Data Processing Agreement

Controller: the Specialist who has opened an account on the Bubi platform (the “Controller”).

Processor: asm studio s. r. o., Pod Huru 377/12, 082 71 Krivany, Slovakia, Company ID 56646321 (“Bubi”).

This agreement is an annex to the Terms for specialists and is entered into together with them.

1.1 For the content of a consultation — what the Controller and the user write and say — the Controller determines the purposes and means of processing. Bubi provides only the technical environment. The Controller is therefore the controller and Bubi the processor.

1.2 For data about the Controller themselves and for running the platform (account, profile, billing details, bookings) Bubi is the controller. That falls outside this agreement.

1.3 Bubi does not use consultation content for its own purposes — neither for product development nor for training artificial intelligence.

3.1 Data subjects: users of the platform who book a consultation with the Controller, and indirectly their children.

3.2 Categories of data:

• —identification and contact details of the user (name, e-mail),
• —booking data (slot, duration, status),
• —the content of the written conversation in the consultation thread,
• —attachments in the thread — photographs and documents the parties exchange.

3.3 Special category. Both the conversation and the attachments may contain health data within the meaning of article 9 GDPR — the user places them in the thread of their own volition. The Controller secures the legal basis for processing them.

3.4 What is not processed. The video call is neither recorded nor transcribed. Nothing remains of its content once the call ends.

4.1 Processing on documented instructions only (point (a)). Bubi processes the data solely on the Controller's documented instructions; use of the platform in accordance with the Terms counts as such an instruction. Where processing is required by Union or Member State law, Bubi informs the Controller beforehand unless that law prohibits it.

4.2 Confidentiality (point (b)). Persons at Bubi with access to the data are bound by an obligation of confidentiality.

4.3 Security (point (c), article 32). Bubi has put in place in particular the following measures:

• —transmission exclusively over an encrypted connection (HTTPS, HSTS),
• —record-level access control in the database (row-level security), so that only the client and their specialist can reach a consultation thread,
• —attachments in private storage, made available only through short-lived signed URLs,
• —Bubi administrators have no access to consultation content — the corresponding permission has been removed from the database,
• —the video call media server bound to the European Union (Frankfurt),
• —regular automatic deletion under article 7.

4.4 Sub-processors (point (d)). The Controller gives Bubi general authorisation to engage the sub-processors listed in article 6. Bubi announces a change at least 30 days in advance; the Controller may object within that period and, if they do, they are entitled to terminate the agreement.

4.5 Assistance with data subject rights (point (e)). If a user approaches Bubi to exercise their rights in respect of consultation content, Bubi forwards the request to the Controller without delay and gives them technical assistance.

4.6 Assistance with security and breaches (point (f)). Bubi assists the Controller in meeting the obligations under articles 32 to 36 and notifies them of a personal data breach without undue delay after becoming aware of it, together with the information needed to notify the supervisory authority.

4.7 Erasure after the end of the service (point (g)). After the provision of the service ends, Bubi, at the Controller's choice, erases the data or returns them to the Controller and deletes existing copies, unless Union or Member State law requires storage.

4.8 Demonstration and audit (point (h)). Bubi makes available to the Controller the information needed to demonstrate compliance with article 28 and allows for and contributes to audits, including inspections conducted by the Controller or an auditor they mandate. Bubi may satisfy the obligation to provide information by means of an independent auditor's report; the Controller's right to conduct their own audit is unaffected and cannot be excluded by contract.

Bubi also informs the Controller without delay if it considers that one of their instructions infringes data protection law.

5.1 They secure the legal basis for processing consultation content, including health data under article 9 GDPR.

5.2 They meet the information obligation towards the user to the extent it concerns their own processing.

5.3 They do not give Bubi instructions that would conflict with data protection law.

Consultation content never reaches OpenAI or Upstash. The consultation thread touches no AI layer.

The Controller may have a particular thread deleted sooner. Bubi reviews the adequacy of these periods at least once a year.

8.1 This agreement lasts for as long as Bubi processes personal data for the Controller.

8.2 The provisions on confidentiality and on erasure after the end of the service survive its termination.

8.3 This agreement is governed by Slovak law and by Regulation (EU) 2016/679.