Last updated: July 28, 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between Servv Inc. (“Servv”, “ServvAI”, “we”, “us”, or “Processor”) and the merchant or other customer using ServvAI Events & Bookings (“Customer”, “you”, or “Controller”) for the provision of Servv’s booking, scheduling, event, appointment, calendar, notification, integration, and related services (the “Services”).
This DPA applies where Servv processes Personal Data on behalf of Customer in circumstances governed by the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, or other applicable data protection laws that require a written data processing agreement.
Executive Summary
- Customer acts as Controller and determines the purposes and means of processing Personal Data submitted to or processed through the Services.
- Servv acts as Processor and processes Personal Data only to provide, secure, support, maintain, and improve the Services, or as otherwise instructed by Customer.
- Servv applies technical and organisational measures designed to protect Personal Data, including access controls, encryption in transit, monitoring, logging, backup procedures, employee confidentiality, vendor management, and incident response.
- Servv may use subprocessors to deliver the Services, but remains responsible for requiring subprocessors to protect Personal Data under written obligations that are materially no less protective than this DPA.
- Servv assists Customer with data subject requests, security incidents, audits, deletion or return of Personal Data, and other compliance obligations as required by applicable law.
1. Definitions
1.1 “Applicable Data Protection Law” means all privacy and data protection laws applicable to Servv’s processing of Personal Data under this DPA, including, where applicable, Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any laws implementing or supplementing them.
1.2 “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, “Process”, and “Subprocessor” have the meanings given to them under Applicable Data Protection Law. For this DPA, Customer is the Controller and Servv is the Processor unless the parties agree otherwise in writing.
1.3 “Customer Data” means Personal Data that Customer submits to the Services, makes available to Servv, or instructs Servv to process in connection with the Services.
1.4 “Services” means ServvAI Events & Bookings and related booking, scheduling, appointment, event, class, workshop, service, training, integration, notification, analytics, support, and platform services provided by Servv.
2. Scope and Order of Precedence
2.1 This DPA applies only to Servv’s processing of Customer Data as Processor on behalf of Customer.
2.2 If there is a conflict between this DPA and another agreement between the parties, this DPA controls with respect to the processing of Customer Data to the extent required by Applicable Data Protection Law. The parties’ commercial agreement controls all other matters.
2.3 Annex I describes the subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects. Annex II describes Servv’s technical and organisational measures. Annex III describes subprocessors and subprocessor categories.
3. Roles of the Parties
3.1 Customer determines the purposes and means of processing Customer Data and is responsible for providing all required notices, obtaining all required consents, selecting appropriate privacy settings, and ensuring that Customer’s instructions to Servv comply with Applicable Data Protection Law.
3.2 Servv processes Customer Data only as Processor and only for the purposes described in this DPA, the applicable services agreement, Customer’s documented instructions, or as required by law.
3.3 Servv does not intentionally collect or process special categories of Personal Data under GDPR Article 9 through the Services. Customer must not submit special category data unless the parties have expressly agreed in writing and Customer has established a lawful basis and safeguards required by Applicable Data Protection Law.
4. Customer Instructions
4.1 Customer instructs Servv to process Customer Data as necessary to provide the Services, including booking management, appointment scheduling, event registration, calendar synchronization, notifications, reminders, video meeting integrations, merchant dashboard functionality, service analytics, customer support, fraud prevention, security logging, backups, and service monitoring.
4.2 Customer’s documented instructions include this DPA, the applicable services agreement, Customer’s use and configuration of the Services, support requests, integration settings, and any other written instructions accepted by Servv.
4.3 Servv will promptly inform Customer if, in Servv’s reasonable opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law.
5. Confidentiality
5.1 Servv will ensure that persons authorized to process Customer Data are bound by confidentiality obligations or are under an appropriate statutory duty of confidentiality.
5.2 Servv will limit access to Customer Data to personnel and contractors who need access to provide, maintain, secure, or support the Services.
6. Security Measures
6.1 Servv will implement and maintain appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
6.2 The measures include, as appropriate to the nature of the Services and the risks presented by processing, encryption in transit, encryption at rest where applicable, access controls, role-based permissions, least privilege access, authentication controls, infrastructure monitoring, logging, backup procedures, incident response procedures, business continuity practices, secure software development practices, employee confidentiality obligations, vendor management, and regular security updates.
