Preamble
The Controller is the tattoo artist or entity that subscribes to Bryana (hereinafter, the "Studio"), holder of the account registered at app.bryana.es.
The Processor is the provider of the Bryana service (hereinafter, "Bryana"), identified in the Privacy Policy published at bryana.es/privacy.
Purpose: to regulate the processing of personal data of the end clients of the Studio (natural persons who contact or commission tattoos) processed through the Bryana platform (messaging, calendar, appointments, attachments, etc.).
Clauses
1. Definitions
The terms "processing", "controller", "processor", "personal data", "data subject" and "personal data breach" have the meaning set out in Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
2. Subject matter and duration
Bryana shall process the personal data indicated in clause 4 exclusively for the purposes set out in clause 3, for the duration of the Studio's subscription and until the return or deletion of the data pursuant to clause 6, unless Bryana is under a legal obligation to retain the data as processor.
3. Nature and purpose of the processing
Provision of cloud software for managing communications (e.g. Instagram/WhatsApp via integrations), calendar, appointments, clients and commercial data linked to the Studio. End client data shall not be used for purposes other than the Studio's documented instructions, except where required by mandatory law.
4. Types of personal data processed
- Identifiers: name, social media aliases, phone number, email address when provided by data subjects.
- Communications: message content, reasonably associated metadata, files or images sent by data subjects through connected channels.
- Preferences and operations: tattoo type, body area, availability, quotes or other information communicated by the data subject in the course of the commercial relationship.
5. Categories of data subjects
End clients and potential clients of the Studio whose data are managed through Bryana.
6. Obligations of the processor (Bryana)
- Process data only in accordance with the Studio's documented instructions, except where required by law.
- Ensure the confidentiality of all personnel authorised to process the data.
- Implement appropriate technical and organisational measures (including, as designed into the product: access control, authentication, per-studio data segregation, backups and logging mechanisms).
- Not engage unauthorised sub-processors. The Studio authorises the list of sub-processors published in Bryana's Privacy Policy (Vercel, Supabase, Stripe, Zernio, OpenAI, Resend, Upstash and, if enabled, Sentry). Bryana shall inform the Studio with reasonable notice of relevant changes to sub-processors so the Studio may object where legally permitted.
- Assist the Studio, to the extent possible, in responding to data subject rights requests.
- Notify the Studio of personal data breaches without undue delay.
- Upon termination of the service, delete or return the personal data processed as processor in accordance with the Studio's instructions, unless retention is required by law.
7. Obligations of the controller (Studio)
- Have a legal basis and, where applicable, valid consent from end clients for the processing of their data in Bryana.
- Inform end clients in its own privacy policy / basic information notice about the use of tools such as Bryana and the processors involved.
- Use the platform in compliance with applicable law (including commercial communications, minors, professional secrecy, etc.).
8. Sub-processors
The sub-processors envisaged are those listed in the Privacy Policy. The Studio may request reasonable additional information about the safeguards applied.
9. International transfers
Where a sub-processor processes data outside the EEA, Bryana endeavours to cover the transfer with appropriate instruments (e.g. Standard Contractual Clauses of the European Commission or other measures under Chapter V of the GDPR), as described in the Privacy Policy.
10. Audit
The Studio may request reasonable information on compliance with this agreement. On-site or technical audits must be arranged with reasonable advance notice (indicative: 30 days) and without prejudicing the security or confidentiality of other Bryana clients.
11. Termination
This agreement is linked to the main subscription contract and ceases when the service provision ends, without prejudice to any applicable legal retention obligations.
12. Governing law
Spanish law and the GDPR shall apply. The courts of Bryana's registered address shall have jurisdiction, unless mandatory consumer law provides for a different forum in favour of the Studio.