Data processing agreement

The Processor processes data only to provide the Fadevo service to the barbershop, for as long as the subscription lasts and during the retention period in section 9.

• The barbershop's clients: name, mobile number, email (optional), notes and requests, booking history, no-shows, points and rewards, friend invitations, client account and communication preferences.
• The barbershop's team: name, photo, role, bio, working hours, assigned bookings and, for those with dashboard access, email and session data.

Special categories of data (for example, health data) are not intended to be processed. The barbershop should not enter them in notes.

The Processor processes data only on the barbershop's documented instructions, which are those set out in these terms and those the barbershop gives by using the dashboard (for example, creating, changing or deleting a client). If an instruction appears to infringe the law, the Processor informs the barbershop.

People authorised to process the data at the Processor are bound by confidentiality.

• Encrypted communications (HTTPS) and passwords stored encrypted.
• Separation of each barbershop's data by rules in the database itself (each barbershop only accesses its own data).
• Role-based access (owner, manager, barber) and Fadevo administrative access protected by two-step verification and logged.
• Database hosted in the European Union (Frankfurt), with the provider's backups.
• Data minimisation: for bookings only name and mobile number are required.

The barbershop authorises the Processor to use the following sub-processors, bound by equivalent data protection obligations:

• Supabase (database and authentication; data hosted in Frankfurt, Germany).
• Vercel (hosting of the site and dashboard).
• Resend (sending confirmation, reminder and sign-in code emails).

When a sub-processor is outside the European Union, the transfer is made under the EU-US Data Privacy Framework or standard contractual clauses. The Processor informs the barbershop of any intended change to this list at least 30 days in advance, and the barbershop may object and cancel the subscription.

The dashboard lets the barbershop view, correct, export and anonymise clients' data, and clients can download or delete their data in the client area. If a client contacts the Processor directly, the Processor forwards the request to the barbershop.

If it becomes aware of a personal data breach affecting the barbershop, the Processor informs the barbershop without undue delay and, where possible, within 48 hours, with the information available so the barbershop can meet its obligations (including notifying the supervisory authority within 72 hours, where applicable).

When the subscription ends, the data is kept for 12 months so the barbershop can come back, and is then deleted, unless the law requires it to be kept. Before then, the barbershop can export its clients' data and ask for earlier deletion.

The Processor makes available to the barbershop the information needed to demonstrate compliance with this agreement and cooperates with reasonable audits, with prior notice.

As controller, the barbershop ensures it has a lawful basis to process its clients' data, informs them about the processing (each barbershop's site includes a base privacy policy, which the barbershop should confirm and complete) and responds to data subjects' requests.