English Română

Data Processing Agreement

Last updated: 13 November 2026

Version: 1.0, 13 November 2026

Parties

Processor: BHDIT SRL, registration number J2026027909001, tax identification code (CUI) 54575180, registered office Aleea Barajul Uzului 1, Sector 3, București, Romania. Contact for data protection: [email protected]. In this agreement "we" and "us" mean BHDIT SRL.

Controller: the Business Customer that uses the Service under the Terms. Its name, registration number and address are those in its Lidisto account. In this agreement "you" means the Business Customer.

We provide Lidisto, an online booking platform with a WhatsApp booking assistant. You use it under the Terms. This agreement sets out how we handle personal data for you, as Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") requires.

1. Definitions

1.1 Personal data, processing, controller, processor, data subject and personal data breach have the meaning they have in the GDPR. In short: personal data is any information about an identifiable person. A controller decides why and how data is used. A processor handles data on the controller's behalf. A data subject is the person the data is about. A personal data breach is a security incident in which personal data is lost, destroyed, changed, disclosed or accessed without permission.

1.2 Terms means the Terms of Service you accepted (https://lidisto.com/terms).

1.3 Service means the Lidisto booking platform: booking pages, the booking widget on your website, the management screens, the mobile apps, your client records, reminders, and the Assistant.

1.4 Assistant means the AI chat assistant that answers on WhatsApp for you. The assistant platform is the separate system that runs the Assistant and stores its conversations.

1.5 Front desk means the general Lidisto assistant that, where one is in use, answers when a person writes to the Lidisto WhatsApp number without choosing a business.

1.6 Client data means the personal data that your clients, the people who write to your Assistant, and your staff enter into the Service, or that the Service creates about them, for you. Annex I lists it.

1.7 Sub-processor means another company we use to process Client data. Annex III lists them by category.

1.8 Standard Contractual Clauses means the standard data protection clauses approved by the European Commission for transfers of personal data outside the European Economic Area ("EEA").

2. Roles

2.1 We are the processor for Client data, and for conversations that people have with your own Assistant. You are the controller of that data. You decide why it is used.

2.2 We are a controller ourselves, and this agreement does not apply, for:

Each business's client record and bookings stay under clause 2.1. Our privacy policy (https://lidisto.com/privacy-policy) covers the data in (a) to (f).

2.3 You are responsible for having a lawful basis for your use of Client data, and for telling your clients about it in your own privacy notice. The notice must say that you offer an AI assistant on WhatsApp, provided by us.

3. Subject, nature, purpose and duration

3.1 Annex I describes the subject matter, the nature and purpose of the processing, the kinds of personal data, the people concerned, and the duration.

3.2 This agreement lasts as long as we provide the Service to you. Clause 12 applies after that.

4. Instructions of the Controller

4.1 We process Client data only on your documented instructions. Your instructions are: (a) the Terms and this agreement; (b) your use and settings of the Service, for example creating a booking, switching the Assistant on or off, or sending a reminder; and (c) any other written instruction we agree. This includes transfers of Client data outside the EEA, as clause 8 sets out.

4.2 We may also process Client data where EU or Romanian law requires it. We then tell you before the processing, unless the law forbids it.

4.3 If we believe an instruction breaks data protection law, we tell you immediately. We may pause that instruction until you confirm or change it. This clause is one of those you accept expressly (Terms Section 13).

4.4 We do not sell Client data and do not use it for our own purposes. Processing needed to provide, secure and fix the Service is part of your instructions.

4.5 You are responsible for the accuracy of the data you enter, for having a lawful basis for it, and for your instructions being lawful.

4.6 When a client signs in to Lidisto with the same phone or email at several businesses, we link the client's account to each business's client record so the client can see their bookings. Each business sees only its own record.

5. Confidentiality

5.1 Only people who need Client data to do their work can reach it, and only for the Service. A small number of our administrators can see all businesses' data and can sign in as a business owner to give support. They do this only to give support or to fix a problem. Individual views by administrators are not logged today.

5.2 Everyone with that access is bound by a duty of confidentiality, which continues after they stop working for us.

6. Security

6.1 We take the technical and organisational measures in Annex II to protect Client data against loss, damage, unauthorised access and unlawful processing. They match the risk, including the risk of health-related data.

