Data Processing Addendum (DPA)

Capitalized terms used but not defined here have the meaning given in the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), the Texas Data Privacy and Security Act ("TDPSA"), and any other applicable US state-level data-protection law (collectively, "Data Protection Laws").

For personal data the Customer uploads to or processes through the Services about its own clients ("Customer Personal Data"), the Customer is the controller and Cosmixxology, Inc. is the processor. Where we process other categories of data described in our Privacy Policy for our own purposes — for example, account, billing, security, product analytics — we act as an independent controller.

We process Customer Personal Data to provide the Services described in the Customer's order form, for the duration of the order term plus any post-termination period required to return or delete the data. Processing includes collection, storage, organization, structuring, retrieval, transmission, deletion, and other operations that are necessary to provide the Services.

• Data subjects: the Customer's clients, staff, and end users.
• Categories: identifiers, contact info, photos of hair/scalp/face, derived measurements, hair-care preferences, allergies, appointment and order history, payment metadata.

We process Customer Personal Data only on the documented instructions of the Customer, which include the order form, the Services configuration, and any further written instructions consistent with the Services. We will tell the Customer if we believe an instruction violates Data Protection Laws.

We ensure that personnel authorized to process Customer Personal Data are bound by confidentiality and have completed appropriate training.

We implement appropriate technical and organizational measures, including:

• Encryption in transit (TLS 1.2+) and at rest (Azure Storage Service Encryption);
• Role-based access control with least-privilege defaults;
• Audit logging of administrative actions;
• Vulnerability scanning, secure SDLC, and code review;
• Incident response plan with notification to Customer without undue delay (and within 72 hours where the breach is likely to result in a risk to data subjects);
• Regular backup, disaster recovery testing, and resilience procedures.

The Customer authorizes us to engage the sub-processors listed at /legal/sub-processors. We will notify B2B Customers at least thirty (30) days before we add a new sub-processor that materially affects the processing of Customer Personal Data, and give the Customer a right to object. We remain liable for sub-processors' compliance with this DPA.

We process Customer Personal Data in the United States. We do not currently transfer Customer Personal Data outside the United States. If we ever begin processing in another country, we will notify the Customer in advance and execute appropriate transfer terms.

We assist the Customer, taking into account the nature of processing, with: (a) responding to data-subject rights requests; (b) carrying out data-protection impact assessments; (c) consulting with supervisory authorities; (d) ensuring appropriate security and notifying personal-data breaches.

We make available to the Customer the information necessary to demonstrate compliance with applicable Data Protection Laws and allow audits by the Customer or a mutually agreed independent auditor, no more than once per year (more often if required by a regulator), with reasonable notice and during business hours, subject to confidentiality and reasonable cost reimbursement. We may satisfy this obligation by providing recent third-party audit reports (e.g., SOC 2 Type II) where available.

On termination of the Services, the Customer may export Customer Personal Data for 30 days. After that period, we will delete Customer Personal Data within 60 days, except as required by law. Backup copies are deleted on the next backup-rotation cycle (no longer than 90 days).

For purposes of the CCPA, in respect of Customer Personal Data we are a "service provider" or "contractor". We will not sell or share Customer Personal Data, will not retain, use, or disclose it outside the direct business relationship, and will not combine it with personal information received from another source.

In case of conflict, the order is: (1) this DPA, (2) the order form, (3) our general Terms of Service.

dpo@cosmixxology.com · legal@cosmixxology.com