6.3 Customer is responsible for using the Services securely, including protecting account credentials, configuring access permissions appropriately, and ensuring that Customer’s integrations and third-party applications are authorized and secure.
7. Subprocessors
7.1 Customer grants Servv general written authorization to engage subprocessors to process Customer Data for the purposes of providing the Services.
7.2 Servv will enter into a written agreement with each Subprocessor that imposes data protection obligations materially no less protective than those in this DPA, to the extent applicable to the services provided by that Subprocessor.
7.3 Servv remains responsible to Customer for the performance of its subprocessors’ obligations under this DPA, subject to the limitations of liability in the applicable services agreement.
7.4 Servv may update its subprocessor list from time to time as necessary to operate and improve the Services. Servv will provide a mechanism for Customer to receive notice of material subprocessor changes and an opportunity to object where required by Applicable Data Protection Law. If Customer objects on reasonable data protection grounds, the parties will work in good faith to address the objection. If the objection cannot be resolved, Customer may stop using the affected Services.
8. Assistance with Data Subject Requests
8.1 Taking into account the nature of processing, Servv will provide reasonable assistance to Customer through appropriate technical and organisational measures to help Customer respond to requests from Data Subjects exercising rights under Applicable Data Protection Law.
8.2 If Servv receives a request directly from a Data Subject relating to Customer Data, Servv will, where legally permitted, direct the requester to Customer or notify Customer. Servv will not independently respond to the request except as instructed by Customer or required by law.
9. Assistance with Compliance
9.1 Taking into account the nature of processing and the information available to Servv, Servv will provide reasonable assistance to Customer with Customer’s obligations relating to security of processing, personal data breach notification, data protection impact assessments, and prior consultation with supervisory authorities, where required by Applicable Data Protection Law.
9.2 Servv may charge reasonable fees for assistance that is outside the standard functionality of the Services, unless the assistance is required because of Servv’s breach of this DPA.
10. Personal Data Breach
10.1 Servv will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data.
10.2 Servv’s notice will include information reasonably available to Servv to help Customer meet its breach notification obligations, which may include the nature of the incident, categories and approximate number of affected Data Subjects and records, likely consequences, measures taken or proposed to address the incident, and contact information for follow-up.
10.3 Servv will take reasonable steps to investigate, contain, mitigate, and remediate the Personal Data Breach. Customer is responsible for determining whether notification to supervisory authorities or Data Subjects is required.
11. Return or Deletion of Customer Data
11.1 Upon termination or expiration of the Services, Servv will delete or return Customer Data in accordance with the applicable services agreement, Customer’s documented instructions, and Servv’s retention practices, unless law requires continued retention.
11.2 Customer Data contained in backups may remain in secure backup systems until overwritten or deleted in accordance with Servv’s backup retention cycle, provided that such data remains protected and is not actively processed except for restoration, security, continuity, or legal compliance purposes.
12. Records and Audit Rights
12.1 Servv will maintain records of processing activities as required by Applicable Data Protection Law.
12.2 Servv will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, where required by Applicable Data Protection Law.
12.3 Audits must be conducted during normal business hours, with reasonable advance notice, subject to reasonable confidentiality and security requirements, no more than once annually unless required by a supervisory authority or following a confirmed Personal Data Breach, and in a manner that minimizes disruption to Servv’s business and does not compromise the security or confidentiality of other customers’ information.
13. International Transfers
13.1 Servv and its subprocessors may process Customer Data in countries outside the European Economic Area, the United Kingdom, or Switzerland, including Canada and the United States, where necessary to provide the Services.
13.2 Where Customer Data is transferred internationally in a manner restricted by Applicable Data Protection Law, Servv will ensure that an appropriate transfer mechanism is in place, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, the Swiss addendum or required Swiss adaptations, or another lawful transfer mechanism.
13.3 Where the Standard Contractual Clauses apply, the parties agree that the applicable module will be selected based on the parties’ roles, the optional docking clause will apply where appropriate, and the Annexes to this DPA will provide the information required for the SCC annexes unless the parties execute separate SCC annexes.
14. Cooperation with Supervisory Authorities
14.1 Servv will cooperate, as reasonably required and legally permitted, with Customer and competent supervisory authorities in connection with matters relating to Servv’s processing of Customer Data under this DPA.
