the business that uses Atendari (the controller) and Anastasiia Matsakova, trabalhadora independente, NIF 311254934, Rua de 9 de Julho 50, Lote 3, 4050-433 Porto, who provides Atendari (the processor, "we"). It applies from the moment the business connects a channel or its booking system to Atendari, and forms part of the terms of service.

1. What we process

Subject and purpose	Answering the controller's clients in the channels it connects, booking, moving and cancelling appointments in its booking system, and showing the conversations to its team.
Duration	As long as the controller uses Atendari, then until deletion under section 8.
People concerned	The controller's clients and prospective clients who message it; the controller's team members who use the inbox.
Kinds of data	Messages (text); names, @usernames and phone numbers as the platforms provide them; booking details (service, time, location, master); team members' names and email addresses.
Special categories	None are needed. Clients sometimes mention health details (such as allergies); the assistant only passes them on to the team and the booking where relevant.

2. Instructions

We process the data only to provide Atendari as the controller has set it up (its settings, notes and connected accounts are its instructions), or where EU or Portuguese law requires it, in which case we tell the controller first unless the law forbids it. If we think an instruction breaks data protection law, we say so.

3. Confidentiality

Only the people who run Atendari can access the data, and only as far as needed to provide and support the service. They are bound to confidentiality.

4. Security

Encrypted connections (HTTPS) for the inbox, the webhooks and the providers we call.
The controller's logins and tokens for its channels and booking system stored encrypted; inbox passwords stored only as hashes.
The server in the EU (Frankfurt), with access limited to the people who run Atendari; each business's data kept separate from other businesses'.
Roles in the inbox (admin, staff), so the controller decides who sees what.
No message text, names or phone numbers in our usage analytics.

5. Sub-processors

The controller authorises these sub-processors:

Sub-processor	Purpose	Location
Oracle Cloud (Oracle Corporation)	Server and database	Germany (Frankfurt)
Anthropic, PBC	AI model generating the replies	United States
PostHog, Inc.	Usage and reliability metrics, without message content or contact details	European Union
Browser push services (Apple, Google, Mozilla)	Encrypted inbox notifications to team members	Their infrastructure

The messaging platforms (WhatsApp and Instagram by Meta, Telegram) and the booking system (EasyWeek) are the controller's own services, which it connects under its own agreements with them.

We bind each sub-processor to data protection obligations equivalent to these. We tell the controller at least 30 days before adding or replacing one; it can object, and if we can't resolve the objection, it can stop using Atendari.

6. Transfers outside the EEA

Anthropic processes data in the United States. We are moving our use of Anthropic to its business terms, which include a data processing agreement with the European Commission's Standard Contractual Clauses, and will tell the controller when that is done. Any other sub-processor outside the European Economic Area will be covered by such clauses or another safeguard under Chapter V of the GDPR.

7. Helping the controller

Requests from people (access, deletion and the other GDPR rights): if we receive one, we pass it to the controller and help it answer. The controller can read and delete conversations itself in the inbox.
Personal data breaches: we tell the controller without undue delay, and within 48 hours of becoming aware, with what we know, and help it meet its own duties.
Assessments: we give the information the controller needs for a data protection impact assessment or a question from an authority.

8. At the end

When the controller stops using Atendari, we delete its conversations, team accounts and stored logins within 30 days, unless the law requires us to keep something, and confirm when done. Before that, the controller can ask for a copy of its conversations.

9. Audits

We make available the information needed to show we meet this agreement, and answer the controller's reasonable questions. On reasonable notice and at its own cost, the controller or an auditor it appoints under confidentiality may audit our compliance, once a year or after a breach.

10. Everything else

Liability and law are as in the terms of service. If this agreement and the terms differ on personal data, this agreement prevails.