Data Processing Agreement

1. Parties and definitions

• Controller ("the salon"; in Israeli terms the "controller of the database"): the business that opened the account, as identified in its account and billing details.
• Processor (in Israeli terms the "holder"): Nerya Cohen, trading as Nerya ERP, support@sewingerp.com.
• Personal data: any information about an identified or identifiable person that the salon enters into or collects through the service (section 3).
• Sub-processor: a provider the processor uses to store or transmit personal data (section 6).
• Data protection law: the UK GDPR and the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), and Israeli privacy law, as far as each applies.

2. Subject matter, duration, nature and purpose

• Subject matter: hosting and operating the SewingERP management system for the salon.
• Nature: storage, organization, retrieval, display, transmission at the salon's request (emails, portals, connected services), backup and deletion.
• Purpose: only to provide the service described in the Terms of Use, and the support and security that come with it.
• Duration: the term of the subscription and the 30-day export period after closure, followed by deletion (section 8).
• Documented instructions: the salon's use of the service itself (what it enters, shares, connects and deletes) and written instructions sent to the support address. The processor will tell the salon if, in its opinion, an instruction infringes data protection law.

3. Data subjects and categories of data

• Data subjects: brides and other clients (and relatives the salon links to them), partner stores (B2B), the salon's employees, suppliers and workrooms, and the salon's users.
• Categories: identity and contact details; event date and venue; body measurements and their history; photos and attached files (including fitting photos); preferences, notes and referral source; appointments; prices, deposits, payments and receipts (never card numbers); digital signatures with their timestamp, IP address and device; employee attendance, hours and, if the salon chooses, pay rates; system and audit logs.
• Special categories: none are intended. Measurements and photos are not in themselves special category data under Article 9, but are handled as sensitive. The salon must not enter health data or full national ID numbers unless it has a legal basis.
• Children: possible (for example a bat mitzvah dress). The salon is responsible for parental consent, including for photos.

4. Processor obligations

• Process personal data only on the salon's documented instructions, including with regard to international transfers, unless the law requires otherwise (in which case the processor will tell the salon first, where the law allows).
• Never use the data for its own purposes: no sale, no advertising, no profiling, no training of AI models, no contact with brides in its own name.
• Confidentiality: everyone with access to production data is bound by confidentiality. Support access to a salon's data is view-only and recorded in the salon's audit log.
• Security: implement the technical and organizational measures in Annex A (Article 32), and keep them at least at that level.
• Assist the salon with data subject requests. The service provides access (the card), rectification (editing), erasure ("permanent delete" per client) and portability (full export). A request sent directly to the processor about the salon's data is forwarded to the salon within 5 business days.
• Assist the salon with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36), taking into account the information available to the processor.
• Make available the information needed to demonstrate compliance with this agreement, and allow and contribute to reasonable audits by the salon or an auditor it mandates, on 30 days' written notice, at most once a year unless a breach or a supervisory authority requires it.

5. Personal data breaches

The processor will notify the salon without undue delay after becoming aware of a personal data breach affecting the salon's data, with what is known: the nature of the breach, the categories and approximate number of people and records concerned, likely consequences and the measures taken or proposed. Information that is not yet available will follow in phases. The processor will help the salon meet its own reporting duties (to the ICO or an EU supervisory authority within 72 hours where required, and to the Israeli Privacy Protection Authority).

6. Sub-processors

The salon gives general authorization to the sub-processors below. Each is bound by a written agreement with data protection obligations equivalent to this one.

• Paddle.com Market Limited (UK) sells the subscription to the salon as Merchant of Record. It is an independent controller of the payment details it collects, not a sub-processor of the salon's data.
• New or replaced sub-processors: notice to the salon by email and on the privacy policy at least 30 days in advance. The salon may object on reasonable data protection grounds; if no solution is found, it may end the subscription without penalty before the change takes effect.

7. International transfers

• The processor is established in Israel. The European Commission recognizes Israel as providing an adequate level of protection (Decision 2011/61/EU, reconfirmed in the Commission's review of 15 January 2024), and the UK recognizes the same decision (Data Protection Act 2018, Schedule 21, paragraph 5).
• The salon's data is stored in Germany (Supabase, Hetzner). Data leaving Israel to these providers goes to the EU, which Israel recognizes under the Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001.
• An encrypted backup copy is stored on Cloudflare R2 in North America. The data is encrypted on the processor's server before it leaves, and the transfer relies on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum incorporated in Cloudflare's data processing agreement.
• Cloudflare's network may process traffic in transit worldwide; Paddle may process billing data in the UK, the US and other countries where it operates, under its own terms.

8. Return and deletion

• During the subscription and for 30 days after closure the salon can export all of its data (a ZIP of CSV files) at any time.
• After those 30 days the data is deleted from the live system automatically, including files and users who have no other business in the service. It disappears from rolling backups within a further 60 days; one encrypted monthly backup copy is kept for 12 months and then deleted.
• Receipts, payments and expenses that tax law requires to be kept are retained for 7 years, with the client's details pseudonymized.
• Deleting a single data subject: the "permanent delete" action in the service (the privacy policy, section 8, lists what is deleted and what remains).
• The processor confirms deletion in writing on request.

9. Salon obligations

• Have a lawful basis for the data it enters and give data subjects the notice required by law (Articles 13 and 14 GDPR; section 11 of the Israeli law), including that the data is kept in an online system run by a third party.
• Enter only what the service needs, manage its own users and roles, and rotate any portal link that leaked.
• Handle data subject requests about its brides, clients and employees, using the tools in the service.
• Make sure the connections it turns on (invoicing, shipping, webhooks, its own payment provider) comply with the law.

10. Liability, term and law

• Each party is responsible for its own breaches. The processor's liability cap is the one in the Terms of Use.
• This agreement applies while the subscription is active and until deletion is complete; the confidentiality and deletion sections survive termination.
• If this agreement and the Terms of Use conflict on the processing of personal data, this agreement prevails. Governing law and jurisdiction are as in the Terms of Use, without limiting rights a data subject or supervisory authority has under the UK GDPR or the EU GDPR.

A. Annex A: security measures

• Isolation: every business table carries the business ID and is protected by row level security in the database; cross-table references are checked; an automated isolation test runs against the real project.
• Access: Supabase Auth with passwords of at least 12 characters, optional Google sign-in (PKCE), one-time reset links; automatic sign-out after 12 hours of inactivity and 30 days at most; roles and permissions per business; platform support access is view-only and logged.
• Encryption: TLS on every connection (Cloudflare Full strict with an origin certificate); encryption at rest at the storage providers; connection secrets encrypted with AES-GCM; API keys and passwords stored only as hashes; backups encrypted before they leave the server.
• Files: private bucket, signed links valid for one hour, per-business paths, allowed file types and size limits; client photos are never shown on supplier portals.
• Logging: automatic audit log of inserts, updates and deletes (12 months, 24 for money and account entities), support logins and exports are recorded.
• Availability: process supervision, health check every 5 minutes with alerts, nightly backup and a periodic restore drill.
• Network: firewall limited to web and SSH, origin locked to Cloudflare, rate limits on sign-in and public links, fail2ban, automatic security updates.
• Development: private code repository, changes through reviewed pull requests and CI, no secrets in the repository.

B. Annex B: contacts

• Processor: support@sewingerp.com (for security incidents, the same address with "SECURITY" in the subject).
• Salon: the account owner (the user with the Owner role).