15. Customer Responsibilities
15.1 Customer is responsible for ensuring that it has a lawful basis for processing Customer Data through the Services and that Customer’s use of the Services complies with Applicable Data Protection Law.
15.2 Customer is responsible for the accuracy, quality, and legality of Customer Data and the means by which Customer acquired Customer Data.
15.3 Customer will not use the Services to process Personal Data in a way that violates Applicable Data Protection Law or this DPA.
16. Liability
16.1 Each party is responsible for its own compliance with Applicable Data Protection Law.
16.2 To the maximum extent permitted by law, each party’s liability under this DPA is subject to the exclusions and limitations of liability in the applicable services agreement between the parties, unless Applicable Data Protection Law requires otherwise.
16.3 Nothing in this DPA limits either party’s liability to Data Subjects where such limitation is prohibited by Applicable Data Protection Law.
17. Governing Law
17.1 Unless the parties agree otherwise in the applicable services agreement, this DPA is governed by the law specified in that agreement. If the services agreement does not specify governing law, the parties should confirm the governing law before publication or execution of this DPA. Servv may elect Ontario, Canada, or another appropriate jurisdiction.
18. Changes to this DPA
18.1 Servv may update this DPA from time to time to reflect changes in law, the Services, subprocessors, or security practices. Material changes will not reduce the overall level of protection for Customer Data during an active services term without Customer’s consent where required by Applicable Data Protection Law.
Annex I: Details of Processing
| Subject matter | Processing of Customer Data in connection with ServvAI Events & Bookings and related Services. |
| Duration | For the duration of Customer’s use of the Services and any additional period required for deletion, return, backup retention, dispute resolution, security, or legal compliance. |
| Nature and purpose | Providing, securing, supporting, maintaining, monitoring, and improving booking, scheduling, appointment, event registration, class, workshop, service, training, calendar, notification, reminder, video meeting, merchant dashboard, support, fraud prevention, backup, and service monitoring functionality. |
| Processing activities | Collection, recording, organization, structuring, storage, hosting, retrieval, consultation, transmission, disclosure to authorized integrations and subprocessors, alignment, restriction, deletion, and other processing necessary to provide the Services. |
| Categories of Personal Data | Customer name, email address, optional phone number, booking details, appointment information, event registrations, order identifiers, payment status excluding full payment card information, time zone, calendar availability, staff assignments, customer notes, IP address, device and browser information, log data, notification history, merchant account information, and information about employees and staff added by merchants. |
| Special categories | Servv does not intentionally process special categories of Personal Data under GDPR Article 9. Customer must not submit such data unless separately agreed in writing. |
| Categories of Data Subjects | Customers, prospective customers, merchant employees, merchant staff, store administrators, event attendees, appointment attendees, class attendees, workshop attendees, service participants, and training participants. |
| Frequency of transfer | Continuous or as initiated by Customer, Customer’s users, Data Subjects, integrations, or automated service processes. |
Annex II: Technical and Organisational Measures
| Measure | Description |
|---|---|
| Encryption in transit | Customer Data is protected in transit using industry-standard encrypted transport where supported by the relevant service, integration, or network path. |
| Encryption at rest | Customer Data is encrypted at rest where applicable based on the storage service, database, infrastructure provider, and technical feasibility. |
| Access controls | Access to production systems and Customer Data is restricted to authorized personnel with a business need. |
| Role-based permissions | Administrative access is assigned based on job function and reviewed or updated as roles change. |
| Least privilege | Personnel are granted the minimum access reasonably required to perform their responsibilities. |
| Authentication | Systems require authenticated access, and stronger authentication controls may be applied to sensitive administrative functions. |
| Logging and monitoring | Servv uses logging and monitoring designed to support service reliability, security review, fraud prevention, and incident investigation. |
| Backup procedures | Backups are maintained to support availability, restoration, business continuity, and resilience. |
| Incident response | Servv maintains procedures to identify, investigate, escalate, contain, and remediate security incidents. |
| Business continuity | Servv uses infrastructure, backup, restoration, and operational practices designed to support continuity of the Services. |
| Secure development | Servv applies secure software development practices, including code review, vulnerability remediation, dependency updates, and security-conscious deployment practices. |
| Employee confidentiality | Personnel with access to Customer Data are subject to confidentiality obligations. |