6.2 We may change these measures, as long as the level of protection does not drop.

7. Other processors we use

7.1 You give us a general written authorisation to use the sub-processors in Annex III. Each Business Customer can get the named list by writing to [email protected].

7.2 We tell you at least 30 days before we add or replace a sub-processor, by email to the account owner or by a notice in your account. If one must be replaced urgently for security or continuity, we tell you as soon as possible, and your right to object in clause 7.3 still applies.

7.3 You may object within that period, on reasonable data protection grounds. We then talk in good faith. If we find no solution, you may end the affected part of the Service, and we refund any fee you paid in advance for the period after it ends. This clause is one of those you accept expressly (Terms Section 13).

7.4 We bind every sub-processor by a written contract with the same data protection obligations as this agreement, in substance.

7.5 We stay responsible to you for our sub-processors' performance of those obligations.

8. Transfers outside the EEA

8.1 We transfer Client data outside the EEA only where the transfer is covered by one of these:

8.2 You instruct and authorise transfers made this way. Annex IV explains the mechanisms in plain words, and Annex III gives the safeguard for each category.

9. Help with requests from data subjects

9.1 You answer requests from your clients to access, correct, delete, restrict or move their data, or to object. We help with technical and organisational means, as far as possible.

9.2 If a person asks us about Client data, we do not answer on the merits. We pass the request to you within 5 working days.

9.3 You can correct a client record and export your client list as a spreadsheet yourself in your account. To delete a client record, write to [email protected]. We delete it within 30 days, together with the contact details saved on that client's past bookings. For other requests, we help on written request.

9.4 Assistant conversations. On your written request, we erase all of your Assistant conversations within 30 days, after the Assistant has been switched off. We cannot yet erase only one person's conversations with your Assistant; those are deleted automatically 90 days after their last activity (clause 12.4).

9.5 We do not charge for ordinary help. If a request needs disproportionate effort, we may charge a reasonable fee, after telling you.

10. Personal data breach

10.1 We tell you without undue delay and at the latest within 72 hours after we become aware of a personal data breach affecting Client data.

10.2 The notice goes to the account owner's email and gives the information we have at that time: what happened, which data and roughly how many people, the likely effects, what we have done, and who to contact. We add details as we learn them.

10.3 We help you meet your own duty to report to the authority and to tell the people affected. You decide whether to report.

11. Impact assessments and prior consultation

11.1 We give you the information we have and you reasonably need for a data protection impact assessment, and for consulting the data protection authority, where your use of the Service requires it. This includes information about the Assistant.

11.2 On request, we give health businesses written information on what the Service stores, where, who can see it, and for how long.

12. Deletion or return at the end

12.1 When the Service ends, we delete the Client data or return it, as you choose. You state your choice in writing within 30 days after the end. We then do it within 30 days of your choice. If you make no choice, we delete the data 60 days after the end.

12.2 Return means a copy in a common, machine-readable format. Today you can export your client list as a spreadsheet (CSV). We do not promise another export format.

12.3 We may keep data that the law requires us to keep, and only for that purpose. Deposit and refund records are kept as long as accounting law requires.

12.4 Assistant conversations are deleted automatically, by a daily job, 90 days after the last activity in the conversation. This happens whether or not the Service ends.

12.5 Copies in logs and backups. Copies in logs, backups and error reports are deleted when those logs and backups expire in their normal cycle, and are not used in the meantime. On the assistant platform, backups hold deleted data for up to 7 more days.

12.6 You decide how long you keep your own client records while the Service lasts, and you delete what you no longer need. We do not set that period for you.

13. Audits and information

13.1 We give you the information needed to show that both of us comply with Article 28 GDPR, and we allow audits, including inspections, by you or an auditor you appoint.

13.2 You may audit once a year, on 30 days' written notice, or at any time after a personal data breach affecting your data. The audit starts with documents and written answers, and then, where those are not enough, remote questions. An on-site visit takes place only if remote steps cannot answer the question. The auditor signs a confidentiality undertaking. The audit does not cover other customers' data.

13.3 You bear the cost of the audit, unless it finds a serious breach of this agreement by us. In that case we bear our own costs of the audit.

13.4 We keep a written record of the processing we carry out for our Business Customers, as Article 30(2) GDPR requires, and we make it available to the supervisory authority on request.

