Data processing agreement

This document is the contract required by article 28.3 of Regulation (EU) 2016/679 (GDPR) between the business that uses Bellioo and the provider of the platform. It forms part of the Business terms and is accepted on sign-up.

• Controller: the business that uses Bellioo (the "Business").
• Processor: Peacock Digital LLC, a company formed in the State of Florida, United States, with its registered address at 1032 E Brandon Blvd, #7001, Brandon, FL 33511, United States, and EIN 37-2167612 ("Bellioo"). We are appointing a representative in the European Union under article 27 of the GDPR; we will publish their details in the Legal notice as soon as the appointment is made.

1. Subject matter, duration, nature and purpose

Bellioo processes on the Business's behalf, and on its instructions, the personal data the Business enters or generates in the Service about its clients and contacts, for the sole purpose of providing it with the Service described in the Business terms: calendar, bookings, client management, reminders, communications, loyalty, signed informed consent and statistics. The operations are collection, hosting, storage, organisation, retrieval, communication by email and WhatsApp, generation of signed documents, production of statistics for the Business and erasure.

The processing lasts as long as the contract and ends with the deletion or return of the data under section 9.

2. Which data and whose

Special categories. Health data in the informed consent is processed with the safeguards in section 3. Outside it, the Business will not process in Bellioo health data or other categories under article 9 of the GDPR in free-text fields such as client notes, except what is strictly essential to provide the service, with the client's explicit consent. Those fields are not designed or secured for it, and using them that way is the Business's decision and responsibility.

3. Signed informed consent

If the Business requires an informed consent for a service, for example tattooing, piercing or micropigmentation, its instructions to Bellioo are these:

1. Present the form written by the Business so the client can fill it in and sign it in the app or on the website: when booking, later from their appointment, or with the QR code the Business shows them. Bellioo verifies the signer with a one-time code sent to their email or with their verified account's session and, if they are under 18 on the day of the appointment, also asks for the details and signature of their parent or guardian.
2. Generate the document: a PDF with the exact text signed, the answers, the signatures and the record, with a digital fingerprint that makes it possible to check it has not been altered. If the Business later changes the form, what has already been signed does not change.
3. Send the signer a copy of the PDF by email, and the Business's owner a notice of the signature without the document or the answers.
4. Store the signed document or, if the client signs on paper, the photo or PDF uploaded by the Business, and record who completes an appointment without consent and why, if the Business does so.
5. Suggest to a client who books again at the same Business with their account the name and answers from their last consent there, so they only need to review them. Never the document number.

What the Business decides. As controller, the Business decides which services require it, writes the text and the questions and determines the legal basis: the client's explicit consent collected by the form (article 9.2.a GDPR) and, to keep the document if the client withdraws their consent, the defence of possible claims (article 9.2.f). It must ask only what is necessary to serve the client safely and adapt the text to the rules that apply to its activity. Bellioo's sample templates are for guidance only: Bellioo does not provide legal or health advice and does not review the content of the forms.

Specific measures, in addition to those in section 4:

• The answers, the document numbers and the date of birth are stored encrypted in the database, and the signatures and documents in separate private storage.
• At the Business, only the owner, the administrators and the professional assigned to the appointment can open the document. The rest of the team only sees whether it is pending or signed. The answers and the document numbers appear only in the PDF, not on the Service's screens or lists.
• They do not appear in technical or error logs, internal alerts, client exports or analytics, and BellIA has no access to them.
• Bellioo's staff only access them when needed to support the Business or when a law requires it.
• Bellioo does not use them for any purpose of its own, not even in aggregate or anonymised form, and does not disclose them to anyone other than the sub-processors in section 5 that host or send them.

Retention. Bellioo keeps each signed consent, including those signed on paper and the record of appointments completed without consent, for five years from signature or from when it is recorded, the limitation period for personal actions, and then deletes it together with its signatures and documents. Pending consents that are voided, for example because the appointment is cancelled, are deleted after ninety days. If the client deletes their Bellioo account, the document is kept for the Business for the same period, without a link to that account. If the rules that apply to its activity require it to be kept longer, the Business must download it before the period ends.

