Data processing agreement (DPA)

The controller is the Client, i.e. the business (salon, beauty centre, spa, barbershop, studio or other) that uses Styla and determines the purposes and means of processing the data of its clients and staff.

The processor is TP53 S.r.l., Via Pomposa 153, 44121 Ferrara (FE), Italia, VAT no. 02203290388, which processes such data solely to provide the Service.

Processing consists of collecting, recording, organising, storing, consulting, processing, disclosing (for example sending reminders) and erasing data, to the extent necessary to provide Styla's features: calendar and bookings, client cards, staff management, checkout, messages, reports and AI assistant. Processing lasts as long as the service contract and, after it ends, for the time needed to return and delete the data.

Some businesses (for example beauty, massage or wellness centres) may record health-related information in client cards, such as allergies, contraindications or previous treatments, which are special categories of data (art. 9 GDPR). The controller is responsible for collecting them only when necessary and with a valid legal basis; TP53 processes them with the same reinforced security measures applied to all Service data.

TP53 processes data only on documented instructions from the controller. The contract, the settings configured in the software and the requests sent to support constitute the instructions. If, in TP53's opinion, an instruction infringes the GDPR or other laws, TP53 informs the controller immediately. TP53 does not use the data for its own purposes, does not sell it and does not use it to train artificial intelligence models.

TP53 authorises only the staff who need it to provide or support the Service, bound by a contractual or statutory duty of confidentiality and appropriately trained. Support staff access account data only when necessary to resolve a request from the controller.

Under art. 32 GDPR, TP53 adopts, among others, the following measures:

• encryption of data in transit (TLS 1.2 or higher) and at rest;
• logical separation of each client's data and row-level access controls;
• secure authentication, role and permission management for the controller's users;
• automatic backups with periodic restore tests;
• logging and monitoring of administrative access;
• vulnerability management and updating of software components;
• least-privilege principle for TP53 staff and incident management procedures.

The controller gives TP53 general authorisation to engage other processors ("sub-processors"), on whom TP53 contractually imposes data protection obligations equivalent to those of this agreement. TP53 notifies the addition or replacement of a sub-processor by email at least 30 days in advance; the controller may object on reasonable data protection grounds and, if no solution is found, terminate the contract without penalty. TP53 remains fully liable for the sub-processors' performance.

Any integrations chosen by the controller (for example external messaging, calendar or payment services) are activated under its responsibility and governed by the relevant provider's terms.

Data is stored primarily in the European Economic Area. Any transfers outside the EEA take place only on the basis of an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, following a transfer risk assessment.

Taking into account the nature of the processing, TP53 assists the controller:

• in responding to data subject requests (access, rectification, erasure, portability), including through the software's export and deletion features, forwarding without delay any requests received directly;
• with data protection impact assessments (DPIA) and prior consultation of the supervisory authority, where required;
• in complying with security and breach notification obligations.

TP53 informs the controller without undue delay, and in any case within 48 hours of becoming aware of it, of any breach of personal data processed on its behalf. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, so that the controller can notify the supervisory authority within 72 hours under art. 33 GDPR.

TP53 makes available to the controller the information needed to demonstrate compliance with art. 28 GDPR. The controller may carry out checks, directly or through an auditor bound by confidentiality, with at least 30 days' notice, no more than once a year except in case of breaches or requests from the authorities, in ways that do not compromise the security of other clients. The costs are borne by the controller.

When the contract ends, the controller may export its data for 30 days. After that, and in any case within 90 days, TP53 deletes the personal data processed on behalf of the controller, including from backups according to the rotation cycle, unless retention is required by EU or Italian law. On request, TP53 confirms the deletion in writing.

The controller warrants that it has a valid legal basis for the processing entrusted, has provided data subjects with the information required by arts. 13 and 14 GDPR, obtains the necessary consents (for example for marketing by SMS, email or messaging) and configures the Service consistently with its instructions.

This agreement remains in force for the whole duration of the processing. In case of conflict between this agreement and the Terms of service on data protection matters, this agreement prevails. Italian law and the jurisdiction stated in the Terms of service apply. The parties are liable under art. 82 GDPR.