This Data Processing Agreement ("DPA") forms part of the Public Offer Agreement and Terms of Service between Domovleno, operated by Individual Entrepreneur Roman Oleksiiovych Malinovskyi (ФОП Маліновський Роман Олексійович) ("Processor"), and the customer ("Controller"). It is the written processing instruction required by Article 4 of the Law of Ukraine "On Personal Data Protection" No. 2297-VI (володілець → розпорядник) and defines how Domovleno processes personal data on the Controller's behalf, in compliance with that Law and GDPR principles.
1. Scope
This DPA applies to all personal data processed by Domovleno on the Controller's behalf in the course of providing the Service. It supersedes any previous data processing terms. The DPA is accepted automatically at account registration — together with the acceptance of the Public Offer Agreement and all of its integral parts; no separate signature is required (a signed copy is available on request).
2. Roles
The Controller determines the purposes and means of processing. The Processor (Domovleno) processes personal data solely for the purpose and in the scope set by this DPA, the agreement, and the Controller's documented instructions (Article 4 of Law No. 2297-VI).
3. Subject of processing
- Categories of data subjects: the Controller's customers, staff, and end-clients who book through Domovleno.
- Categories of personal data: name, email, phone, booking history, service notes, payment metadata.
- Nature of processing: storing and managing bookings, clients, staff, and payments; sending the notifications the Controller configures; preparing payment reports for the Controller's bookkeeping on the Controller's instruction; and — where the Controller uses Domovleno's optional AI features — sending the relevant data to our AI sub-processor to generate assistant answers, brand suggestions, and automated ranking of retention opportunities (the ranking uses anonymous numeric signals only). AI features are used only on the Controller's instruction, by switching them on and using them.
- Duration: for the term of the Service plus 30 days, after which data is permanently deleted.
4. Sub-processors
Domovleno engages the following sub-processors. The Controller authorises this list at signup; Domovleno notifies the Controller of any addition or replacement at least 30 days in advance so the Controller may object.
- mono (JSC "UNIVERSAL BANK"), LiqPay (JSC CB "PrivatBank") and Stripe — online card payment processing. Payments are taken through the Controller's own merchant account with the chosen provider and settle directly to the Controller; Domovleno does not hold funds or store full card details.
- Resend — transactional email delivery (confirmations, reminders, notifications).
- Twilio — SMS delivery, including reminder and notification messages.
- PostHog — product analytics and session replay, configured with input masking and with the public booking app excluded from replay.
- Anthropic PBC (Claude, USA) — AI provider for Domovleno's optional AI features (the admin AI Assistant, brand generation, and retention-opportunity ranking). Processes Controller data only when the Controller actively uses one of these features. Under Anthropic's commercial terms, data is not used to train models and API inputs and outputs are deleted within 30 days; processing takes place in the USA under Anthropic's Data Processing Addendum incorporating the EU Standard Contractual Clauses.
- Cloud infrastructure and hosting providers — servers, storage, and encrypted backups.
5. Security
Domovleno implements technical and organisational measures appropriate to the risk (Article 24 of Law No. 2297-VI): encryption of all traffic in transit, hashed credentials, per-tenant data isolation, role-based access to production systems, audit logging of administrative actions, and regular encrypted backups. An overview is published on our Security page.
6. Data subject requests
The Controller can act on most data-subject requests directly in Domovleno: a client record can be exported in a machine-readable format or erased (anonymised and removed from lists and search) from within the account. For anything the app doesn't cover, Domovleno will assist the Controller with reasonable requests (access, correction, deletion, portability) within seven business days — send these via our contact page.
7. Controller duties
The Controller in turn is responsible for:
- having a lawful basis for every category of data entered into the Service (client consent, performance of a contract, or another basis under Article 11 of Law No. 2297-VI) and informing their clients about the processing;
- obtaining separate consent for marketing messages (retention SMS are sent only to clients who explicitly opted in);
- special-risk data: if the Controller stores health-related notes about clients (e.g. allergies or contraindications), such processing may require notifying the Ukrainian Parliament Commissioner for Human Rights under Article 9 of Law No. 2297-VI — that duty rests with the Controller. Domovleno is not intended for keeping medical records;
- the accuracy of entered data and timely handling of data subjects' rights.
8. Audits
On request, Domovleno will complete security questionnaires and provide a written description of its technical and organisational measures. Independent audit reports will be made available under NDA as they are obtained.
9. Cross-border transfers
Transfers of personal data outside Ukraine are made under Article 29 of Law No. 2297-VI: to EU/EEA states and parties to Council of Europe Convention 108 as states ensuring adequate protection, and to other countries (including the USA, where some sub-processors are located) on the basis of contractual safeguards agreed with each sub-processor. For data originating in the EU/EEA, GDPR safeguards such as Standard Contractual Clauses apply. This includes our AI sub-processor (Anthropic, USA) when an AI feature is used: transfers rest on Anthropic's Data Processing Addendum incorporating the EU Standard Contractual Clauses; data is not used to train models and is deleted within 30 days. By accepting the agreement the Controller instructs Domovleno to make these transfers as part of providing the Service. Details about processing locations are available on request.
10. Termination
On termination of the Service, Domovleno deletes or returns all personal data within 30 days, unless retention is required by law. Backups roll off after a further 30 days.
11. Liability
Liability under this DPA is governed by the limitations set out in the Public Offer Agreement and Terms of Service.
Need a counter-signed copy with your company stamp? Reach us via our contact page — we turn DPAs around within a few business days.