Personal data processing agreement

This document is a translation provided for information purposes only. The Romanian version is the sole legally binding version and prevails in the event of any discrepancy.

Article 1. Definitions and interpretation

(1) In this Agreement, the terms "personal data", "processing", "controller", "processor", "data subject", "third party", "consent", "personal data breach" and "data concerning health" have the meaning given to them in Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR").

(2) For the purposes of this Agreement, the following terms have the following meanings:

• a) "Agreement": this personal data processing agreement;
• b) "KYRO": to complete: company name, the operator of the Platform, identified in Article 2(1);
• c) "Salon": the professional who registers its establishment in Kyro Studio and provides beauty, personal care or barbering services, acting as controller of the data described in Article 5;
• d) "Terms and Conditions for Salons": the terms published at /en/legal/salon-terms, which, together with this Agreement, form the contract concluded between KYRO and the Salon, as defined in the Terms and Conditions for Salons;
• e) "Platform": the Kyro App, Kyro Studio and the KYRO web app, together with the associated services;
• f) "Kyro App": the mobile application intended for Clients;
• g) "Kyro Studio": the application intended for Salons and Team Members;
• h) "Account": the user account created in the Kyro App or in Kyro Studio;
• i) "Client": any natural person whose data are recorded in Kyro Studio as a client of the Salon, whether or not that person holds an Account in the Kyro App;
• j) "Team Member": a natural person added by the Salon in Kyro Studio with one of the roles Owner, Manager, Specialist, Booth Renter (Chiriaș) or Reception;
• k) "Owner": the Team Member who registered the Salon or to whom that capacity was subsequently transferred, and who represents the Salon towards KYRO;
• l) "Client Record": all the data concerning a Client recorded by the Salon in Kyro Studio;
• m) "Allergy Note": the information recorded in the field dedicated to allergies and intolerances in the Client Record;
• n) "Client Rating": the score from 1 to 5 and the comment that the Salon may give a Client after the date of an appointment, including one marked as a no-show;
• o) "Sub-processor": another processor engaged by KYRO under the conditions of Article 28(2) and (4) GDPR;
• p) "EEA": the European Economic Area;
• q) "ANSPDCP": the Romanian National Supervisory Authority for Personal Data Processing.

(3) Time limits expressed in days are calculated in calendar days.

(4) This Agreement is to be interpreted in accordance with the GDPR. The article headings are for guidance only.

Article 2. Parties and contractual framework

(1) This Agreement is concluded between the Salon, as controller, and to complete: company name, with its registered office at to complete: registered office, tax ID (CUI) to complete: tax ID (CUI), as processor.

(2) This Agreement forms, together with the Terms and Conditions for Salons, the Contract concluded between KYRO and the Salon and is accepted together with them when the Salon registers in Kyro Studio. KYRO keeps a record of the accepted version and of the date and time of acceptance.

(3) This Agreement constitutes the contract referred to in Article 28(3) GDPR.

(4) In the event of any discrepancy between this Agreement and the Terms and Conditions for Salons, this Agreement prevails as regards the processing of personal data.

Article 3. Subject matter, duration, nature and purpose of the processing

(1) The subject matter of the processing is the hosting and processing of the personal data that the Salon and the Team Members enter or receive in Kyro Studio.

(2) The processing takes place for the term of the Terms and Conditions for Salons, plus the period needed to delete or return the data in accordance with Article 11.

(3) The nature of the processing comprises the following operations:

• a) collection of the data through the Platform's applications;
• b) storage, organisation and consultation of the data;
• c) display of the data to authorised Team Members;
• d) calculation of reports;
• e) sending service messages to Clients;
• f) making backup copies;
• g) erasure of the data.

(4) The purpose of the processing is to enable the Salon to manage its appointments, Clients, team, takings, loyalty programmes and subscription plans, and to communicate with Clients about appointments and about the days on which the Salon is closed.

