Data Processing Agreement

1Who is who

The barbershop, represented by the owner who registered it, is the controller of its customers' and staff's data: it decides why and how that data is used. PROH MEDIA AGENCIA DE MARKETING LTDA - ME, CNPJ 65.789.160/0001-07, which runs Barba & Cabelo, is the processor: it handles that data on the barbershop's behalf, only to provide the service.

Each person's own account data in the app (sign-in, password and preferences) is covered by the Privacy Policy, under which the operator is the controller.

The owner accepts this agreement when registering the barbershop. It applies while the barbershop uses the app and, after that, until the data is returned or deleted (section 9).

2Subject and purpose

On the barbershop's behalf, the processor handles the data needed for bookings, the loyalty club and running the shop:

• Customers: name, email, WhatsApp number, appointments, visit history, club points and any other information the barbershop enters in the app;
• Staff: name, contact details, role, permissions and schedule of the people who work at the barbershop;
• Notifications: confirmations, reminders and other appointment notices sent to customers via WhatsApp on the barbershop's behalf.

The processor does not use this data for its own purposes, does not sell it and does not use it for advertising.

3The barbershop's instructions

The processor handles the data only according to the barbershop's instructions. Those instructions are this agreement and the choices the owner and permitted staff make in the app itself, such as services, opening hours, permissions, notifications and connected integrations.

If an instruction appears to be unlawful, the processor will tell the barbershop and may decline to follow it.

4Confidentiality

People who work for the processor or provide services to it access the data only when needed for the task (for example, support requested by the barbershop, the security of the service or compliance with the law), under a duty of confidentiality.

5Security

The processor applies to the barbershop's data the same measures described in section 5 of the Privacy Policy, such as encryption in transit, access control by barbershop and by permission, and passwords stored only as a hash. No system is completely immune to failure, so these measures are reviewed continuously.

6Sub-processors

To run the service, the processor uses the same providers listed in section 6 of the Privacy Policy:

• the virtual private server (VPS) contracted by the operator, which runs the database, authentication and server functions;
• Hostinger, which hosts the website and domain and provides the email service for account messages;
• WhatsApp (Meta), which delivers the messages sent by our own Evolution API installation, on our own server;
• Google, only if the barbershop switches on the Google Calendar/Contacts connection.

These providers receive only what they need for their part of the service. If the list changes, the Privacy Policy and this agreement will be updated.

7Security incidents

If a security incident affects the barbershop's data, the processor will notify the barbershop without undue delay, with the information available: what happened, the data involved, the risks and the measures taken. The processor will also help the barbershop notify the authority and the affected customers, where required (art. 48 of the LGPD). To report a suspected incident, write to contato@contheiner.digital.

8Rights of customers and staff

The barbershop is responsible for answering data subject requests (access, correction, deletion and others) about the barbershop's data. The processor helps where it can and, if it receives such a request, forwards it to the barbershop.

In the app itself, each person can already correct their profile, change their preferences and delete their own account, without contacting support.

9End of use and return of data

When the barbershop stops using the app, the owner can ask by email at contato@contheiner.digital for a copy of the shop's customer and staff data and, afterwards, for that data to be deleted. As the app does not yet offer an automatic export, the copy is prepared by the processor and sent to the owner.

Only data the law requires us to keep (such as access logs for 6 months, required by Brazil's Marco Civil da Internet) and anonymous records, with no link to individuals, may be kept.

10The barbershop's duties

As controller, the barbershop agrees to:

• have a legal basis to process the data and to contact customers — for example, to send confirmations and reminders via WhatsApp to people who booked;
• inform customers clearly about how their data is used and respect anyone who asks not to receive notifications;
• not enter sensitive data (such as health, religion or racial origin) or any other information that is not needed for the service;
• give each staff member only the permissions they need and remove access for anyone who leaves;
• keep the data accurate and respond to data subject requests.

11Governing law and jurisdiction

This agreement follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018). For barbershops in Portugal or another European Union country, the General Data Protection Regulation (GDPR) also applies, in particular Article 28, which governs the relationship between the controller and the processor. The courts of the operator's place of business have jurisdiction, unless a mandatory legal rule provides otherwise.

12Contact and changes

Questions about this agreement: contato@contheiner.digital.

The date at the top shows the current version. For significant changes, we will notify the owner through the app's usual channels and may ask for a new acceptance.