Data Processing Agreement (DPA)

This DPA is between Mohamed Abu Khadra, trading as Oden Pet ("Processor"), and the business customer who uses Oden to process personal data ("Controller"). The Processor processes personal data only on behalf of, and on the documented instructions of, the Controller.

The Processor may process the following categories of personal data on behalf of the Controller: customer contact information (name, email, phone, address), pet information, appointment and session history, billing information, and any other data the Controller enters into the platform. The Processor does not process special categories of personal data unless specifically directed by the Controller.

The Processor processes personal data solely to provide the Oden platform as described in the Terms & Conditions, including providing scheduling, customer management, billing, and related features.

The Processor engages the following categories of sub-processor to deliver the service:

• Paddle — billing, invoicing, and payment processing for Oden subscriptions (acting as merchant of record).
• Vercel — application hosting and infrastructure.
• Cloudflare — bot protection and form security (Turnstile).
• Resend (or SMTP, where configured) — transactional email delivery.
• Twilio and Stripe, where connected — SMS and payment processing run through each Controller's own connected Twilio and Stripe accounts (bring-your-own), on the Controller's instruction and credentials.

Note to reviewer: this list reflects what is verifiable from the marketing site's codebase and public configuration. The complete, authoritative sub-processor list for the core application (app.oden.pet) — including its database and any additional infrastructure providers — should be confirmed against that product's own systems before this page is treated as final, since this repository does not have visibility into the product's backend. TODO: confirm and complete this list from the app.oden.pet infrastructure.

The Processor remains liable for the acts and omissions of its sub-processors.

The Processor implements industry-standard security measures as described on our Security page, including encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access controls, and activity monitoring. The Processor is working toward SOC 2 alignment as it scales.

The Processor may transfer personal data outside the European Economic Area. Such transfers are governed by Standard Contractual Clauses or other appropriate safeguards as required by applicable law.

The Processor will assist the Controller in responding to data subject requests where reasonably possible. The Processor will not respond directly to data subject requests without the Controller's authorization, except where required by law.

The Processor will notify the Controller of a personal data breach without undue delay and in any case within 72 hours of becoming aware of the breach, providing all information reasonably necessary for the Controller to meet its own breach notification obligations.

Upon termination of the service, the Processor will, at the Controller's choice, return or delete all personal data, except where retention is required by law. The Controller may export their data at any time during the term of the service.

The Controller may audit the Processor's compliance with this DPA once per year, with reasonable notice, and subject to confidentiality obligations. The Processor will provide relevant documentation to demonstrate compliance.

For questions about this DPA or to request execution of a signed copy, contact us at legal@oden.pet.