Article 4. Categories of data subjects

The processing concerns the following categories of data subjects:

• a) Clients, including Clients who do not hold an Account in the Kyro App and whose data are entered by the Salon;
• b) Team Members, namely the Owner, Managers, persons with the Reception role, Specialists and Booth Renters.

Article 5. Categories of personal data

(1) The processing concerns the following categories of data:

(2) The Salon is not permitted to enter in Kyro Studio any other special categories of personal data within the meaning of Article 9 GDPR (including, without limitation, other medical information, religious beliefs or sexual orientation), data relating to criminal convictions and offences, or personal numeric codes (CNP).

(3) Internal notes, Client Ratings and the other free-text fields must not contain data concerning health. Allergies are recorded only in the field dedicated to them, subject to the conditions laid down in Article 6.

(4) Team Members' access to Client Records is determined as follows:

• a) the Owner, Managers and persons with the Reception role have access to the Client Records of all of the Salon's Clients;
• b) Team Members with the Specialist or Booth Renter role have access only to the Client Records of the Clients with whom they have at least one appointment, past or future.

Article 6. Allergy Notes

(1) As controller, the Salon is required to have a legal basis for processing Allergy Notes. The legal basis is the Client's explicit consent within the meaning of Article 9(2)(a) GDPR, obtained before the Allergy Note is recorded.

(2) Before an Allergy Note is saved, the Team Member is required to tick in Kyro Studio the confirmation, in pre-set wording, by which they attest that they requested and obtained the Client's explicit consent. KYRO records the identity of the Team Member who ticked the confirmation and the date and time of the ticking, as evidence available to the Salon.

(3) The Salon records only the information necessary for the Client's safety in the course of the services (for example, "latex allergy").

(4) The Allergy Note is accessible only to the Team Members who have access to the Client Record under Article 5(4).

(5) If the Client withdraws consent, the Salon is required to delete the Allergy Note. A request by the Client to delete the Allergy Note has the effect of a withdrawal of consent.

(6) If a Client deletes their Account in the Kyro App, KYRO automatically deletes the Allergy Notes from all Client Records linked to that Account, at all Salons. By accepting this Agreement, the Salon gives KYRO the documented instruction to carry out that deletion.

(7) KYRO does not use Allergy Notes for ranking Salons, for marketing purposes, for statistical purposes or for any purpose other than hosting them for the Salon, in compliance with Article 3 of Romanian Law No. 190/2018 on measures implementing the GDPR.

Article 7. Processing outside the scope of this Agreement

(1) For the following processing, KYRO acts as an independent controller, and the processing is described in the Privacy policy:

• a) Clients' Accounts in the Kyro App and Team Members' Accounts in Kyro Studio;
• b) public Reviews;
• c) displaying to the Client the Client Ratings given to them by the Salon, and handling reports concerning those Ratings;
• d) the security of the Platform, abuse prevention, the automatic language filter and content moderation;
• e) the log of actions performed by KYRO administrators;
• f) the record of appointments, loyalty points and subscription plans, as kept in the Client's Account.

(2) Client Ratings form part of the Client Records kept by the Salon. A Client Rating is accessible only to the Salon that gave it and to the Client concerned, and is not accessible to any other Salon.

(3) The data that a Client transmits to the Salon by means of a booking made in the Kyro App are received by the Salon as controller, for its own business.

Article 8. Obligations of KYRO

(1) As processor, KYRO has the following obligations:

