Inventory
Hosting/VPS: Hostika, operational country and contract to be confirmed. Network/security: Cloudflare. Sign-in: Google. Optional submitted AI content: OpenAI. Payment processors: Stripe/Google Play only when activated. Partner offer API: Digitalna kuhinja, public listing information. Each provider’s exact role, subprocessors and transfers must be documented.
B2B processing agreement
A business customer who uploads guest/employee data may act as controller and Wedalio as processor for that workspace. A signed GDPR Article 28 agreement must set subject, duration, purposes, data subjects/types, documented instructions, confidentiality, security, subprocessors and change notices, rights assistance, incidents, audits, return/deletion and transfer safeguards. This summary is not a signed DPA.
Incident procedure
The operator must document incident contacts, assessment, containment, processor notification and regulator/data-subject notification where legally required, including the GDPR 72-hour supervisory notification rule when applicable. This page does not promise a staffed 24/7 response.