| Vendor management | Servv assesses and contracts with vendors and subprocessors that support operation of the Services and requires appropriate data protection obligations. |
| Security updates | Servv applies regular updates and patches to systems under its control, taking into account severity, operational risk, and technical feasibility. |
Annex III: Subprocessors
The following table identifies common categories of subprocessors and representative providers that may support the Services. Servv should confirm the definitive current list, locations, and transfer mechanisms before publication and keep the list updated.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| AWS | Cloud infrastructure, hosting, storage, backup, compute, and related infrastructure services. | AWS regions selected by Servv; support and service subprocessors may vary by AWS service. | Adequacy decision, SCCs, or other applicable safeguard. |
| Shopify | Shopify app platform, merchant account context, order-related booking information, and app integration services. | Determined by Shopify for the merchant’s Shopify store and Shopify Partner services; Shopify indicates initial processing in Ireland for EEA, UK, and Swiss personal data, with Shopify affiliates and subprocessors processing globally as needed. | Adequacy decision, SCCs, or other applicable safeguard. |
| Stripe | Payment status, billing, subscription, invoice, and payment-related services, excluding full payment card storage by Servv. | United States, EU/EEA, and other Stripe affiliate or subprocessor locations depending on account and service. | Adequacy decision, SCCs, or other applicable safeguard. |
| Brevo | Email, marketing, transactional messaging, or notification support where enabled. | EU/EEA and other Brevo affiliate or subprocessor locations used to provide messaging services. | Adequacy decision, SCCs, or other applicable safeguard. |
| Amazon SES | Transactional email delivery and notification support. | AWS regions selected by Servv and global email routing locations as necessary for delivery. | Adequacy decision, SCCs, or other applicable safeguard. |
| Amazon CloudWatch | Infrastructure monitoring, application logs, diagnostics, alerting, and service reliability support. | AWS regions selected by Servv; support and service subprocessors may vary by AWS service. | Adequacy decision, SCCs, or other applicable safeguard. |
| Google Calendar integration, authentication, analytics, or related integration services where enabled by Customer. | Google service and subprocessor locations applicable to the Customer-enabled Google integration. | Adequacy decision, SCCs, or other applicable safeguard. | |
| Microsoft | Microsoft Bookings, Microsoft Calendar, authentication, or related integration services where enabled by Customer. | Microsoft service regions selected or provisioned for the Customer-enabled Microsoft integration, with controlled global support access. | Adequacy decision, SCCs, or other applicable safeguard. |
| Calendly | Calendly integration services where enabled by Customer. | United States and other Calendly subprocessor data center locations used to provide the integration. | Adequacy decision, SCCs, or other applicable safeguard. |
| Zoom | Video meeting creation, meeting links, and related meeting integration services where enabled by Customer. | Zoom account, data center, storage, and subprocessor locations selected or enabled by Customer and Zoom. | Adequacy decision, SCCs, or other applicable safeguard. |
| Cloudflare | Content delivery, DNS, network security, firewall, caching, and performance services. | Global edge network and Cloudflare subprocessor locations used to provide network and security services. | Adequacy decision, SCCs, or other applicable safeguard. |
| Additional subprocessors | Other service providers used to operate, secure, support, monitor, or improve the Services. | Locations disclosed in Servv’s then-current subprocessor list or applicable provider documentation. | Adequacy decision, SCCs, or other applicable safeguard. |
Publication Checklist
Before publication or execution with customers, Servv should confirm and, where appropriate, add the following company-specific information:
- Full legal entity details for Servv Inc., including registered address and corporate jurisdiction.
- Privacy contact email and security incident contact process.
- Governing law and venue, such as Ontario, Canada, or another selected jurisdiction.
- Definitive retention periods for active accounts, terminated accounts, support records, logs, and backups.
- Definitive subprocessor list, including locations, processing purposes, and transfer mechanisms.
- Whether Servv offers a subprocessor notification subscription or notice page.
- Whether UK GDPR, Swiss FADP, or other regional addenda should be included for the customers Servv serves.
- Whether SCC Module Two, Module Three, or both should be pre-signed or incorporated by reference for international transfers.
Counsel Review Notes
This DPA should be reviewed by qualified legal counsel before adoption, publication, or execution with customers. Counsel should specifically review the governing law clause, limitation of liability, audit rights, breach notification process, retention periods, definitive subprocessor list, international transfer mechanism, SCC incorporation approach, UK and Swiss transfer requirements, and whether any customer use cases could involve special categories of Personal Data.