PMUezy Data Processing Agreement

External policy or terms | Version 1.0 | 2 October 2026

This Data Processing Agreement forms part of the Professional Terms between the Salon identified in the accepted order, as Controller, and Managezy Ltd trading as PMUezy, Irish company 812735, as Processor. It governs personal data processed on the Salon's behalf and takes precedence over conflicting terms for that processing. GDPR terms have the meanings in Regulation EU 2016/679. Each party's details and authorised contacts are those in the accepted order, with Processor privacy contact privacy@pmuezy.com at 46 Enterprise Centre, Lavery Avenue, Park West Business Park, Dublin 12, Ireland, D12 PP48.

1 Scope and instructions

The subject matter is provision of Salon booking, client communication, form, signature, media and record management software. Processing lasts for the subscription and the return and deletion period below. It comprises collection through Salon configured forms, recording, organisation, storage, retrieval, display, authorised transmission and export, restriction and deletion. It is performed for the Controller's administration and provision of its services, not for PMUezy's independent advertising or AI purposes.

Data subjects are the Salon's clients, invited personnel and people whose information the Controller lawfully includes. Data includes identity and contact details, date of birth where relevant, booking records, messages and images, treatment documentation, health declarations, signatures, timestamps, consent histories and associated access records. Health information is special category data. Photographs are not automatically biometric data used for unique identification; no facial recognition is instructed. The service is for adults and does not permit deliberate child account creation.

Documented instructions consist of this DPA, the order, lawful configuration and authenticated directions from the Controller's authorised representative. Processor processes only on those instructions, including for transfers, unless EU or Member State law requires otherwise. In that case it informs Controller before processing unless prohibited on important public interest grounds. Processor immediately informs Controller if it considers an instruction infringes applicable data protection law and may pause the affected activity while clarification is sought, protecting existing data.

2 Controller obligations

Controller determines purposes, necessity, lawful bases, Article 9 conditions, transparency and retention. It ensures instructions and data collection are lawful, secures necessary permissions, limits form fields and manages user access. It supplies privacy information to clients and handles their rights and complaints. Controller is entitled to supervise compliance and receive assistance; its responsibilities do not reduce Processor's independent duties under GDPR.

3 Confidentiality and security

Processor ensures persons authorised to process data are committed to confidentiality or under an appropriate statutory obligation, trained and limited to authorised duties. Support personnel do not have routine access to treatment content. Developer production access is permitted only where necessary, authorised, role based, time limited and logged.

Processor implements Article 32 measures appropriate to risk, including HTTPS/TLS in transit; encryption of database, storage and backups; bcrypt password hashing; Professional two factor authentication; role based Salon separation; controlled privileged access; and logs of record viewing, changes, export, deletion, consent access, administration and role changes. Daily encrypted backups run on a 30 day rolling cycle. Access revocation, patching, incident handling and recovery are maintained and effectiveness is regularly evaluated. Encryption key and credential access must be separated and controlled. Processor may improve measures but must not materially reduce protection without agreement and lawful justification.

4 Subprocessors

Controller gives general written authorisation for the specifically identified processing providers and activities in the accompanying Subprocessors and Service Providers schedule as completed and supplied at acceptance. Independent controllers and Controller selected vendors are not authorised merely by being named as service providers. Processor must contractually impose substantially the same data protection obligations on each subprocessor, including sufficient security guarantees. Processor remains fully liable to Controller for the subprocessor's performance of its data protection obligations.

Processor gives at least 30 days' prior written notice of intended addition or replacement, including the identity, activity, location and safeguards, allowing Controller to object on reasonable data protection grounds. The parties work to resolve an objection by safeguards or a suitable alternative. If unresolved before the proposed processing, Processor will not send the affected data to that provider; Controller may terminate the affected service without penalty and receive prepaid unused fees. A necessary urgent change must still preserve a meaningful opportunity to object and comply with Article 28; operational urgency is not a general waiver.