• a) to process personal data only on documented instructions from the Salon, unless required to do so by Union or Member State law to which KYRO is subject; in such a case, KYRO informs the Salon of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Article 28(3)(a) GDPR). The Salon's documented instructions are contained in the Terms and Conditions for Salons, in this Agreement and in the settings configured and actions performed by the Salon in Kyro Studio;
• b) not to transfer personal data to a country outside the EEA except in compliance with the safeguards laid down in Chapter V GDPR, in accordance with Article 9 (Article 28(3)(a) GDPR);
• c) to ensure that the persons authorised to process the personal data have committed themselves to confidentiality (Article 28(3)(b) GDPR);
• d) to implement the appropriate technical and organisational measures required by Article 32 GDPR (Article 28(3)(c) GDPR), in accordance with paragraph (2);
• e) to respect the conditions for engaging Sub-processors laid down in Article 9 (Article 28(3)(d) GDPR);
• f) to assist the Salon, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests from data subjects exercising their rights of access, rectification, erasure, restriction of processing, portability and objection (Article 28(3)(e) GDPR), in accordance with paragraph (3);
• g) to assist the Salon in ensuring compliance with the obligations under Articles 32 to 36 GDPR concerning security of processing, notification of personal data breaches, data protection impact assessment and prior consultation of the supervisory authority, taking into account the nature of the processing and the information available to KYRO (Article 28(3)(f) GDPR);
• h) to delete or return the personal data at the end of the provision of services, in accordance with Article 11 (Article 28(3)(g) GDPR);
• i) to make available to the Salon all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, and to allow for and contribute to audits conducted in accordance with Article 12 (Article 28(3)(h) GDPR).

(2) The technical and organisational measures referred to in paragraph (1)(d) include, without limitation:

• a) encryption of connections;
• b) role-based access control enforced at database level, so that one Salon has no access to another Salon's data;
• c) storage of passwords and codes exclusively as cryptographic hashes;
• d) limiting the number of sign-in attempts;
• e) access to profile photos exclusively through temporary links;
• f) restricting administrative access to a small number of persons;
• g) logging every consultation of personal data by KYRO administrators;
• h) making backup copies.

(3) If KYRO receives directly a request from a data subject concerning the data processed under this Agreement, KYRO forwards the request to the Salon without delay and does not respond to it on the Salon's behalf, unless the Salon asks it to do so.

(4) If, in KYRO's opinion, an instruction from the Salon infringes the GDPR or other Union or Member State data protection provisions, KYRO immediately informs the Salon (Article 28(3), second subparagraph, GDPR).

Article 9. Sub-processors

(1) By accepting this Agreement, the Salon gives KYRO a general written authorisation, within the meaning of Article 28(2) GDPR, to engage the following Sub-processors:

(2) KYRO does not process payments made by Clients to the Salon. Clients pay for the services directly at the Salon.

(3) KYRO has concluded with each Sub-processor a contract (that provider's data processing agreement) imposing data protection obligations at least as strict as those laid down in this Agreement, including, where applicable, standard contractual clauses for transfers outside the EEA (Article 28(4) GDPR).

(4) KYRO informs the Salon by email and in Kyro Studio, at least 15 days in advance, of any intended addition or replacement of a Sub-processor. Within that period, the Salon has the right to object on grounds relating to data protection. If the parties do not reach a solution, the Salon has the right to terminate the Terms and Conditions for Salons, at no cost, before the date on which the change takes effect.

(5) KYRO remains fully liable to the Salon for the performance of its Sub-processors' obligations (Article 28(4), second sentence, GDPR).

Article 10. Personal data breach

(1) KYRO notifies the Salon, by email and in Kyro Studio, without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting the Salon's data.

(2) The notification contains, to the extent known to KYRO at the date of notification:

• a) the nature of the breach;
• b) the categories and approximate number of data subjects concerned;
• c) the categories and approximate number of records concerned;
• d) the likely consequences of the breach;
• e) the measures taken or proposed by KYRO;
• f) the contact details of a person from whom further information can be obtained.

(3) Information not available at the date of notification is communicated to the Salon subsequently, as it becomes available.

(4) KYRO assists the Salon in notifying ANSPDCP within the 72-hour period laid down in Article 33(1) GDPR and, where applicable, in communicating the breach to the data subjects under Article 34 GDPR.

(5) KYRO keeps an internal register of personal data breaches.

