Agreement for processing data on behalf of the business
Separate acceptance of this document by the business's authorised representative is recorded with its version and date. It supplements the Terms of Service.
Parties and roles
The registered business, identified by its business name, VAT number, address and representative in the account, determines the purposes and means of processing its clients' and staff's data (data controller). Longo Alfredo, for data entered by the business into the software, acts on the business's behalf within the scope of providing the service (data processor). For the account, payments and commercial relationship, the provider acts as an independent controller under theprivacy notice.
Scope and duration
The service includes storing, viewing and editing client records, appointments, treatments, staff, services, sales, stock and communications configured by the business. Processing continues for the contractual relationship and the return or deletion activities to be defined in the exit plan. Closing access does not instantly delete data.
Data subjects, data and purposes
Data subjects may include clients, employees, contractors and business contacts. Names, contact details, appointments, notes, treatment history, purchases and communications may be processed. The business must avoid excessive data; health information requires a specific assessment of legal bases, Article 9 GDPR and appropriate measures. The business provides its own notices and decides whether and when to send reminders or marketing.
Instructions and confidentiality
The provider processes business data only to provide the service and in accordance with the business's documented instructions, except where applicable law requires otherwise, in which case it informs the business where permitted. Authorised persons are bound by confidentiality. If an instruction appears contrary to privacy law, the provider informs the business.
Security and cooperation
The provider adopts technical and organisational measures proportionate to risk, including access controls, separate business workspaces, credential and authorisation management, backup and recovery procedures, updates and incident recording. Measures actually implemented and verifiable must be described in the technical annex before this agreement is approved. The provider cooperates with the business on data subject requests, breaches, impact assessments and audits within the limits of available information.
Breaches, subprocessors and transfers
The provider informs the business without undue delay of personal data breaches it becomes aware of, supplying available information to manage the incident. Technical providers currently integrated include Vercel (hosting), Neon (database) and Clerk (authentication), and, when activated, Stripe (payments) and Brevo/messaging services (communications). The final list must specify each provider's privacy role, activities, processing locations, transfers outside the EEA and safeguards. Subprocessors require authorisation under Article 28 GDPR and equivalent contractual obligations.
Termination and audit
When the service ends, the business may request return or deletion of data, subject to statutory retention obligations. Export formats, operational deadlines, backup handling and deletion periods must be set in the exit annex before commercial activation. The provider makes reasonably necessary information available to demonstrate compliance and permit agreed audits.
Annexes requiring approval
Before delivery, the following are required: the final list of operations and data categories; tested technical and organisational measures; the subprocessor list with locations and transfer safeguards; export, deletion and backup procedures; and incident contacts and procedures. A reference for review is the European Commission's standard contractual clauses.
Documentation contact: info@seylabeauty.com.