Legal
Data Processing Agreement
Last updated: 1 November 2026
This Data Processing Agreement ("DPA") forms part of the agreement between you ("Controller") and WhenTap ("Processor", "we", "us") regarding your use of WhenTap ("Service").
WhenTap, a registered trade name of a Dutch sole proprietorship (eenmanszaak), Beeklaan 38, 4702JL Roosendaal, Netherlands. KvK 97282812, VAT NL005260736B22. For DPA signature or data-protection requests, reach us at support@whentap.com or through our support form.
1. Definitions
Terms used in this DPA have the meanings given in the EU General Data Protection Regulation (GDPR) 2016/679.
2. Subject and duration
| Item | Detail |
|---|---|
| Subject matter | Processing of Personal Data by Processor on behalf of Controller in connection with the Service. |
| Duration | For as long as the Service is provided to Controller, plus any post-termination retention required by law. |
| Nature and purpose | Scheduling and booking management for Webflow sites. |
| Processing activities | Storing OAuth tokens, reading and writing Webflow CMS content, registering webhooks and WhenTap's booking script on Controller's Webflow sites, computing availability, syncing Google and Microsoft calendars, sending transactional email and routing booking payments via Stripe. |
| Categories of Data Subjects | Controller's authorized users; the end customers who book with Controller. |
| Categories of Personal Data | Email address of Controller's users and team members; names, emails, phone numbers, addresses, timezones, intake answers and booking details of Controller's end customers. |
3. Processor obligations
Processor agrees to:
- Process Personal Data only on documented instructions from Controller (including those in the Terms and this DPA).
- Ensure persons authorized to process Personal Data are bound by confidentiality.
- Implement appropriate technical and organizational measures (see Section 6).
- Assist Controller in responding to Data Subject requests.
- Notify Controller without undue delay (within 72 hours) of a Personal Data breach.
- Delete or return all Personal Data after the end of the provision of Services, except team members' sign-in emails, which are kept until the member asks us to delete them.
- Make available all information necessary to demonstrate compliance with GDPR Art. 28.
4. Sub-processors
Controller authorizes Processor to engage the following sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | EU |
| Webflow, Inc. | The platform WhenTap integrates with; source of the CMS content and OAuth processed for the customer | US (EU SCCs) |
| Google LLC | Google Calendar sync (when a staff member connects Google); storage of encrypted offsite database backups (Google Drive, encrypted before upload, so Google cannot read them); the mailbox where email to our @whentap.com addresses is delivered (Gmail), including support messages | US (EU SCCs) |
| Microsoft Corporation | Outlook / Microsoft 365 calendar sync via Microsoft Graph (when connected) | US / EU (EU SCCs) |
| Stripe Payments Europe, Ltd. | Subscription billing, and booking payments routed to the customer's own connected account | EU (Ireland) / US |
| Resend, Inc. | Transactional email delivery | US (EU SCCs) |
| Cloudflare, Inc. | DNS and email routing for whentap.com: email sent to our @whentap.com addresses passes through it | US / global (EU SCCs) |
| Functional Software, Inc. (Sentry) | Error monitoring of WhenTap's server: error messages and stack traces, with email addresses removed and no cookies, headers, request bodies, URL query strings or IP addresses | EU (Germany; EU SCCs) |
Processor will notify Controller of any intended changes concerning the addition or replacement of sub-processors, giving Controller 30 days to object.
5. International transfers
Where Personal Data is transferred outside the EEA, Processor relies on:
- EU Commission adequacy decisions where applicable
- Standard Contractual Clauses (SCCs) for transfers to third countries
- Supplementary measures (encryption in transit and at rest) as recommended by EDPB guidance
6. Technical and organizational measures
Processor implements:
- AES-256-GCM encryption for stored OAuth tokens and other sensitive secrets
- HTTPS-only connections for all data in transit
- SSH key-only access to production infrastructure (password login disabled)
- Logical separation of customer data: every request is checked against the account that owns the data before anything is read or changed
- Daily database backups, kept on the server for 14 days (readable only by the system administrator account) and copied offsite each night, encrypted before upload, kept 30 days
- An activity log of actions taken in the account (the owner can clear it)
7. Data Subject rights
Processor assists Controller in responding to Data Subject requests for access, rectification, erasure, restriction, portability, and objection. Controller can self-serve most requests via the Service:
- Data export: one-click JSON download from the Account dialog
- Account deletion: from the Account dialog (type "delete my account" to confirm), immediate in the live database and out of backups within 30 days
- After an uninstall from Webflow with no new authorization: the account and its data are deleted 30 days later, after one email notice
For requests Controller cannot self-serve, contact us through our support form.
8. Audits
Controller may, no more than once per 12 months and with 30 days written notice, audit Processor's compliance with this DPA. Processor will respond to reasonable written audit questionnaires within 30 days.
9. Termination
This DPA terminates automatically when the Terms terminate, or when Processor ceases processing Personal Data on Controller's behalf, whichever is later.
10. Governing law
Dutch law governs this DPA. Disputes are subject to the competent court in the Netherlands.
Contact
For DPA signature requests, sub-processor questions, and deletion requests, contact us through our support form.