Data Processing Addendum

Anteroom's standard terms for processing personal data on a client's behalf, under Article 28 of the GDPR.

Version 2, dated 7 November 2026.

Version 2 adds two things to version 1: email alerts to the Client's administrators, sent through Namecheap, and copies of insurance and registration certificates uploaded by applicants, with how long they are kept. It also removes the vetting declaration, which Anteroom no longer asks for.

The addendum's terms

1. Parties and roles

• The Provider is Farias Maiquita, sole trader, of Beira, Mozambique. Notices go to hello@farias.pro. The Provider is the processor, and the data importer under the clauses.
• The Client is the organisation named in the Service Agreement and in its client part of Annex I. The Client is the controller, and the data exporter.
• The Service Agreement is the Anteroom Service Agreement, the signed agreement under which the Provider supplies Anteroom to the Client.

2. How this addendum applies

1. Through the Service Agreement. The Service Agreement names this addendum, its version, and where it is published, and incorporates it.
2. One signature covers it. By signing the Service Agreement, the Client also signs Annex I.A of the clauses as data exporter, and the Provider signs as data importer.
3. A standalone signed copy is available on request. It uses the signature block in the Client's part of Annex I.
4. Publication alone binds no one.

3. Order of precedence

The clauses prevail over this addendum and the Service Agreement (Clause 5). This addendum prevails over the Service Agreement on personal data.

4. The clauses

1. The Standard Contractual Clauses, Module Two (controller to processor), in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, are incorporated by reference, unmodified: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
2. The options taken are those set out below.
3. Their Annexes I, II and III are this document's Annex I (with the Client's part), Annex II and Annex III.

5. Instructions (Clause 8.1)

The Client's documented instructions are:

1. the Service Agreement and this addendum;
2. what the Client's administrators do in Anteroom. Every approval, refusal, suspension, deletion and rate change is recorded with who made it;
3. anything else the Client sends in writing to the notice address.

6. Sub-processors (Clause 9(a), Option 2)

1. The Client gives general written authorisation for the sub-processors listed in Annex III, which is also published on this page.
2. The Provider gives 30 days' written notice, by email, of any addition or replacement, with the information the Client needs to object.
3. If the Client objects and the Provider cannot meet the objection, the Client may end the Service Agreement, with a pro-rata refund of the unused prepaid fee.

7. Personal data breaches (Clause 8.6(c))

The Provider notifies the Client without undue delay, and in any case within 48 hours of becoming aware of a breach, so that the Client can meet the 72 hours of Article 33.

8. Changes to this addendum

A new version applies to a Client only once that Client accepts it in writing. Until then, the version it agreed stays in force.

9. What this addendum does not cover

• A client's own website, even where the Provider hosts it.
• Card data. Anteroom never sees it: a cardholder pays on the payment gateway's own page, into the Client's own merchant account.
• The Provider's own business data about the Client, such as invoices.
• Email alerts once they reach the Client's own mailboxes. Those copies are the Client's, held by its own email provider.

The options taken in the clauses

Complaints contact point (Clause 11(a))

Annex I: details of the processing and transfer

This is the general part, the same for every client. Each client's own part, signed with the Service Agreement, names the client, its contact, its supervisory authority and its own choices.

I.A. List of parties

• Data exporter: the Client, as named in its client part, with its address, contact, activities, signature and date. Role: controller.
• Data importer: Farias Maiquita, sole trader, Beira, Mozambique. Contact: hello@farias.pro. Activities: builds, hosts, operates and supports Anteroom. Hosting is through OVH (Annex III). He administers the server and the application remotely, from Mozambique. Signature and date: the Service Agreement's. Role: processor.

I.B. Description of the transfer

Categories of data subjects

1. Practitioners: self-employed professionals who rent the Client's rooms.
2. Applicants: people who apply to use the rooms, including those refused.
3. The Client's administrators.
4. Anyone who reaches the Client's Anteroom address, as far as the web server's logs record their IP address and browser.

Not data subjects, by design: the practitioners' own clients and patients. Anteroom books rooms, not appointments, and has no field for a client or patient.

Categories of personal data

No card data. Anteroom keeps three named fields of a gateway's result, and sends the gateway no name or email.

Sensitive data, and the restrictions applied

• No special-category data is intended. Anteroom asks for none.
• No criminal records. Anteroom asks nothing about criminal records or vetting.
• Free text. Notes and reasons can hold anything typed. Restriction: the Client tells its administrators and practitioners not to put client or health details in any field.

Frequency, nature and purpose

• Frequency: continuous. The data is stored in France, and the Provider reaches it from Mozambique over SSH and HTTPS. That remote access is the transfer. Each email alert leaves the server once, through Namecheap (Annex III).
• Nature: hosting, storage, backup, administration, maintenance, support, sending email alerts, and deletion.
• Purpose: to provide Anteroom under the Service Agreement: room booking, practitioner approval, including alerts of new applications, rates, invoicing, payments and reconciliation. Nothing else.

Retention

The Client sets the retention of its own data, in its part of Annex I. Where a default is given below, it applies unless the Client's part sets another.

For transfers to sub-processors: OVH hosts the whole dataset, for the whole term, for the purpose above. Namecheap receives each email alert, to deliver it, and keeps its logs of it.

I.C. Competent supervisory authority

The supervisory authority of the Member State where the Client is established, named in its part (Clause 13(a)).

Annex II: technical and organisational measures

The same for every client. Only measures in place are listed.

1. Location and hosting

• One OVHcloud virtual server in Gravelines, France, chosen explicitly when it was ordered. The hosting contract keeps that location.
• The database, its snapshots, the uploaded certificates and the logs stay on that server, and nothing ships them anywhere.
• The only personal data the server sends out is the email alert (§6 below).