Article 11. Deletion and return of the data

(1) The Owner has the right to close the Salon permanently from Kyro Studio. Before closure, the Owner may export the Salon's Clients, appointments and services from Kyro Studio. Upon closure, future appointments are cancelled and Clients are notified.

(2) Upon termination of the Terms and Conditions for Salons or closure of the Salon, the Salon has the right to request the return of the data within no more than 30 days from the date of termination or closure (Article 28(3)(g) GDPR). KYRO sends the Salon, by email, an export in CSV format containing the appointments, Clients and services.

(3) When the Terms and Conditions for Salons end, for whatever reason, the Salon is permanently closed no later than on the date on which they end. When 30 days have elapsed since the Terms and Conditions for Salons end, for whatever reason, KYRO deletes from its active systems all of the Salon's data, including the photos and other files uploaded by the Salon, namely the data processed under this Agreement and the record referred to in Article 7(1)(f) concerning that Salon. Only data whose retention is required by law and the proof of acceptance of the Terms and Conditions for Salons and of this Agreement are kept, for the period laid down in the Privacy policy. Automatic database backups are overwritten within no more than 30 days.

(4) KYRO retains data only where the law requires it to do so (for example, accounting documents concerning the relationship between KYRO and the Salon) and only for the period required by law.

(5) If a Client deletes their Account in the Kyro App, the Client Record remains in Kyro Studio as a record of the Salon, without being linked any longer to the Client's Account. The Allergy Notes are deleted in accordance with Article 6(6), and the Client's subscription plans, including the record of payments noted by the Salon, are deleted on the date the Account is deleted. By accepting this Agreement, the Salon gives KYRO the documented instruction to carry out these deletions.

(6) During the term of the Terms and Conditions for Salons, data are deleted automatically at the end of the retention periods laid down in the Privacy policy.

(7) The retention periods referred to in paragraph (6) are the following:

• a) appointments: 3 years from the date of the visit; an appointment on which a published review is based is kept for as long as the review remains published;
• b) cancelled appointments: 1 year from the date of cancellation;
• c) Client Ratings: 2 years from the date on which they were given;
• d) subscription plans: 3 years from the last month of the subscription plan;
• e) the record of confirmations of consent for Allergy Notes: for as long as the Client Record exists, but for no less than 3 years from the date of each entry.

Article 12. Information and audit

(1) At the Salon's request, KYRO makes available to it the information necessary to demonstrate compliance with this Agreement, namely the description of the security measures, the list of Sub-processors and the data processing agreements concluded with them.

(2) If the information referred to in paragraph (1) is not sufficient, the Salon, directly or through an independent auditor bound by a confidentiality obligation, has the right to carry out an audit under the following conditions:

• a) the Salon gives notice of the audit at least 30 days in advance;
• b) the audit takes place no more than once a year, unless it is requested by a supervisory authority or a personal data breach has occurred;
• c) the audit takes place on a date and within a time slot agreed in advance by the parties, without affecting the data of other Salons;
• d) each party bears its own costs of the audit.

Article 13. Obligations of the Salon

As controller, the Salon has the following obligations:

• a) to have a legal basis for each category of data it enters in Kyro Studio, and to inform Clients and Team Members about the processing;
• b) to obtain the Client's explicit consent for Allergy Notes and to be able to demonstrate it;
• c) not to enter excessive data or the categories of data excluded under Article 5(2) and (3);
• d) to determine, within the limits of the periods laid down in Article 11(7), the retention period of its own Clients' data and to delete them from Kyro Studio once they are no longer necessary;
• e) to grant access only to persons who need it and to withdraw the access of Team Members who leave the team.

Article 14. Liability and final provisions

(1) The liability of each party is that laid down in Article 82 GDPR and in the Terms and Conditions for Salons.

(2) This Agreement is governed by Romanian law.

(3) This Agreement is amended in accordance with the procedure laid down in Article 13 of the Terms and Conditions for Salons.

(4) Communications concerning personal data protection are to be sent to [email protected].

Back to top