1. Subject Matter, Parties, and Legal Qualifications
This Agreement governs the processing of personal data in connection with providing the HurryStyle salon management software.
The parties are defined under EU Regulation 2016/679 (GDPR) as follows:
- The Hair Salon: acts as Data Controller for all personal data belonging to its end clients and staff members entered into the application.
- Simone Venturini (natural person, developer and operator of the service): acts as Data Processor under GDPR Article 28, processing salon data exclusively on behalf of the Controller and pursuant to its documented instructions.
2. Processing Purpose, Categories of Data, and Data Subjects
The service processes data for calendar, contacts, services, schedules, completed service value, work photos, export and salon analysis. Operations include collection, storage, access, indicator calculation, sync, sharing on the controller’s instruction and deletion. Data includes names and contacts, appointments and amounts, schedules and exceptions, style preferences, images and comments. Data subjects are salon clients and staff. Health data is excluded. Processing lasts for the relationship and the operations required to return or delete data.
3. Processor Obligations and Documented Instructions
The Processor agrees to:
- Process personal data only on documented instructions from the Controller, including standard application operations, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
- Promptly inform the Controller if, in the Processor's opinion, an instruction infringes the GDPR or applicable data protection laws;
- Ensure that authorized persons processing personal data have committed themselves to confidentiality;
- Implement appropriate technical and organizational measures pursuant to GDPR Article 32 (encryption in transit, access controls, data integrity protection).
4. Sub-processors and Notification Procedure
The Controller authorizes the engagement of the following infrastructure providers:
- Google Cloud / Firebase: Actual sub-processor for hosting the salon database (Firestore in Milan, Italy) and user authentication (Firebase Authentication in the United States, governed by Standard Contractual Clauses and Google Cloud DPA).
- Cloudflare, Inc.: Network provider for DNS, web hosting, and email routing; operates a separate infrastructure role and does not host salon tenant application databases.
The Processor imposes equivalent data protection obligations on sub-processors and remains responsible for their performance. Any intended modification or addition of sub-processors will be notified with prior notice, allowing the Controller to object on valid privacy grounds.
Google Cloud Storage holds private photos in europe-west1 (Belgium), with protected copies for 7 days after deletion. Google/Firebase also provides server functions and App Check/Play Integrity protections. No generative AI or Google review import sub-processor is configured.
5. Controller Assistance, Data Breaches, and DPIAs
Taking into account the nature of processing and information available, the Processor assists the Controller in ensuring compliance with obligations pursuant to Articles 32 to 36 of the GDPR:
- In fulfilling requests by data subjects exercising their rights under Chapter III GDPR;
- In ensuring security of processing pursuant to GDPR Article 32;
- In notifying the Controller of personal data breaches (Data Breach under GDPR Article 33) without undue delay after becoming aware of it, as well as assisting with breach communications to data subjects pursuant to GDPR Article 34;
- In conducting Data Protection Impact Assessments (DPIAs pursuant to GDPR Article 35) and consulting the supervisory authority prior to processing pursuant to GDPR Article 36.
6. Deletion or Return of Personal Data
On termination the controller may choose return or deletion of data, except retention required by law. Owner CSV export remains available after expiry; data not covered by export may be requested from support before deletion. The process removes the active archive and photos. Protected photo copies expire after 7 days; provider deletion cycles and copies on devices or with external recipients are explained in the privacy policy. The processor assists the controller with data-subject requests.
7. Audits, Information, and Document Status
The Processor shall make available to the Controller information reasonably necessary to demonstrate compliance with GDPR Article 28 and allow for and contribute to proportionate audits, including inspections, conducted by the Controller or another independent auditor mandated by the Controller.
Agreement Effectiveness: This is the current version made available for transparency; the DPA becomes binding for each Salon through digital acceptance or formal signature before commercial use of the service.