14. Special categories of data

14.1 The Service includes a clinical record for health businesses: reason for visit, diagnosis, treatment, notes and visit images. An empty draft visit record is created automatically for every completed booking, at every business, including businesses that do not use the clinical record. Data in these records is health data. You may also enter health information in notes, intake answers or uploaded files. Health data is special category data under Article 9 GDPR.

14.2 You are responsible for having a lawful basis under Article 9 for this data, for entering only what you need, and for choosing which intake questions to ask. Do not collect national identification numbers (CNP) unless Law 190/2018 allows it. The intake template for clinics includes an optional CNP question. Remove it unless that law allows you to collect the CNP. That law sets extra conditions when the basis is a legitimate interest, including safeguards and the appointment of a data protection officer. Your staff who see health data remain bound by the professional secrecy that applies to them. Using the Service does not change that duty.

14.3 The Assistant is not meant to handle health data and is told not to ask for it. The notes you give the Assistant must not contain health data or personal data of your clients, as the Terms say. People may still write health details in the chat. The Assistant does not filter them out: they are stored with the conversation until it is deleted, 90 days after its last activity, and passed to the AI provider like any other message. At a health business, the name of a booked service can also reveal health information. You must cover this in your privacy notice and your impact assessment.

14.4 We apply the measures in Annex II to this data, including encryption of the clinical record fields in our database. On request, we tell you which other fields are not encrypted (clause 11.2).

15. Liability

This clause is one of those you accept expressly (Terms Section 13).

15.1 Each of us is liable to the other for damage caused by a breach of this agreement, as the law provides. The exclusions and limits in the Terms (Section 19) also apply to a breach of this agreement.

15.2 Our total liability to you for claims under this agreement and the Terms together is limited as Section 19 of the Terms says: the fees you paid in the last 12 months, or EUR 100 if that is higher.

15.3 Nothing in this agreement limits liability for intent or gross negligence, liability that cannot be limited by law, or the rights of data subjects against either of us under Article 82 GDPR.

16. Term, precedence, acceptance and changes

16.1 Term. This agreement starts when you accept the Terms and ends when we have finished clause 12.

16.2 Precedence. If this agreement and the Terms conflict on data protection, or on liability for data protection claims, this agreement prevails.

16.3 Acceptance. This agreement forms part of the Terms. You accept it when you accept the Terms for your business account; for a Business Customer that already uses the Service, it applies as a change to the Terms (Terms Section 20). On request, we can also sign a copy with you. The person who accepts confirms that they may bind the Business Customer. Clauses 4.3 (pausing an instruction), 7.3 (ending part of the Service), 15 (liability) and 17.2 (courts) are not usual clauses; they are among those you accept expressly under Terms Section 13.

16.4 Changes. We may change this agreement for a good reason, such as a change in the law or in the Service. We give at least 30 days' notice by email to the account owner or in your account. If you do not agree, you may end the Service before the change takes effect. Changes that the law requires may apply sooner. Changes to Annex III follow clause 7.

16.5 Languages. This agreement is available in Romanian and English. If they differ, the Romanian version prevails.

17. Law and courts

17.1 This agreement is governed by Romanian law.

17.2 Disputes go to the courts of București. This clause is one of those you accept expressly (Terms Section 13).

Annex I Description of the processing

1. Subject and duration. Providing the Service to you for as long as it lasts (clause 3.2). Assistant conversations are deleted 90 days after their last activity (clause 12.4).

2. Nature and purposes.

3. Categories of data subjects.

4. Categories of personal data.

5. Special categories. Health data, as clause 14 explains. You decide what you enter.

6. Retention. As clause 12 says. While the Service lasts, you decide how long you keep your client records.

Annex II Technical and organisational measures

This annex lists the main measures we take.