2. Network and encryption in transit

• The application listens only on the server itself, behind a web server.
• HTTPS only, with Let's Encrypt certificates.
• Administration is over SSH, with keys.
• Email alerts go to Namecheap's mail server by authenticated SMTP submission, over an encrypted connection.

3. Separation and least privilege

• One service account per instance, with no shell, no home directory and no administrative rights. The operating system enforces the isolation.
• Each service is confined: the system is read-only to it, it can write only to its own data directory, and it cannot gain privileges or see other processes.
• The service cannot read its own snapshots. Logs are readable only by administrators. Secrets are in files only the system administrator can read.

4. Change control

• Code reaches the server only through a deploy gate. Production runs only a copy of what staging has already run, and the server enforces it.
• Server configuration is applied by hand, from a versioned record. Security patches for the runtime apply automatically.

5. Backups

• An integrity-checked snapshot of the database before every deploy.
• OVH's automated backup of the server.

6. The application

• Salted scrypt password hashes. Session cookies marked HttpOnly, Secure and SameSite=Lax. Sessions last 14 days.
• Two roles, administrator and practitioner. No personal data in page addresses. The application form is rate limited.
• No card data. No third-party code, fonts or services on any page.
• Email alerts. The only email Anteroom sends is the alert of a new application. It carries the applicant's name and a link, and nothing else from the application. The link opens only for a signed-in administrator. The recipients are set in the server's configuration, not taken from the database, so a change to the data cannot redirect them.
• Uploads. Insurance and registration certificates only. Each file is checked by its content as a PDF or an image, and limited in size. Files are stored outside the web server's public folder, under an identifier that cannot be guessed, and only an administrator can open or delete one. Each is deleted automatically on the schedule in Annex I.

7. Organisational

• One person has administrative access: the Provider.
• Real data is never copied to the Provider's own machine. So no copy of the data is stored in Mozambique.
• Correspondence about practitioners goes only through the Provider's business mailbox (Annex III), never through a consumer email service.

Annex III: sub-processors

The sub-processors the Client authorises under Clause 9(a), with each one's location, function and safeguards.

What the Client is authorising: OVH

OVH's terms are its own. They are not the Commission's clauses, and they do not pass down to OVH, in substance, every obligation the Provider takes on under those clauses (Clause 9(b)). By authorising OVH, the Client accepts the following, knowing it:

• The company and the law. The hosting contract is with Hébergement OVH Inc., a Canadian company in Montréal. It is governed by the laws of Québec and Canada, not by the law of an EU Member State. OVH's data-protection terms are written to Québec's privacy law, and they do not mention the GDPR.
• OVH's own subcontractors. OVH may subcontract all or part of the service to companies in its group, and may use other suppliers, "without having to inform the Client or seek its prior consent" (General Terms §3.10). So the Provider is not told of changes among OVH's subcontractors, and cannot pass on notice of them.
• Remote maintenance from outside the EU. OVH group companies outside the EU, none of them in the United States, may work on the server remotely to keep it available, secure and maintained (PIPA §6.2). The terms do not say which companies.
  • OVH's published list of its group companies includes companies in the United Kingdom and Canada, which have EU adequacy decisions.
  • It also includes companies in Singapore, Australia, India, Morocco and Tunisia, which do not.
  • No transfer safeguard covers that access.
• No rights for practitioners against OVH. OVH's terms give the people whose data is hosted no right to enforce them.
• What does hold:
  • the server stays in Gravelines, France, the location chosen when it was ordered (PIPA §6.1);
  • OVH acts only on instructions, and binds its staff to confidentiality (PIPA §§1.1, 4.1);
  • it reports incidents, with set contents (PIPA §5);
  • it deletes the data within 30 days of the service ending (PIPA §9.1);
  • it allows audits (PIPA §11).
• The Provider stays fully responsible to the Client for OVH (Clause 9(d)).

What the Client is authorising: Namecheap

Namecheap's terms do include the Commission's clauses. The Client accepts the following about them, knowing it:

• The company. Namecheap, Inc. is a company in the United States.
• The wrong module, formally. Namecheap's addendum treats its customer as a controller and uses Module Two. For the Client's data the Provider is a processor, so the module that fits is Module Three (processor to processor).
• Transfers to the United States. Namecheap may transfer the data to the United States (§9.1). The clauses apply to data transferred outside the EEA (§9.2), but not where a transfer rests on another recognised basis, "such as when necessary for the performance of Covered Services … or with your consent" (§9.2). The terms name no location for the mailbox or its backups.
• An EU server is not EU-only processing. The mailboxes are stored in Amsterdam, but every message sent to them passes through Namecheap's relays in the United States before it arrives. So mail to these addresses is transferred to the United States, whatever the mailboxes' own location. Outgoing alerts are handed to Namecheap in Amsterdam. The first, on 7 November 2026, went from there straight to the recipient's provider. Namecheap may still route others through the United States: its terms do not say which way they go.
• Namecheap's own sub-processors. Namecheap may use sub-processors (§6.1). Its clauses give the Provider 10 days' notice of a change, not the 30 days the Provider gives the Client. No list of them was found in Namecheap's addendum.
• What does hold:
  • the Commission's clauses, with third-party beneficiary rights for the people whose data it is, under the law and courts of Belgium;
  • processing only on instructions (§2.2), breach notice without undue delay (§7.1), and audits (§8.2).
• What reaches Namecheap is only what is written to or from the Provider's mailbox, and each alert: an applicant's name, a link, and the administrators' addresses it goes to. The Anteroom database is not hosted there, and no certificate is sent.
• The Provider stays fully responsible to the Client for Namecheap (Clause 9(d)).