Data Processing Agreement

The Operator processes personal data on the Studio's behalf solely to provide the STUDIO CORE service described in the Terms. This DPA applies for as long as the Operator processes personal data on the Studio's behalf: from the start of the free trial or subscription until the data has been returned or deleted under section 11.

Processing consists of storing, organising, retrieving, transmitting and deleting data as needed to: manage bookings, workstations and artists' calendars; collect and archive clients' informed consent forms and guest artists' contracts with electronic signatures; send transactional emails to clients (confirmations, reminders, aftercare) and recaps to the Studio; synchronise the Google Calendar of users who choose to; produce analytics for the Studio; and provide support. The Operator does not use the Studio's data for its own purposes, for marketing or to train AI models.

• The Studio's clients, including people who book an appointment. • Resident artists and guest artists working at the Studio. • The Studio's owners, managers and staff who use the Service.

• Identification and contact data: full name, email, phone, city, country, date or year of birth, tax code, home address. • Identity document data: document type and number and, when the Studio uses the optional scan, the image of the document, processed only to fill in the form and not stored. • Health data (special category, Art. 9 GDPR): answers to the health questionnaire in informed consent forms (for example allergies, medical conditions, infectious diseases, medication). • Signatures and consent records: electronic signatures, signed text, date and time. • Booking and financial data: appointments, workstation, notes, reference images, prices, deposits, artist fees. • Users' account and usage data: login email, role, Google Calendar tokens (encrypted), push notification tokens, technical logs. As controller, the Studio is responsible for obtaining explicit consent, or ensuring another legal basis under Art. 9 GDPR, for health data.

The Operator shall: • process personal data only on the Studio's documented instructions — the Terms, this DPA and the Studio's use of the Service's features — including with regard to transfers to third countries, unless required to do so by EU or Member State law, in which case it informs the Studio before processing unless that law prohibits it; • immediately inform the Studio if, in its opinion, an instruction infringes the GDPR or other data protection rules; • ensure that the people authorised to process the data are bound by confidentiality and access it only as needed to provide the Service or support; • implement the security measures described in section 6; • comply with the conditions for engaging sub-processors in section 7; • make available to the Studio the information needed to demonstrate compliance with Art. 28 GDPR (section 12).

The Operator implements technical and organisational measures appropriate to the risk, including: • encryption of data in transit (HTTPS/TLS with HSTS) and at rest (Google Cloud infrastructure encryption); • authentication of every user through a personal account (Firebase Authentication, sign-in with Google or email and password); • database-level access control through Firestore security rules: each studio is isolated from the others and access depends on the user's role (admin, shop manager, artist, guest); the rules are checked by an automated test suite; • keys and service credentials kept in Google Secret Manager; Google Calendar tokens encrypted (AES-256-GCM) and stored where only the server can read them; • signed consent forms and contracts sealed server-side with a timestamp and a SHA-256 hash of the signed text, and impossible to alter from the application; • logs of deletions and of access to personal data for sensitive operations; • rate limiting on public endpoints and validation of uploaded files; • daily backups and point-in-time recovery of the database; • data minimisation: only aggregated figures are sent to the AI analytics feature, and scanned ID images are not stored. The Studio is responsible for the security of its own devices, for managing its users' access and for keeping credentials confidential.

The Studio gives the Operator general written authorisation to engage sub-processors. The current sub-processors are: • Google LLC (Firebase / Google Cloud) — hosting, authentication, database, file storage, scheduled functions. United States (us-central1); some scheduled functions in the EU (europe-west1). • Google LLC (Gemini API) — optional AI features (analytics insights on aggregated figures, ID document scan). Google infrastructure, including the United States. • Resend (Plus Five Five, Inc.) — transactional email delivery. United States; EU sending region (Ireland). • Sentry (Functional Software, Inc.) — error monitoring. United States or EU. • PayPal (Europe) S.à r.l. et Cie, S.C.A. — subscription billing (the Studio's billing data only). EU (Luxembourg). The Operator imposes on each sub-processor, by contract, data protection obligations equivalent to those in this DPA and remains responsible to the Studio for their performance. The Operator informs the Studio's admins by email at least 30 days before adding or replacing a sub-processor. Within that period the Studio may object on reasonable data protection grounds; if the objection cannot be resolved, the Studio may terminate its subscription before the change takes effect, without penalty.

The database, hosting and part of the sub-processors' services are located in the United States (section 7), so personal data is transferred outside the European Economic Area. Transfers take place only in compliance with Chapter V GDPR: the US sub-processors are certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, where their data processing terms include them (for example the Google Cloud Data Processing Addendum and the Resend DPA), the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 apply. The Studio authorises these transfers.

Taking into account the nature of the processing, the Operator assists the Studio: • in responding to requests from data subjects exercising their rights (Arts. 15-22 GDPR): the Service lets the Studio view, correct and export client data and delete bookings; for anything the Studio cannot do itself, the Operator acts on request. The Operator forwards to the Studio without undue delay any request it receives directly from a data subject; • in meeting its obligations under Arts. 32-36 GDPR (security, breach notification, data protection impact assessments and prior consultation), by providing the information available to it.

The Operator notifies the Studio of any personal data breach affecting the Studio's data without undue delay and in any case within 48 hours of becoming aware of it. The notification is sent by email to the Studio's admins and includes, as far as available at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; further information follows as soon as it becomes available. Notifying the supervisory authority and the data subjects (Arts. 33-34 GDPR) remains the Studio's responsibility as controller, with the Operator's assistance.

When the service ends (cancellation, non-renewal or termination), the Studio may request an export of its data at privacy@studio-core.app, in a commonly used, machine-readable format. The Operator deletes the Studio's personal data within 90 days of the end of the service, unless EU or Member State law requires it to be kept. Copies in backups are erased when the backups expire (currently within 14 days). For a Studio suspended for non-payment, the service ends at the close of the 90-day period set out in the Terms, after the final notice, and deletion follows without delay.

On request at privacy@studio-core.app, the Operator makes available to the Studio the information needed to demonstrate compliance with Art. 28 GDPR, including a description of the security measures and the sub-processors' certifications and reports (for example Google Cloud's ISO 27001 and SOC 2 reports). The Studio, itself or through an independent auditor bound by confidentiality, may carry out audits, including inspections, with at least 30 days' written notice, during normal business hours, no more than once a year unless a breach or a supervisory authority requires otherwise, and in a way that does not disrupt the Service or compromise the confidentiality of other customers' data. Each party bears its own costs.

The parties' liability under this DPA is subject to the limitations in the Terms, without prejudice to Art. 82 GDPR towards data subjects. If this DPA and the Terms conflict on the protection of personal data, this DPA prevails. This DPA is governed by Italian law and the courts of Milan have exclusive jurisdiction. The Operator may update this DPA to reflect legal requirements or changes of sub-processors; material changes are communicated to the Studio's admins by email at least 30 days in advance.