Data Processing Agreement

Article 1. Subject matter

MyWest processes personal data solely on the instructions of the Salon, to the extent necessary to provide the MyWest software as a service. The Salon remains the controller; MyWest is the processor.

Article 2. Duration

This data processing agreement applies for as long as the Salon uses MyWest and ends automatically with the subscription, except for the provisions that by their nature continue to apply, such as confidentiality and the deletion after termination under article 10.

Article 3. Nature and purpose of the processing

MyWest processes personal data to provide the software as a service: storing and displaying the Salon's calendar, customer, till, service and staff data, sending transactional email (such as appointment confirmations and reminders) on behalf of the Salon, and collecting the Salon's own subscription payments. MyWest never uses this data for its own marketing or for any purpose other than providing the service to the Salon.

Article 4. Types of personal data and data subjects

• The Salon's customer data: name, contact details, appointment history and, to the extent the Salon itself enters it, notes about a treatment.
• Staff data: name, contact details, schedule and, to the extent the Salon itself enters it for its own payroll administration, Dutch citizen service number (BSN), IBAN and salary data.
• The Salon's own business data (the controller): name, address, Chamber of Commerce number, VAT number and IBAN.

Article 5. Obligations of the processor

MyWest processes personal data only on the basis of documented instructions from the Salon and for the purposes of article 3, unless a law obliges MyWest to a different processing; in that case, MyWest informs the Salon in advance of that legal obligation, unless the law prohibits providing that information.

MyWest ensures appropriate technical and organisational security measures (article 7), requires everyone processing personal data under its authority to maintain confidentiality, and cooperates with a reasonable request from the Salon to demonstrate compliance with this agreement.

Article 6. Subprocessors

MyWest uses the following subprocessors to perform the service:

• Supabase: database and file storage, EU-west region.
• Vercel: hosting of the application, London region (United Kingdom; the United Kingdom is covered by an adequacy decision of the European Commission).
• Mollie B.V.: processing of payments and direct debits.
• Resend: sending of transactional email.
• Sentry: error monitoring of the application.
• Anthropic, PBC: AI features (AI assistant, text generation, recognition of receipts, products and documents), only for the data the Salon itself submits to those features; under its commercial terms, Anthropic does not use this data to train models.
• OpenAI, LLC: speech-to-text conversion, only if the Salon uses voice input.
• Discord Inc.: internal operational notifications to MyWest about the service (salon name, the Salon's contact address and the nature of the event); no customer data.

MyWest enters into an agreement with every subprocessor that imposes on that subprocessor at least the same obligations that this data processing agreement imposes on MyWest. MyWest announces a new subprocessor, or the replacement of an existing one, at least 30 days in advance by email; the Salon may raise a reasoned written objection within that term.

Article 7. Security

MyWest secures personal data with appropriate measures, which in any event include: encryption of data in transit (TLS), access to data on a role basis and only for those who need it for their work, an environment separated per salon at database level (row level security), and regular security updates of the software used.

Article 8. Data breaches

If MyWest discovers a breach relating to personal data it processes for the Salon, it notifies the Salon without undue delay and in any event within 48 hours of discovery, with the information the Salon reasonably needs to assess for itself whether notification to the data protection authority or to data subjects is required. The Salon itself remains responsible for deciding whether or not to notify a data breach to the supervisory authority or to data subjects.

Article 9. Rights of data subjects

If MyWest directly receives a request from a data subject (for example, a customer or member of staff of the Salon) concerning the processing carried out by the Salon, MyWest forwards this request to the Salon and does not itself respond to it on the merits. MyWest assists the Salon, to the extent reasonably possible within the capabilities of the software, in responding to a request for access, rectification, erasure or portability of data.

Article 10. Deletion after termination of the agreement

After termination of the agreement between MyWest and the Salon, MyWest deletes or anonymises the personal data it processed for the Salon, within the retention period stated for that purpose in MyWest's general terms and conditions, except for what MyWest is legally required to retain, in particular the accounting records relating to invoices.