Data Processing Agreement (DPA)
This DPA forms part of the AMONS Terms whenever TONATOMETO s.r.o. processes personal data on behalf of a Customer. It is intended to satisfy Article 28 GDPR requirements and will be reviewed by legal counsel before final sign-off.
1. Roles and instructions
The Customer is controller (or a processor authorised by the relevant controller) and TONATOMETO s.r.o. is processor for personal data processed through AMONS booking, CRM, websites, reminders and related Customer-controlled features. AMONS processes that data only on documented instructions, including the Customer’s use and configuration of the service, unless law requires otherwise.
2. Subject matter and duration
Processing covers hosting and operating the AMONS service for the duration of the subscription plus a limited period required for deletion, backup rotation, security and legal obligations.
3. Data and data subjects
Data can include names, email addresses, telephone numbers, booking and service information, communications, preferences, notes supplied by the Customer, technical identifiers and other data the Customer chooses to place in AMONS. Data subjects can include the Customer’s clients, prospects, staff, contractors and business contacts.
4. Confidentiality and security
AMONS restricts access to authorised persons subject to confidentiality obligations and implements appropriate technical and organisational measures including encrypted transport, access control, tenant separation, secret management, logging, backups and security monitoring appropriate to the risk.
5. Subprocessors
The Customer authorises the subprocessors reasonably required to provide AMONS. Current core subprocessors are: Railway for backend and database infrastructure; Vercel for frontend hosting, CDN and domain delivery; Resend for transactional email; and OpenAI for AI-assisted functionality when invoked. AMONS remains responsible for subprocessor obligations to the extent required by applicable data-protection law and will maintain contractual protections appropriate to the processing.
6. Stripe and other independent providers
Stripe primarily processes the Customer’s AMONS subscription payment and tax information under Stripe’s own legal obligations and may act as an independent controller for those activities. Customer-selected integrations or third-party content may be governed separately.
7. International transfers
Where processor data is transferred outside the EEA and GDPR requires a transfer mechanism, AMONS will use an applicable adequacy decision, Standard Contractual Clauses or another lawful mechanism and appropriate safeguards.
8. Assistance
Taking into account the nature of processing, AMONS will reasonably assist the Customer with data-subject requests, security obligations, breach notifications, DPIAs and regulator consultations where required by GDPR. Additional work beyond ordinary product functionality may be chargeable where legally permitted and agreed.
9. Personal-data incidents
AMONS will notify the Customer without undue delay after becoming aware of a personal-data breach affecting processor data and will provide information reasonably available to support the Customer’s obligations.
10. Deletion and return
On termination and on the Customer’s documented instruction, AMONS will delete or return processor data within a reasonable period, except where retention is required by law or data remains temporarily in protected backups until normal rotation.
11. Audit information
AMONS will make available information reasonably necessary to demonstrate compliance with this DPA and allow proportionate audits where required by Article 28 GDPR, subject to confidentiality, security and reasonable scheduling requirements.
12. Priority
If this DPA conflicts with the Terms on processing of personal data, this DPA controls for that subject. Mandatory data-protection law prevails over conflicting contractual language.