Договор за обработка на податоци
Последно ажурирање: 15 октомври 2026 г.
Оваа страница е достапна на англиски и српски јазик. Се прикажува на англиски додека не биде достапен проверен превод.
This agreement is between the clinic ("Controller") and DUŠAN ANTOVIĆ PR RAČUNARSKO PROGRAMIRANJE TREEONIX BEOGRAD (ZEMUN), Ugrinovačka 98, 11080 Beograd (Zemun), Serbia, registration number (MB) 68152879, tax ID (PIB) 115168900 ("Processor"). It applies whenever Vetonect processes personal data for the clinic, and forms part of the Terms of Service. It meets GDPR Article 28 and Article 45 of Serbia's Law on Personal Data Protection.
1. What is processed
| Item | Detail |
|---|---|
| Purpose | Running the clinic's practice software: clients, patients, visits, vaccinations, prescriptions, invoices, appointments, reminders and messages |
| Duration | As long as the clinic uses Vetonect, plus the deletion period in section 6 |
| People concerned | The clinic's clients (pet owners) and staff |
| Data | Names, contact details, addresses, national ID numbers where entered, pet details, medical notes about animals, invoices and payments, messages, photos |
| Special categories | None expected. Medical data about animals is not health data about people. The clinic must not enter human health data. |
2. Processor's obligations
The Processor will:
- process the data only on the clinic's documented instructions, which are the Terms, this agreement and the clinic's use of the app;
- make sure everyone with access is bound to confidentiality;
- apply the security measures in Annex A and keep them up to date;
- help the clinic answer requests from its clients (access, correction, deletion) and with any data protection impact assessment;
- notify the clinic of a personal data breach without undue delay and within 48 hours of becoming aware of it, with what is known at the time;
- make available the information needed to show it meets this agreement, and allow audits with 30 days' notice, at most once a year unless a breach has occurred.
3. Sub-processors
The clinic authorises the sub-processors below. The Processor will give 30 days' notice of any new one; the clinic may object, and if no solution is found, may end the agreement.
| Sub-processor | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and database | Germany |
| Cloudflare, Inc. | File storage, backup storage, DNS | Europe (preferred location); Cloudflare, Inc. is a US company |
| Resend (Plus Five Five, Inc.) | Transactional email | United States |
| Google LLC | Address lookup and maps | United States |
Each sub-processor is bound by data protection terms at least as strict as these. Transfers outside the EEA and Serbia rely on standard contractual clauses or the EU-US Data Privacy Framework.
4. Clinic's obligations
The clinic confirms it has a lawful basis for the data it enters, informs its clients as the law requires, and manages its staff's access.
5. Liability
As set out in the Terms of Service, section 7.
6. Return and deletion
When the clinic leaves, the Processor will, at the clinic's choice, provide a copy of its data in a common, machine-readable format and then delete it within 30 days. Copies in backups are overwritten on their normal cycle, within about five weeks. Data the law requires the Processor itself to keep is kept only for that purpose.
Annex A: Security measures
- All connections encrypted with TLS. The server firewall accepts only web traffic and administrative SSH.
- Passwords stored as bcrypt hashes. Sign-in requires a verified email, confirmed with a one-time code that expires after 2 minutes.
- National ID numbers encrypted in the database with a separate key.
- Every request is checked on the server against the user's clinic and role (owner, admin, vet, vet tech, receptionist, assistant).
- A full database backup every night to separate, private object storage, reached with credentials limited to that storage. The last 7 days and 4 weekly copies are kept. A restore was tested on 30 September 2026.
- A further backup before every software update, which runs through an automated, reviewed deployment.
- Production access is limited to the founder, Dušan Antović, and the automated deployment process (GitHub Actions), each with its own SSH key.