Data Recipient & Barbershop Agreement

2.1 Tyjera: Sole Data Controller

Tyjera Einzelunternehmen is the sole data controller under GDPR Article 4(7). Tyjera determines:

• The purposes for processing appointment and customer data
• The technical and organizational means of processing
• What data is collected, retained, secured, and deleted
• Who may access data and under what conditions

2.2 Barbershop: Restricted Data Recipient

The Barbershop (Customer) is not a data controller, data processor, or joint controller. The Barbershop:

• Receives appointment data from Tyjera solely to provide the booked service
• May use data only for fulfilling the specific appointment booked
• Must not independently determine data processing purposes or means
• Must not retain, store, backup, or independently process customer data
• Must not share customer data with third parties
• Acknowledges all data remains under Tyjera's control and remains Tyjera's property

2.3 Tyjera's Role as Processor for Sub-Processors

Where Tyjera engages sub-processors (e.g., Clerk, Brevo, Mapbox), Tyjera acts as a processor under Article 28 GDPR with respect to those sub-processors. Tyjera remains the controller vis-à-vis the data subject (barbershop customers) and barbershops.

3.1 Duration

This Agreement remains in effect for the duration of the Barbershop's use of Tyjera's services and for 30 days following termination to allow for data return or deletion.

3.2 Nature and Purpose of Processing

Tyjera processes customer appointment data for the following purposes:

• Facilitating appointment booking and confirmation
• Sending appointment reminders and confirmations
• Managing customer profiles and booking history
• Providing analytics and business insights to barbershops (aggregated, non-personal data only)
• Complying with tax, legal, and security obligations

4.1 Security Measures

Implementing appropriate technical and organizational measures to protect personal data (see Section 5).

4.2 Handling Data Subject Requests

Tyjera is responsible for responding to all data subject requests. Barbershops forward requests to Tyjera.

4.3 Managing Sub-Processors

Tyjera ensures all sub-processors comply with GDPR through Data Processing Agreements (Article 28).

4.4 Data Breach Notification

Tyjera reports data breaches in accordance with GDPR Articles 33 and 34.

5.1 Encryption & Data Protection

Data transmitted via our platform is encrypted using industry-standard protocols (TLS). Password authentication is secured using industry-standard hashing algorithms.

• TLS encryption for all data in transit
• Password hashing using bcrypt or similar industry-standard algorithms
• Secure authentication provided by Clerk (third-party authentication service)

Planned: We are actively working towards implementing encryption for data at rest and secure backup procedures.

5.2 Access Controls

Tyjera implements role-based access control (RBAC) to restrict platform access according to user roles:

• Business Owners have full administrative access to their business data, including customer information, appointments, and settings
• Professionals (barbers/stylists) have limited access only to the data necessary for providing services and managing their schedules
• Access permissions are managed by the business owner account
• Automatic session timeouts for inactive users

As Tyjera is currently operated by a single person, formal multi-factor authentication and regular access reviews will be implemented as the business scales.

5.3 Confidentiality

As a single-operator business, all access to personal data and systems is limited to the owner. Data protection principles and security best practices are followed in all operations.

Planned: As the business grows and additional personnel are hired, formal confidentiality agreements and data protection training will be established.

5.4 Data Backup and Availability

Tyjera hosts all data and services within Germany using infrastructure compliant with local data protection laws.

• All data is hosted in Germany (EU)
• Regular data backups are performed
• DDoS protection via Cloudflare
• Regular system updates and security patch management

Planned: We are actively planning enhancements to continuity and disaster recovery capabilities to improve uptime and service resilience.

Limitations: We have not yet implemented full geographic redundancy or high-availability failover systems. Occasional service interruptions may occur, and Tyjera disclaims liability for any downtime beyond its reasonable control.

5.5 Monitoring and Incident Response

While formal 24/7 security monitoring and continuous penetration testing are not yet in place, Tyjera monitors system health and security events regularly.

• Regular monitoring of system logs and security events
• Incident response procedures for data breaches (notification within 72 hours as required by GDPR Art. 33)
• Security updates applied promptly when vulnerabilities are identified

Planned: Tyjera aims to enhance security testing, auditing processes, and monitoring capabilities as the platform grows.

5.6 Barbershop Data Access Controls

Barbershop owners and their staff have controlled access to customer data through the platform:

• Business owners have full access to historical appointment and customer data specifically related to their business operations
• Professionals (staff) have limited access only to their assigned appointments and necessary customer contact information
• Data access is strictly controlled through the platform and limited to what is necessary for managing bookings, customer communication, and service delivery
• Barbershops cannot bulk export customer data for external use beyond what the platform provides for business operations
• Barbershops cannot access data belonging to other businesses or users

Restrictions: Barbershops must not retain customer data independently outside the Tyjera platform or use customer data for purposes beyond providing the booked services.