Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is part of the Partner Terms and/or the agreement between:

1. Lookster, Chamber of Commerce 94593051, Piet Heinstraat 12, 7511JE Enschede ("Processor" or "Lookster"); and
2. the salon/partner using the Lookster Salon Software/Dashboard ("Controller" or "Partner").

Together: "Parties".

1. This DPA applies when Lookster processes personal data on behalf of Partner in the context of providing the Salon Software/Dashboard and related services (such as support, maintenance and security).
2. Parties acknowledge that:
   1. Partner is the controller for personal data of (potential) customers and contact persons that Partner processes in the Dashboard; and
   2. Lookster acts as a processor insofar as Lookster processes those personal data on behalf of Partner.
3. This DPA does not apply to processing where Lookster independently determines the purpose and means (e.g. own business administration, invoicing, security/fraud prevention for its own systems, or Lookster website analytics). Lookster acts as an (independent) controller for these processing operations.

1. GDPR: the General Data Protection Regulation (EU) 2016/679.
2. Personal data, Processing, Processor, Controller, Data subject: as defined in the GDPR.
3. Subprocessor: a processor engaged by Lookster who carries out parts of the processing on behalf of Partner.

1. The details of the processing (categories of personal data, data subjects, purposes, duration) are set out in Appendix 1 to this DPA.

1. Lookster only processes personal data:
   1. based on written instructions from Partner; and
   2. to the extent necessary to provide the Services in accordance with the agreement/Partner Terms.
2. Instructions may emerge from the use of Dashboard functionalities and the configurations that Partner sets.
3. If Lookster believes that an instruction is contrary to the GDPR or other applicable law, Lookster will inform Partner of this (to the extent permitted by law).

1. Lookster takes appropriate technical and organizational measures to protect personal data against loss, unauthorized access, modification or disclosure, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the processing.
2. "Appropriate measures" include in any case (where applicable):
   1. access security (accounts, roles/rights);
   2. transport security (e.g. TLS/HTTPS where possible);
   3. logging/monitoring for security and stability purposes;
   4. backups and recovery measures (best effort);
   5. organizational measures (need-to-know, confidentiality).
3. Partner is responsible for secure configuration and use on its side, including:
   1. managing Seats/employee accounts and using strong passwords;
   2. preventing account sharing;
   3. correctly setting roles/rights within the Dashboard;
   4. processing personal data in accordance with its own privacy policy and legal obligations.

1. Lookster guarantees that persons who process personal data under its responsibility (employees, contractors) are bound by appropriate confidentiality.

1. Partner hereby gives Lookster general permission to engage sub-processors, to the extent necessary for the provision of the Services.
2. Lookster remains responsible for sub-processors' compliance with the obligations under this DPA.
3. Current (known) sub-processors within the scope of this DPA:
   1. Hosting/Infrastructure: Hetzner (data center/hosting).

   Explanation: Google Analytics is used by Lookster exclusively for Lookster website analytics and is therefore not covered by this DPA (see Article 1.3).

4. Lookster may change or add sub-processors. Lookster will inform Partner of this via an update in the Platform, by email or via a current list (e.g. on a support page), unless this is disproportionate. If Partner reasonably has serious objections to a new sub-processor, Parties will enter into consultation to find a solution. If no solution is possible, Partner may (as a last resort) terminate the agreement with effect from the introduction date of that sub-processor, without penalty, to the extent permitted by law.

1. A “Data Breach” means a personal data breach within the meaning of Article 4(12) GDPR.
2. Lookster shall report a Data Breach to Partner without unreasonable delay after Lookster has become aware of the Data Breach, providing, to the extent available:
   1. nature of the Data Breach;
   2. (probable) consequences;
   3. (proposed) measures to limit the Data Breach;
   4. contact point for follow-up.
3. Partner is responsible for any notifications to the Dutch Data Protection Authority and/or data subjects, unless the Parties agree otherwise in writing. Lookster will reasonably support Partner with information that Partner needs for those notifications.

1. Lookster will support Partner, as far as reasonably possible and appropriate to the nature of the processing, in:
   1. requests from data subjects (access, rectification, deletion, restriction, data portability, objection);
   2. security obligations and reporting obligations;
   3. DPIAs (data protection impact assessments) and prior consultation with the supervisory authority, to the extent that the processing by Lookster so requires.
2. If Lookster receives a request directly from a data subject that relates to data for which Partner is the controller, Lookster will forward this request (to the extent permitted) to Partner and Lookster will not substantively respond to the data subject, unless Partner instructs Lookster to do so or legal obligations provide otherwise.

1. Lookster will not process or have personal data processed outside the European Economic Area (EEA) unless:
   1. Partner gives permission for this or gives instructions; or
   2. this is necessary for a sub-processor and appropriate safeguards are applied (e.g. EU Standard Contractual Clauses) in accordance with GDPR.

1. Lookster processes personal data during the term of the agreement and thereafter only as long as and to the extent that:
   1. necessary to complete the Services (e.g. limited technical aftercare);
   2. necessary due to legal obligations; or
   3. necessary for security/backups, within reasonable timescales.
2. After termination of the Services, Partner may export data via the Dashboard (where available) prior to termination. Upon request, Lookster can, where reasonably possible, provide an export at any reasonable costs (as agreed in the partner terms).
3. Lookster will delete or anonymize personal data on behalf of Partner within a reasonable period after termination, unless:
   1. legal retention obligations or security/backup cycle temporarily prevent this; or
   2. Partner requests longer storage in writing.

1. Partner has the right to verify compliance with this DPA. Parties agree that audits:
   1. take place no more than once a year, unless there is a serious incident or valid reason;
   2. during office hours and with reasonable notice;
   3. respect the security and confidentiality of other customers/partners.
2. Instead of a physical audit, Lookster may also (first) offer reasonable evidence, such as an overview of measures, policies or (if available) audit reports/certifications.
3. Costs of audits are borne by Partner, unless an audit demonstrates material non-compliance on the part of Lookster.

1. The liability of the Parties under this DPA follows the liability provisions of the Partner Terms/main agreement, unless mandatory law provides otherwise.

1. In the event of any conflict between this DPA and other data protection contractual documents, this DPA shall prevail.
2. This DPA applies as long as Lookster processes personal data on behalf of Partner.