Compliant with Article 28 of the GDPR (EU Regulation 2016/679) • Contractual annex to the Terms and Conditions
This Personal Data Processing Agreement (Data Processing Agreement – DPA) sets out the contractual conditions under which the Publisher DEVOXIS processes, as Processor, the personal data of End Customers on behalf of and on the instructions of the Hair Salon / Barber (the Client), acting as Data Controller.
Article 1 – Legal qualification of the respective roles
-
The Salon (Client) is the DATA CONTROLLER:
The Salon collects and manages the contact details, appointments, hair preferences and history of its own customers (End Customers). It alone determines the purposes and lawfulness of this processing within its establishment. -
DEVOXIS is the PROCESSOR (Art. 28 GDPR):
DEVOXIS provides the SaaS infrastructure, the secure database, the booking engine and the communication modules. DEVOXIS acts solely on behalf of and on the instructions of the Salon.
Article 2 – Description of the processing carried out
| Purposes of the processing: | 24/7 online booking, team schedule management, CRM and customer records, automatic SMS/email reminders, chair timing, till management and loyalty balance. |
| Data subjects: | End Customers of the hair salon / barber, telephone callers handled by the voice agent, team staff and hairdressers. |
| Types of data processed: | Surnames, first names, mobile numbers, emails, haircut history, technical notes, non-biometric photographs of hairstyles (uploaded via temporary tokens /upload/:token), amounts paid and tabs/debts. |
| Duration of the processing: | Strictly limited to the term of the Subscription taken out by the Salon to the CYB platform. |
Article 3 – Strict commitments of DEVOXIS (Processor)
In accordance with Article 28 of the GDPR, DEVOXIS formally undertakes to:
- Processing exclusively on documented instructions: Process End Customers' data only in the context of the Salon's normal use of the CYB modules.
- PROHIBITION OF SALE AND MONETISATION: DEVOXIS formally undertakes not to sell, rent, transfer, assign, exploit or monetise the Salon's customer base on its own behalf or on behalf of third parties, and refrains from any direct marketing to End Customers.
- Team confidentiality: Ensure that all persons authorised to work on the infrastructure (developers, system technicians) are bound by a strict contractual confidentiality obligation.
- Security and multi-tenant separation: Ensure absolute logical isolation of data between the different salons (Tenant Isolation), TLS encryption of data flows and redundant daily backups.
- Breach notification within 48 hours: Inform the Salon by email within a maximum of forty-eight (48) hours of becoming aware of any personal data breach or leak.
- Assistance with data subject rights: Provide the Salon with the features needed to export, correct or delete an End Customer's data upon simple request.
Article 4 – Authorised sub-processors
The Salon authorises DEVOXIS to use the following infrastructure and service sub-processors, which are essential to the technical operation of the solution:
| Sub-processor | Technical role | Server location |
|---|---|---|
| [NOM_HEBERGEUR, ex : Hetzner / OVHcloud] | Hosting of servers, Docker containers and MariaDB databases | France / European Union |
| Twilio Inc. | Routing and delivery of transactional SMS / reminders | EU / United States (Data Privacy Framework) |
| Stripe Payments Europe | Securing of payments, subscriptions and online deposits | European Union (Ireland) |
| AI API providers (OpenRouter / OpenAI) | CMS content generation & Voice processing for the switchboard agent | EU / United States (Encryption in transit / Zero retention for training) |
Article 5 – Reversibility and deletion of data at the end of the contract
5.1. Right to export (30 days): Upon termination of its Subscription, the Salon has thirty (30) days to carry out a complete, free export of all its data (customer files, history, schedules) in standard CSV and JSON formats directly from the CRM dashboard.
5.2. Secure permanent destruction: At the end of this 30-day period, DEVOXIS irreversibly and automatically erases all of the Salon's personal data from its active production servers.
Article 6 – Contact and Data Protection Officer
For any question regarding the application of this DPA or the security of your processed data:
DEVOXIS DPO contact: [EMAIL_CONTACT]