4. Bellioo's obligations as processor

In accordance with article 28.3 of the GDPR, Bellioo:

1. Processes the data only on the Business's documented instructions, including as regards international transfers. These terms and the normal use of the Service are the initial instructions. If a Union or Member State law requires Bellioo to do otherwise, it will inform the Business beforehand, unless that law prohibits it. Bellioo will inform the Business if it considers an instruction infringes the regulations.
2. Does not use the data for its own purposes, except what is necessary to operate, secure and improve the Service in aggregate or anonymised form, and what the law requires. It never uses it to sell to the Business's clients or to steer them to another business.
3. Confidentiality: ensures that persons authorised to process the data have committed themselves to confidentiality.
4. Security (article 32): encryption in transit and at rest, role-based access control, isolation between businesses, audit logging of relevant actions, encrypted backups, separation of environments, incident logging and vulnerability management. For informed consent, also the measures in section 3.
5. Notifies the Business without undue delay, and in any event within 48 hours of becoming aware, of any security breach affecting the Business's data, with the information available so the Business can comply with article 33.
6. Assists the Business in responding to data subjects' rights (access, rectification, erasure, portability, objection, restriction) with the Service's features and, where they are not enough, with its reasonable help. If a data subject contacts Bellioo, Bellioo will inform the Business.
7. Assists the Business with security, breach notification, impact assessments and prior consultations (articles 32 to 36), taking into account the nature of the processing and the information available to it.
8. Returns or deletes the data at the end of the contract, at the Business's choice, under section 9.
9. Makes available to the Business the information necessary to demonstrate compliance with these obligations and allows audits under section 7.
10. Keeps a record of the categories of processing activities carried out on the Business's behalf.

5. Authorised sub-processors

The Business gives Bellioo general authorisation to engage the sub-processors in this table. Bellioo will inform the Business of any addition or replacement by email at least 30 days in advance; the Business may object on justified grounds and, if there is no alternative, terminate the contract without penalty. Bellioo imposes on each sub-processor obligations equivalent to those in this contract and is responsible for their compliance.

6. International transfers

Data is hosted in the European Union. Bellioo is established in the United States, so processing on the Business's behalf is in itself an international transfer, in addition to those of the sub-processors in the table above. All of them are covered by an adequacy decision, including the EU-US Data Privacy Framework for certified entities, or by the standard contractual clauses approved by the European Commission (Decision 2021/914) with appropriate supplementary measures, which Bellioo will provide to the Business on request. As controller, the Business must reflect this transfer in its own record of processing activities.

7. Audit

Bellioo will provide the Business with the security documentation it holds. The Business may request an audit once a year, or after a security breach affecting it, with 30 days' notice, during working hours, without interrupting the Service and without access to other businesses' data, bearing its cost unless it reveals a material breach by Bellioo.

8. The Business's obligations

The Business provides its clients with the information the GDPR requires, has a legal basis for each processing activity and for each marketing communication, handles data subjects' rights, ensures the accuracy of the data, does not enter data it is not entitled to process, and uses the Service in accordance with the regulations.

9. End of processing

On termination of the contract, the Business may obtain a copy of its data in a commonly used electronic format for 30 days. Afterwards, Bellioo will delete or anonymise the data, except what it must keep by legal obligation, which will remain blocked until the relevant liabilities expire.

Signed informed consents follow their own period: Bellioo keeps them blocked on the Business's behalf until the five years in section 3 have passed and then deletes them. In the meantime, the Business may ask at privacy@bellioo.com for a copy of the documents or for them to be erased earlier.

10. Liability

Each party is liable for its own infringements under article 82 of the GDPR. Bellioo's liability to the Business is limited as provided in the Business terms.