Data Processing Agreement (DPA)

1. Who does what

The studio is the Controller of its clients' data: it decides what data to collect, for what purpose and on what legal basis, and is answerable for those choices.

The Provider is the Processor: it supplies the tool and processes that data only to run the Service, on the Controller's documented instructions.

The Controller's documented instructions are these: store, organise, make available, export and delete the data entered, through the functions the Service offers. We neither receive nor act on other instructions except by written agreement.

2. Data processed on the Controller's behalf

Categories of data subjects: the studio's clients and, where given, their contacts.

Categories of data: identity and contact details; health questionnaires; informed consents signed on a device; photographs of the treated area; professional notes on sessions; pigments, lots and tools used; payments recorded by the studio.

What the signature actually captures: the image of the stroke drawn on screen (a PNG file), the name typed by the signer, the date and time, the IP address and browser used, the text of the signed document and its digital fingerprint. Biometric signature data — pressure, speed, acceleration, rhythm — is NOT captured, so this is not a graphometric signature and does not fall under Article 9 on that basis. The health data processed remains that contained in the health questionnaire.

This includes special categories of data under Article 9 of the Regulation, in particular the health data contained in the questionnaire. The Controller must identify an appropriate legal basis for processing it, ordinarily the explicit consent of the data subject obtained before treatment.

Duration: for the term of the contract and, on termination, as set out in clause 8 of this agreement.

3. Confidentiality

Anyone at the Processor authorised to access the data is bound by a duty of confidentiality and accesses it only where necessary for support or for the security of the Service.

The Processor does not consult client data for its own purposes and does not disclose it to third parties outside this agreement.

4. Security measures

Encrypted transmission (HTTPS), passwords stored only as bcrypt hashes, private file storage with no public address and an access check on every file.

Logical separation of data by studio: no query can read another studio's data.

Distinct roles within the team, an action log with author and date, and rate limiting on sign-in attempts.

Execution and storage in the European Union. Backups managed by the database provider.

5. Sub-processors

The Controller gives general authorisation for the sub-processors listed in the privacy policy published at /legal/privacy. Each is bound by protection obligations no less onerous than those set out here.

Changes to the list are notified at least 30 days in advance by email or in the application. The Controller may object on reasonable and documented grounds: if the objection cannot be resolved, it may terminate the contract with no penalty for the unused part of the service.

6. Assistance to the Controller

The Processor assists the Controller, so far as reasonable, in responding to data subject requests (access, rectification, erasure, portability). The export function built into the Service is the ordinary means of doing this independently.

The Processor assists the Controller with impact assessments and prior consultation, where required, by providing the technical information available to it.

If a data subject request reaches the Processor directly, the Processor does not act on it and forwards it to the Controller without delay.

7. Personal data breaches

The Processor informs the Controller without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting data processed on its behalf, with the information available on its nature, the data involved, likely consequences and measures taken.

Notification to the supervisory authority and, where required, communication to data subjects remain the Controller's obligations.

8. Deletion and return

On termination the Controller may export all data from the Service, independently, until the deletion date.

Thirty days after termination, the data and related files are permanently deleted from production systems. At the Controller's written request deletion is brought forward and carried out within 30 days of the request.

Only accounting records, which contain no client data, are retained for the period required by law.

9. Audits

The Processor makes available to the Controller the information needed to demonstrate compliance with Article 28 and allows audits, including by an auditor mandated by the Controller, on reasonable notice, no more than once a year save where a breach has been established, and in a manner that does not compromise the security of other customers.

10. Transfers

Processing takes place in the European Union. Where a transfer to a third country becomes necessary, it takes place on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision.

11. Liability and precedence

This agreement prevails over the Terms as regards the processing of the studio's clients' personal data. In all other respects the Terms apply, including the limitations of liability to the extent permitted by applicable law.

Nothing in this agreement limits either party's liability towards data subjects or derogates from mandatory provisions of the Regulation.