Data Processing Agreement

1. Parties and Subject Matter

2. Personal Data Processed

2.1 Types of Personal Data

• Caller telephone numbers (CLI for voice, WhatsApp number for messages)
• Names, where provided by callers during the conversation
• Booking preferences: preferred stylist, services, dates and times
• Voice call transcripts and WhatsApp message transcripts
• Messages and notes left by callers

2.2 Categories of Data Subjects

• Salon clients (inbound callers and WhatsApp users)
• Prospective clients making enquiries

3. Controller Obligations

As the data controller, the salon (Controller) is responsible for:

• Establishing and documenting a lawful basis for processing caller data under UK GDPR Article 6
• Informing callers at the start of each call that calls are AI-handled and may be recorded
• Ensuring their ICO registration covers the use of AI telephone reception
• Responding to data subject rights requests from callers (we will assist within 72 hours)
• Notifying biflo.ai promptly of any data subject rights requests received directly

4. Processor Obligations (biflo.ai)

KRM Consultants Limited (trading as biflo.ai), as data processor, shall:

• Process personal data only on documented instructions from the Controller (i.e., the configuration of the service)
• Ensure all staff with access to personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (see section 6)
• Not engage any new sub-processors without giving the Controller prior written notice and opportunity to object
• Assist the Controller in fulfilling data subject rights requests within 72 hours of receiving a forwarded request
• Assist the Controller with security obligations, breach notifications, DPIAs, and prior consultations
• At the choice of the Controller, delete or return all personal data upon termination of the agreement
• Make available all information necessary to demonstrate compliance with Article 28 obligations

5. Sub-Processors

biflo.ai uses the following sub-processors. By entering into this DPA, the Controller provides general authorisation for their use. We will provide at least 14 days notice before adding new sub-processors.

6. Security Measures

biflo.ai implements the following technical and organisational security measures:

• AES-256 encryption at rest for all personal data stored in Supabase
• TLS 1.3 encryption in transit for all data transmissions
• Row-Level Security (RLS) in the database - each salon can only access its own data
• Role-based access controls (RBAC) with least-privilege principles
• Multi-factor authentication for admin access to production systems
• Regular security code reviews and dependency audits
• Supabase hosted in EU (Frankfurt) - EU/UK data residency for stored data
• Data minimisation - only data necessary for the service is collected and retained

7. Data Retention and Deletion

8. Data Breach Notification

In the event of a personal data breach, biflo.ai will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.

The Controller is responsible for notifying the ICO and affected data subjects where required under UK GDPR Articles 33 and 34.

9. Data Subject Rights Assistance

biflo.ai will assist the Controller in responding to data subject rights requests, including: access, rectification, erasure, restriction, portability, and objection. When we receive a direct request from a data subject relating to a specific salon, we will forward it to that salon within 72 hours. We will provide technical assistance to fulfil the request within 28 days.

10. Audit Rights

biflo.ai will make available all information necessary to demonstrate compliance with this DPA upon written request. Where the Controller requires an audit of processing activities, we will facilitate reasonable inspection, subject to reasonable advance notice (minimum 14 days) and at the Controller's cost.

11. Contact and Queries

For data processing queries, to exercise rights, or to report a breach: