Data Processing Agreement

Between the beauty professional (controller) and Pro Beauty World (processor) - GDPR Article 28

The Dutch-language version (Verwerkersovereenkomst) is the version of record; this English text is a convenience translation.

Version 1.4 - last updated: 2026-10-23

0. Context and roles

When a beauty professional ("the Professional") uses pbw.life to take bookings, the Professional decides why and how their end clients' personal data is processed. The Professional is therefore thecontroller. pbw.life processes that data solely on the Professional's instructions and is therefore theprocessor. This agreement governs only that processor relationship between the Professional and pbw.life.

What falls outside this agreement: for some processing pbw.life is itself the controller, not a processor. That is: the booking statistics pbw.life keeps across all studios (numbers of no-shows and cancellations per client, used to decide whether a deposit is asked), client accounts in the pbw.life apps, events, the AI assistant, and the accounts of the Professional and their team. That processing is described in the Privacy policy.

On Mollie and Stripe: the Professional chooses whether deposits are taken through Mollie, through Stripe or not at all. Mollie and Stripe each act as an independent controller for the payment data they process. pbw.life is not their processor and they are not pbw.life's sub-processors for deposits; no processor agreement with Mollie or Stripe is required and none forms part of this document.

1. Parties

• Controller: the Professional (sole trader/ZZP or company) holding a pbw.life account. Business identity as provided at signup (name, KvK number).
• Processor: Pro Beauty World (pbw.life), sole proprietorship - KvK 42107799, registered address Ronsseweg 115, 2803 ZS Gouda, the Netherlands.

2. Subject matter and duration

pbw.life processes personal data of the Professional's end clients solely to provide the booking, scheduling, deposit, notification and record-keeping functionality of the platform. The agreement applies for as long as the Professional's account is active, plus the statutory retention periods described in section 9 and thePrivacy policy.

3. Nature and purpose of processing

• Taking and managing appointment bookings.
• Sending confirmations, reminders and related notifications.
• Collecting and reconciling deposits (payment status only; card and bank data is processed by Mollie or Stripe, whichever the Professional chose, as an independent controller).
• Maintaining booking history, no-shows and the Professional's notes on their own appointments. The booking statistics across all studios are not part of this (section 0).

4. Categories of data subjects and personal data

• Data subjects: the Professional's end clients.
• Personal data: name, contact details (email, phone), service address (street, house number, postcode, city) for at-client appointments, appointment details, deposit/payment status, no-show history, and notes the Professional records.

The platform is not intended for special categories of personal data (such as health data). The Professional is instructed not to record special-category data in free-text note fields; if the Professional does so anyway, that is done under their own responsibility as controller.

5. Obligations of the processor

1. Process personal data only on the Professional's documented instructions. The agreement, the platform settings the Professional configures, and the functionality described in section 3 together constitute those instructions. The Professional gives additional instructions in writing (email is enough). pbw.life informs the Professional immediately if, in its opinion, an instruction infringes the GDPR or other data protection rules.
2. Ensure that persons with access to the data are bound by confidentiality.
3. Take appropriate technical and organisational security measures (Annex A).
4. Engage sub-processors only in accordance with section 6.
5. Assist the Professional with data-subject requests (access, rectification, erasure, portability) and with breach notification, DPIAs and prior consultation.
6. Inform the Professional without undue delay, and no later than 48 hours after establishing a personal data breach, with the information the Professional needs for their own notification duties (nature of the breach, data and people affected, likely consequences and measures taken). Information not yet available follows as soon as it is known.
7. On termination, delete or return all personal data at the Professional's choice, except where EU or Dutch law requires retention by pbw.life itself (section 9).
8. Make available the information necessary to demonstrate compliance, and enable audits in accordance with section 8.

6. Sub-processors

The Professional grants general authorisation for the sub-processors listed in Annex B. pbw.life imposes obligations on each sub-processor equivalent to those in this agreement. Intended changes (adding or replacing a sub-processor) are announced by email at least 30 days in advance; the Professional may object in writing within that period and may terminate the agreement if the objection cannot reasonably be resolved.

7. International transfers

All data is stored in the European Economic Area: hosting, storage and email in Microsoft Azure (West Europe region), the database in MongoDB Atlas (Azure, West Europe region), authentication on Auth0's EU environment and error monitoring on Sentry's EU environment (Frankfurt). Some sub-processors (Microsoft, Okta, MongoDB) have a parent company in the United States. Access or processing outside the EEA takes place only under the EU Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework, as set out in the processing agreement with that sub-processor. A new transfer is announced in advance per section 6.

8. Audits and accountability

On request, pbw.life makes available the information reasonably needed to demonstrate compliance with this agreement (including available certifications and sub-processor reports). The Professional may conduct or commission an audit at most once per twelve months - or additionally after an established breach - with at least 30 days' written notice, during business hours, without disproportionate disruption to the service. Each party bears its own costs.

9. Liability, term and termination

• This agreement follows the term of the Terms of service and ends automatically when they end.
• Liability is governed by the liability provisions of the Terms of service; this agreement neither extends nor limits them.
• After termination, the personal data of the Professional's end clients is deleted or returned within 30 days per section 5.7. On request, pbw.life first provides an export of the client and appointment data. pbw.life does not keep personal data on the basis of the Professional's fiscal retention duty; the Professional keeps those records themselves. Anonymised booking rows (date, service, amount, without personal data) may remain.
• During the term, personal data in bookings is anonymised after 3 years and anonymised booking rows are deleted after 7 years. See the Privacy policy for the full retention schedule.

10. Governing law

This agreement is governed by Dutch law. This Data Processing Agreement forms part of the Terms of service and is expressly accepted by the Professional during onboarding.

Annex A - Technical and organisational measures

• Data storage and processing within the EU (Microsoft Azure, West Europe).
• Encryption in transit (TLS for all traffic between users and the platform) and at rest.
• Network segmentation: internal service-to-service traffic stays within a private cluster network, is restricted by network policies, and internal endpoints are blocked from the internet.
• Authentication and access control via Auth0; least-privilege access.
• Per-tenant isolation: a Professional can only access their own client data.
• Error monitoring (Sentry, EU) under a documented legitimate-interest assessment; browser-side monitoring only with consent.
• Documented data-breach procedure and operational GDPR checklist.

Annex B - Sub-processors

Mollie B.V. (Amsterdam) and Stripe Payments Europe, Ltd. (Dublin) process payment data as independent controllers and are not sub-processors (see section 0).