A. Access and separation

  1. In the booking service, everything done in a business's account is filtered to that business, and automated tests check this. It is a filter on one shared database, not separate databases. Admin access is described in clause 5.
  2. The assistant platform's database hides each business's data from the others (row-level security: the database itself hides other businesses' rows), and every request is checked against the business it belongs to. Automated tests try to read another business's data and must fail. Each business's connection uses its own key.
  3. Within a business, only the business owner can open the Assistant's conversations and settings. Other staff get an "owner only" refusal.
  4. Access by our administrators is described in clause 5.
  5. Clinical visit images and uploaded client files are stored on a private disk and are not publicly reachable. Visit images are served only through a route that checks the business, and a test covers it.
  6. Clients sign in with a one-time code sent by email or SMS. Staff sign in with a password. Password-reset requests are rate-limited.
  7. The Assistant cannot book or change anything alone. A booking happens only after the person presses the Confirm button, and the prepared booking is valid for 15 minutes.
  8. Every call from the assistant platform to the booking service carries a signed proof of who is calling, valid for 5 minutes.

B. Protection of data

  1. The booking service and management screens are reached over encrypted connections (HTTPS).
  2. The connection to the assistant platform's database accepts only encrypted connections.
  3. Inside the booking database, clinicians' notes on clients, the visit complaint, diagnosis, treatment and notes, activity-log details and the access tokens for connected calendars are encrypted. Uploaded files and visit images are stored on a private disk. On request, we tell health businesses which other fields are not encrypted (clause 11.2).
  4. Secrets (keys, tokens) are not kept in the code. On the assistant platform they are held in a secrets store, and the part of the platform that faces the internet can store a business's connection key but cannot read it back.
  5. Messages stored on the assistant platform are stored as sent and are never edited.

C. Logs, retention and deletion

  1. On the assistant platform, logs by rule contain no message text or phone numbers. The booking service's application logs can contain phone numbers and email addresses and are kept for a limited period.
  2. Only two database functions can delete conversation data on the assistant platform: the daily deletion 90 days after last activity, and erasure on a business's request (clause 9.4). The database refuses every other deletion, and the application's own database users have no right to delete.
  3. The booking service deletes its own copy of a prepared booking about 7 days after it was made, once it has been used or has expired, by a daily job.
  4. A conversation that is still in use is never deleted by the daily job.
  5. The assistant platform's database keeps 7 daily backups and 7 days of change logs.

D. Limits and abuse protection

  1. Each conversation has a limit on the number of messages per person.
  2. Each business has a monthly cap on Assistant use, set by us, and there is a ceiling for the whole platform. The caps are enforced in one database step, so parallel chats cannot exceed them.
  3. Rate limits apply to the public and management routes of the booking service and to the assistant platform's partner interface.

Annex III Other processors by category

Category What it does Where the data may be Safeguard
Hosting provider for the booking service Runs the servers, the database and the stored files EU Not needed, inside the EU
Server management provider Deploys and manages the servers, and can reach the data on them Outside the EEA possible Adequacy decision or Standard Contractual Clauses
Network and security provider Delivers the website, protects it against attacks and bots, and encrypts connections Worldwide network Adequacy decision or Standard Contractual Clauses
Cloud provider for the Assistant Runs the Assistant and stores its conversations EU Not needed, inside the EU
AI language-model provider Reads the conversation and writes the Assistant's replies Outside the EEA possible Adequacy decision or Standard Contractual Clauses
WhatsApp (Meta) Delivers WhatsApp messages Meta's infrastructure Meta's transfer safeguards, including the EU-US Data Privacy Framework
Email provider Sends emails As in the named list As in the named list
SMS provider Sends SMS As in the named list As in the named list
Error-monitoring provider Receives technical error reports As in the named list As in the named list

The named list, with each company's legal entity, location and safeguard, is available to each Business Customer on request at [email protected]. We tell you about changes as clause 7 says.

Connections you choose. These are not our sub-processors. You, or your staff member, have your own relationship with the other company.

Annex IV Transfers in plain words

  1. Inside the EEA (the EU plus Iceland, Liechtenstein and Norway), data moves freely under the GDPR. No extra mechanism is needed.
  2. Adequacy decision. The European Commission can decide that a country gives protection equal to the EU's. For the United States, such a decision covers companies that have joined the EU-US Data Privacy Framework. We check that a US sub-processor is certified before we rely on this.
  3. Standard Contractual Clauses. These are standard contract terms, written by the European Commission, that the sub-processor signs. They oblige it to protect the data to EU standards. We use them where no adequacy decision applies, or as a back-up if the Framework stops being valid.
  4. Extra measures. Where needed, we add measures such as limiting what data is sent.
  5. Your copy. On request, we give you the relevant clauses and certification details for any sub-processor.