Data Processing Agreement (DPA)

pursuant to Art. 28 GDPR — instructions and obligations of the data processor

This Data Processing Agreement ("Agreement") is entered into between the shop, acting as data controller, and 北京厚土客盛科技有限公司 (Beijing Houtukesheng Technology Co., Ltd.), acting as data processor, and forms an integral part of the service contract governing the supply of the MiBuono membership management system.

1. Roles of the parties

Within the MiBuono network, each affiliated shop acts as an independent data controller of the data of its own customers and staff. The Processor operates the platform on behalf of each shop, exclusively on that shop's instructions.

2. Subject matter of the processing

• Duration: for the entire term of the service contract;
• Nature and purpose: processing carried out solely to provide the membership management system (registration, points, coupons, bookings, notifications), the related technical support and the management of the shop's subscription. No processing for other purposes, including profiling or marketing by the Processor;
• Subscription and licensing: for each shop the Processor aggregates the number of registered members (an aggregate count, not the individual records), the plan tier in use and the expiry date, in order to determine the applicable plan, manage the subscription, send expiry reminders and produce usage statistics for the Controller. This information is used only for licensing, billing and assistance purposes and is never used for profiling or marketing;
• Categories of data:
  • member registration data (first name, last name, e-mail, mobile number, date of birth, membership card number);
  • loyalty data (transactions, amounts, points accrual/redemption, coupons issued/used, registration and birthday bonuses);
  • booking data (date, time, services selected, preferred technician);
  • shop staff account data (display name, e-mail, role: manager/staff);
  • operational and security logs (IP address, user agent, audit log of management actions);
  • subscription and licence records (plan tier, aggregate number of registered members, expiry date);
  • push notification identifiers (device push token / cid) of the devices on which the app is installed.
• Categories of data subjects: customers/members of the Controller's shop; holders of the shop's staff accounts and their devices;
• Special categories of data: not processed. Payment data does not transit through the system: payments are made in person at the shop.

3. Place of processing and transfers outside the EU

The platform and the customer data are hosted on servers located in the European Union (data centre in Germany).

The push notification service, however, necessarily involves the transmission of the device push identifier, together with the notification content (which does not contain customer personal data), to the push infrastructure providers, which process it outside the EU/EEA: the unified push channel used by the app (Getui, through the uniCloud function, servers located in China) and, once the production release enables them, the offline channels of the device vendors and Google FCM (servers that may be located outside the EU, including the United States). These transfers are carried out under Art. 28 GDPR with appropriate safeguards within the meaning of Arts. 44 et seq. GDPR (Standard Contractual Clauses and the safeguards offered by the providers); the Controller authorises them as part of the instructions given by accepting this Agreement.

No other transfer of personal data outside the EU/EEA shall take place without the Controller's prior written consent.

4. Processor's obligations (Art. 28(3) GDPR)

The Processor undertakes to:

1. process the data only on documented instructions from the Controller, including with regard to transfers, unless required to do so by EU or Member State law — in which case the Controller shall be informed before processing, unless that law prohibits it;
2. ensure that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and receive such authorisation only within the strictly necessary scope;
3. take the technical and organisational security measures described in section 6 (Art. 32 GDPR);
4. not engage sub-processors without the Controller's prior specific or general written authorisation; where authorised, impose on them the same data protection obligations as set out in this Agreement and remain fully liable for their performance;
5. taking into account the nature of the processing, assist the Controller in responding to requests for the exercise of data subjects' rights (Arts. 15-22);
6. assist the Controller in ensuring compliance with Arts. 32-36 GDPR (security, breach notification, risk assessment, prior consultation);
7. at the choice of the Controller, delete or return all personal data after the end of the service and delete existing copies, unless EU or Member State law requires storage;
8. make available to the Controller all information necessary to demonstrate compliance and allow for and contribute to audits and inspections.

5. Sub-processors

The Controller authorises the following categories of sub-processors:

• hosting provider — servers located in the EU (data centre in Germany);
• transactional e-mail provider — sending of confirmation messages, verification codes and coupons;
• unified push provider (Getui, through the uniCloud function service) — delivery of push messages; processing takes place on servers located in China;
• device vendor push channels and Google FCM — offline delivery of push messages on Android/iOS; processing may take place on servers located outside the EU (including the United States).

For the sub-processors located outside the EU, the transfer is governed by the safeguards referred to in section 3.

New sub-processors will be notified to the Controller in advance, allowing reasonable time for objection.

6. Security measures

• transport encryption (HTTPS/TLS);
• passwords stored only in hashed form;
• role-based access control and least-privilege authorisation;
• audit logging of sensitive management operations;
• regular backups and hosting in certified EU data centres.

7. Data breach notification

The Processor shall notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach, providing the information needed to demonstrate compliance with Art. 33 GDPR and assisting the Controller in fulfilling its notification obligations under Arts. 33-34 GDPR.

8. Term and data return/deletion

This Agreement remains in force for the entire duration of the service. Upon termination, the Processor shall delete or return the personal data in accordance with section 4(7) and confirm the completion of the operations.

The shop may export its data at any time while the service is active and, in any event, within 30 days of termination. At the end of that period, and in any event within 90 days of termination, the Processor shall delete the personal data from the production systems and, according to its backup rotation cycle, from the backups, unless EU or Member State law requires longer storage.

9. Governing law and jurisdiction

This Agreement is governed by Italian law. Any dispute shall be brought before the court of the place where the Processor has its registered office, unless mandatory legal provisions provide otherwise.

10. Contacts

• Controller: the shop (see section 1);
• Processor: [email protected]

Last updated: 13/10/2026 — Version 1.1