5 International transfers

Core hosting is in Nuremberg, Germany. No restricted transfer, including remote access from a third country, may occur without documented authorisation and a valid GDPR Chapter V mechanism. Processor records the recipient, destination, role, onward transfers and safeguard. If relying on standard contractual clauses, the appropriate modules and annexes must actually be executed and any required transfer assessment and supplementary measures completed. This DPA does not itself constitute the European Commission's transfer clauses. Processor assists Controller with transfer information and suspends transfers where effective protection cannot be ensured.

6 Rights and regulatory assistance

Taking into account the nature of processing, Processor assists by appropriate technical and organisational measures with Controller's obligations to respond to data subject rights. It forwards a request concerning Controller data without undue delay, ordinarily within two working days, and does not refuse it or answer on Controller's behalf unless instructed or legally required. Assistance includes search, copies, correction, restriction, erasure and applicable portability, while protecting other people's information.

Taking account of the nature of processing and information available, Processor assists Controller with security, breach assessment and notifications, DPIAs and prior consultation under Articles 32 to 36. It provides available information promptly enough for legal deadlines. Routine rights assistance is part of service; any exceptional separately priced work must be agreed in advance and must not obstruct statutory obligations.

7 Personal data breaches

Processor notifies Controller without undue delay after becoming aware of a personal data breach affecting Controller data. Its internal target is within 24 hours of awareness, without waiting for a full investigation. The initial and subsequent notices describe the nature, categories and approximate numbers of subjects and records where known, contact point, likely consequences and containment and mitigation measures. Incomplete information is supplied in phases without undue further delay.

Processor preserves evidence, cooperates with Controller and records the incident. Controller decides its supervisory authority and individual notification obligations, without limiting Processor's independent legal duties. Processor does not notify Controller's clients in Controller's name without authorisation unless law requires. A 72 hour controller notification period is not permission for Processor to delay its own notice.

8 Return and deletion

During service, retention follows the Controller's documented lawful schedule. On termination, Controller may choose return or deletion. The standard arrangement supplies 60 days of read only access and authorised export, then deletes existing active copies. Controller may request earlier deletion. Export must include intelligible records, signed PDFs and associated versions and media, subject to necessary security measures; rights are not confined to an individual artist's permissions.

Backups expire within 30 days after active deletion and remain isolated from ordinary use until expiry. If restored for disaster recovery, deletion and restriction instructions must be reapplied before returning to ordinary processing. On request Processor confirms deletion. Where EU or Member State law requires further storage, Processor identifies the ground where permitted, isolates the necessary data, limits processing to that ground and deletes when it ends. Processor's separate lawful retention of its own billing information does not justify retaining all Salon treatment data.

9 Evidence and audits

Processor makes available all information necessary to demonstrate Article 28 compliance and allows and contributes to audits, including inspections by Controller or its mandated auditor. The parties arrange reasonable scope, confidentiality, notice and security safeguards that protect other customers. Reports or certifications may be used first where sufficient, but are not the exclusive audit route. Urgent incident, regulator and substantiated compliance audits are not prevented by ordinary notice or frequency preferences. Any reasonable cost allocation must not make the audit right ineffective.

Processor keeps the records required of it by Article 30(2) and cooperates with competent supervisory authorities. The parties identify and remedy material deficiencies promptly.

10 Roles and legal effect

This DPA does not cover processing for which PMUezy genuinely determines its own purposes, described in the Privacy Notice. Role labels do not override the factual allocation under GDPR. Processor may not convert Salon records into its own marketing dataset. No term reduces rights of data subjects, supervisory powers or liability imposed by GDPR, including Article 82. Commercial liability provisions apply only to the extent lawful and compatible with those rights and obligations.

Irish law and the dispute provisions of the Professional Terms apply, subject to mandatory data protection law. The DPA is accepted electronically with the Professional Terms; the acceptance record must identify the Controller, authority of the accepting person, version and time.