Data Processing Agreement (DPA)

The Salon is the Controller of the personal data of its End-clients entered and managed in the Service, and is responsible for the lawfulness of its collection, for the privacy notice given to data subjects and for any necessary consents. Heritage Srls is the Processor of that data and processes it solely to provide the Service, on the Controller's documented instructions.

For account data, Salon staff data, billing data and technical product-usage data, Heritage Srls instead acts as an independent Controller: that processing is described in the Privacy Policy and is not governed by this DPA.

• Subject matter and nature: collection, recording, organisation, storage, retrieval, processing, disclosure and erasure operations carried out by automated means through the Kairo platform.
• Purpose: management of calendar and bookings, till, receipts and electronic invoicing, client records, communications to End-clients, marketing authorised by the Controller, and generation of AI insights and suggestions.
• Duration: for the term of the subscription agreement, and thereafter for the time needed for the steps set out in section 9.
• Categories of data subjects: the Salon's End-clients and any contacts they provide.
• Categories of data: identity and contact data, appointment, purchase and payment history, preferences, technical notes entered by the Salon (which may include health data under Art. 9, e.g. allergies), and message and call content where those channels are enabled.

The Processor processes personal data only on the Controller's documented instructions, including as regards transfers to third countries, unless required to do otherwise by Union or Member State law: in that case it informs the Controller before processing, unless the law prohibits it. The Controller's documented instructions consist of:

• these Terms and this DPA;
• use of the Service and its features by the Salon's authorised users, including the settings chosen in the account;
• the instruction, specifically given by accepting the Terms, to aggregate and anonymise the data in order to produce industry statistics. That processing takes place with the safeguards described in section 6 of the Privacy Policy — prior removal of every identifier, a minimum threshold of five salons for any figure released — and its output, being anonymous, is no longer personal data within the meaning of Recital 26 GDPR. The Controller may withdraw this instruction at any time by writing to the contacts in section 11; withdrawal does not extend to anonymous statistics already produced, which can no longer be traced back to the Controller.

The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data-protection provisions.

The Processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access to the data is limited to staff who genuinely need it to provide the Service.

The Processor implements technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest;
• user authentication, role-based access control and logical separation of each Salon's data;
• regular backups and restore procedures;
• logging of access to and material changes made to End-client data;
• minimisation of the data transmitted to sub-processors, in particular AI providers.

The Controller gives the Processor general authorisation to engage sub-processors to provide the Service. The Processor imposes on each of them, by contract, data-protection obligations no less onerous than those in this DPA, and remains fully liable to the Controller for their performance. The categories currently engaged are:

• cloud infrastructure and application hosting;
• database hosting, in the European Union;
• language-model providers, for the AI features, in zero-data-retention mode and limited to entities headquartered in the United States or the European Union;
• telephony, SMS and messaging providers, including WhatsApp (Meta), and speech synthesis/recognition providers where the voice assistant is enabled;
• transactional email delivery provider;
• Stripe, for subscription payment handling.

The named, up-to-date list is available by writing to kairo.aidesk@gmail.com. The Processor gives the Controller at least 30 days' notice of any intention to add or replace a sub-processor; within that period the Controller may object on reasonable data-protection grounds and, if the disagreement is not resolved, terminate the contract without penalty as to the affected part of the Service.

Some sub-processors process data outside the European Economic Area, in particular in the United States. In those cases the transfer relies on the Standard Contractual Clauses adopted by the European Commission and on appropriate supplementary measures. In particular, the content of requests made to the AI assistant — which may include End-clients' names, contacts, calendar and spend history — may be processed by model providers located outside the EEA, admitted only if they operate in zero-data-retention mode and are headquartered in the United States or the European Union. The Controller acknowledges this transfer, which forms part of the documented instructions in section 3.

The Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in responding to requests to exercise data-subject rights (access, rectification, erasure, restriction, portability, objection). The export, edit and erasure features available in the product are the primary means to that end; where they are not sufficient, the Processor acts on the Controller's written request.

If a data-subject request is addressed directly to the Processor, the Processor does not act on it on its own initiative and forwards it to the Controller without undue delay.

The Processor also assists the Controller in ensuring compliance with the obligations in Arts. 32–36 GDPR. In the event of a personal-data breach, it notifies the Controller without undue delay and in any case within 48 hours of becoming aware of it, providing the information needed for notification to the supervisory authority and, where required, to the data subjects.

On termination of the Service, at the Controller's choice, the Processor deletes the personal data or returns it in a structured, commonly used, machine-readable format. The Controller has 30 days from termination to export the data; if that period passes without instructions, the data is deleted on the timelines set out in the Privacy Policy. Copies that the Processor is required to retain by law are excepted, for the strictly necessary period and with any further processing prohibited.

The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations in this DPA and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates. Audits are requested in writing with at least 30 days' notice, take place during business hours, no more than once a year save where a breach has been established or a supervisory authority so requires, must not compromise the confidentiality of other customers' data, and are at the Controller's expense unless they reveal a material failure by the Processor.

This DPA takes effect on account creation and remains in force for the duration of the processing carried out on the Controller's behalf. Material changes are notified with reasonable advance notice under section 14 of the Terms. For any communication concerning this agreement: kairo.aidesk@gmail.com.