Data processing agreement

Barbeo processes personal data on the shop's behalf only to provide the contracted service: booking page, calendar, client management, communications (confirmations, reminders, review requests and marketing when enabled), cash register, packages and vouchers. The agreement lasts as long as the business account exists.

• Data subjects: the shop's clients and team members.

• Data: identification and contact (name, email, phone), bookings and visit history, notes, communication preferences, birthday, loyalty, packages, vouchers and recorded sales.

• Not intended for special categories of data (for example health); the shop must not record them in notes.

• Process the data only on the shop's documented instructions, which are the settings and actions it takes in Barbeo and this agreement.

• Ensure anyone with access to the data is bound by confidentiality.

• Apply appropriate security measures: encryption in transit, hashed passwords, per-business data isolation, role-based access control and backups.

• Help the shop answer data subject requests and meet its security, notification and impact assessment obligations.

• Notify the shop without undue delay, and within 48 hours, after becoming aware of a data breach that affects it.

• At the end of the service, allow the data to be exported and delete it within 30 days, unless the law requires it to be kept.

• Make available the information needed to demonstrate compliance with this agreement.

The shop authorises the following sub-processors, bound by equivalent data protection obligations:

• Deno Land Inc. (Deno Deploy): application hosting, EU region.
• Prisma Data Inc. (Prisma Postgres): database, EU region (Frankfurt).
• Resend Inc.: sending transactional emails.
• Stripe Payments Europe Ltd.: payment of the Barbeo subscription (only the subscribing business's data).
• Google Ireland Ltd. (Google Workspace): our support email.
• OpenAI Ireland Ltd.: only if the business uses AI branding (the shop's details and images, never client data).

Barbeo gives at least 15 days' notice before adding or replacing a sub-processor; the shop may object and, if there's no alternative, cancel the service.

The data is hosted in the EU. When a sub-processor handles data outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework or standard contractual clauses.

The shop confirms it has a legal basis to process its clients' and team's data, that it informs them of this processing (it may point to this policy), and that it only sends marketing to those who agreed to it.