Effective from 13.11.2026
Българска версия · This is a translation for convenience. If it differs from the Bulgarian text, the Bulgarian text prevails.
This agreement is an integral part of the contract between the Client and Домеско ЕООД (Domesko Ltd.), UIC 207716933, registered office Sofia, ul. "5028-ma", 17, D (the “Provider”) under the Terms of Service and governs the processing of personal data under Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). Terms have the meaning given to them by the Terms of Service and the GDPR.
1. Roles
1.1. The Client is the controller of the personal data of their End clients and their Team. The Provider processes them as a processor, on behalf of the Client, only as far as needed for Tickabell.
1.2. The data are stored on the Client’s Site, on the Client’s hosting. The Provider has access to them only: during installation, setup and support of Tickabell; when fixing problems the Client asked for help with; and when sending notifications to the Team’s phones through the App.
1.3. Services the Client connects under their own contract (hosting, email, Google Calendar, Stripe, BORICA, SMS providers and others) process the data as processors of the Client, not of the Provider.
2. Subject matter and data
- Purpose: providing Tickabell under the Terms of Service – online booking, managing bookings, clients, payments and documents, notifications, support.
- Data subjects: the Client’s End clients and the members of the Client’s Team.
- Types of data: name, phone, email, day and month of birth (if the Client collects them), bookings, services and prices, Team notes, answers to questions in the form, files sent by the End client, ratings and comments, payment data (without card details), invoice data, consents to marketing messages.
- Special categories of data: Tickabell is not designed for them, but the Client may collect them – for example health data in form questions or notes. If they do, the Client is responsible for the legal basis and for the additional measures the law requires for them.
- Duration: for as long as the contract lasts and up to 30 days after it ends.
3. Obligations of the Provider
The Provider:
- processes the data only on documented instructions from the Client – the Terms of Service, this agreement, the Tickabell settings and the Client’s written requests – unless the law requires otherwise (in which case it informs the Client in advance, unless the law forbids that);
- ensures that the people with access to the data are bound by confidentiality;
- applies appropriate technical and organisational measures under Article 32 GDPR (section 4);
- complies with the conditions for sub-processors (section 5);
- helps the Client respond to requests from data subjects – for access, rectification, erasure, restriction, portability and objection – including through the built-in Tickabell and WordPress tools for exporting and erasing data;
- helps the Client with security, notification of breaches and impact assessments, as far as necessary and taking into account the information available to it;
- notifies the Client without undue delay and, where possible, within 48 hours after becoming aware of a personal data breach, describing what is known about it and the measures taken;
- deletes the data it had access to after the processing ends, unless the law requires it to keep them;
- provides the Client with the information needed to demonstrate compliance with Article 28 GDPR and allows audits – with reasonable notice, during working hours, not more than once a year (except after a breach), at the Client’s expense and protecting the confidentiality of other clients.
4. Security measures
The Provider applies measures appropriate to the risk, including:
- the data stay on the Client’s Site; the Provider makes no copies unless needed for a specific task and deletes them after it;
- access to the Site is with a separate account, which the Client can stop at any time, and only by those of the Provider’s people who need it;
- an encrypted connection for every access and for the connection between the App and the Site;
- the Provider’s devices and accounts are protected with passwords, two-factor authentication where possible and disk encryption;
- Tickabell updates are checked before release and distributed securely;
- in Tickabell: permissions by role (each team member sees only their own bookings and clients), protected End client files, secret links for documents and client pages, automatic deletion of old data after the period the Client sets.
5. Sub-processors
5.1. The Client gives the Provider general authorisation to use sub-processors. At the date of this agreement they are:
- 650 Industries, Inc. (Expo), USA – sending App notifications to the Team’s phones (the notification text contains only the type of event, the service and the time, and for a new rating – the stars and the service; without the End client’s name and without the text of the rating);
- Apple Inc. and Google LLC – delivering notifications to iOS and Android devices;
- the Provider’s hosting and email provider – support correspondence, when the Client sends personal data in it.
5.2. Where a sub-processor is outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework) or on the Commission’s standard contractual clauses.
5.3. The Provider imposes the same data protection obligations on its sub-processors and is liable for them to the Client.
5.4. The Provider notifies the Client in writing at least 30 days before adding or replacing a sub-processor. The Client may object on reasonable grounds related to data protection. If the parties cannot find a solution, the Client may terminate the contract and receive back what was paid for the full months after termination.
6. Obligations of the Client
The Client is responsible for the lawfulness of the processing: having a legal basis for it, informing the End clients and the Team (including in their own privacy policy that they use Tickabell and the services they have connected), collecting consents where needed, setting a reasonable retention period and not entering into Tickabell data that are not needed.
7. Liability and term
7.1. Section 16 of the Terms of Service applies to liability under this agreement, unless the GDPR provides otherwise.
7.2. The agreement applies for as long as the contract lasts and the Provider has access to the Client’s personal data.