Data Processing Agreement

Last updated: 6 October 2026

This Data Processing Agreement (“DPA”) forms part of the KERSIVO Terms of Service (the “Terms”) between Bartosz Jasinski, trading as KERSIVO, based in Bournemouth, England, United Kingdom (“KERSIVO”, “we”, “us” or “our”), and the Client.

This DPA applies only where KERSIVO processes Customer Personal Data on behalf of the Client in the course of providing the Services. For that processing, the Client is the Controller and Bartosz Jasinski, trading as KERSIVO, is the Processor.

KERSIVO separately acts as an independent Controller for its own account, billing, security, support, legal, tax, marketing and operational data, as explained in the Privacy Policy. That independent-controller processing is outside the scope of this DPA. KERSIVO is not the Processor for every category of personal data processed in connection with the platform.

1. Definitions

In this DPA:

• Applicable Data Protection Law means, to the extent applicable, the UK GDPR, the Data Protection Act 2018, and other applicable UK data-protection law.
• Client means the barbershop or business customer that uses the Services under the Terms.
• Controller and Processor have the meanings given in Applicable Data Protection Law.
• Customer Personal Data means personal data relating to the Client’s customers, clients, staff or other individuals that the Client submits to, collects through, or manages using the Services, and that KERSIVO processes on the Client’s behalf as Processor.
• Data Subject means an identified or identifiable natural person to whom Customer Personal Data relates.
• Processing / Process have the meanings given in Applicable Data Protection Law.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor means a third party engaged by KERSIVO to Process Customer Personal Data on KERSIVO’s behalf in connection with the Services.
• Services means the KERSIVO software and related services described in the Terms (including barbershop website, booking, CRM/admin, retail pickup and related operational features).

2. Roles and scope

The Client is Controller for Customer Personal Data it submits to, collects through, or manages using KERSIVO. KERSIVO acts as Processor only for the Processing required to provide the Services on the Client’s behalf.

KERSIVO remains an independent Controller where it determines its own purposes, including account administration, authentication and security, SaaS billing, legal acceptance records, direct support and customer communications with the Client, accounting, tax and legal compliance, abuse and fraud prevention, KERSIVO marketing analytics, and KERSIVO operational audit records. Those activities are described further in the Privacy Policy and are outside this DPA.

3. Documented instructions

KERSIVO will Process Customer Personal Data only: (a) to provide the Services; (b) according to this DPA, the Terms, the Client’s product configuration and other documented instructions; or (c) where required by applicable law.

Written instructions may include configuration made through the product, authenticated actions in the admin, support requests, and written email instructions consistent with the Services. KERSIVO does not provide legal advice.

If applicable law requires Processing outside the Client’s instructions, KERSIVO will inform the Client beforehand unless prohibited by law. KERSIVO will also inform the Client if, in KERSIVO’s opinion, an instruction appears to infringe Applicable Data Protection Law.

The Client instructs and authorises KERSIVO to transfer Customer Personal Data to the approved Sub-processors listed in Schedule 2, including where this involves a restricted transfer outside the United Kingdom, solely where necessary to provide the Services and subject to section 7 of this DPA.

4. Confidentiality

Any person authorised by KERSIVO to Process Customer Personal Data must be subject to an appropriate contractual or statutory duty of confidentiality.

5. Security

Taking account of the nature of Processing, the state of the art, the costs of implementation, and the likelihood and severity of risk to Data Subjects, KERSIVO will maintain appropriate technical and organisational measures to protect Customer Personal Data. Current measures are described in Schedule 3. No online service can guarantee absolute or perfect security.

6. Sub-processors

The Client grants KERSIVO general written authorisation to engage: (a) the Sub-processors listed in Schedule 2; and (b) replacement or additional Sub-processors, subject to the notification procedure below.

KERSIVO will enter into a written agreement with each Sub-processor that imposes data-protection obligations providing an equivalent level of protection for Customer Personal Data to the obligations applicable to KERSIVO under Article 28 and this DPA. KERSIVO remains responsible to the Client for the performance of the Sub-processor’s applicable data-protection obligations and will only permit Processing needed for the relevant service. KERSIVO does not promise a bespoke vendor stack for every Client.

For planned new or replacement Sub-processors, where reasonably practicable KERSIVO will notify active Clients at least 14 days before the change, by email and/or service notice. Emergency, security or legal changes may occur sooner where necessary. During the notice period the Client may object on reasonable data-protection grounds. The parties will attempt to resolve the objection in good faith. If no reasonable solution exists, KERSIVO may discontinue the affected feature, or either party may terminate the affected service in accordance with the Terms.

7. International transfers

Customer Personal Data may be processed outside the United Kingdom where a Sub-processor does so. KERSIVO does not claim that all data remains in the UK.

Where a restricted transfer requires safeguards, KERSIVO will rely on an appropriate lawful mechanism, which may include UK adequacy regulations where applicable, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard recognised under UK data-protection law. Provider-specific transfer mechanisms are governed by the current agreements between KERSIVO and those providers.

Where KERSIVO relies on an Article 46 safeguard for a restricted transfer, KERSIVO will complete any data protection test, also referred to by the ICO as a transfer risk assessment, required by Applicable Data Protection Law and implement any additional safeguards reasonably identified as necessary.

8. Data subject rights

The Client remains responsible for responding to requests from its Data Subjects. Taking account of the nature of Processing, KERSIVO will provide reasonable assistance using available technical and organisational measures for access, correction, erasure, restriction, portability and objection where applicable. Not every right has a self-service interface; assistance is also available via hello@kersivo.co.uk.

If KERSIVO receives a request relating to Customer Personal Data, it will normally direct the requester to the relevant Client unless law requires otherwise.

9. Security, breach and DPIA assistance

Taking account of the nature of Processing and information available to KERSIVO, KERSIVO will provide reasonable assistance with the Client’s obligations relating to Article 32 security, personal data breach assessment, regulator notification, data-subject notification where required, data protection impact assessments, and prior consultation with the ICO where required.

After becoming aware of a Personal Data Breach affecting a Client’s Customer Personal Data, KERSIVO will notify that Client without undue delay. Available information may be provided progressively where not all facts are known at first notification. KERSIVO does not promise a fixed one-, twelve- or twenty-four-hour notification SLA.

10. Return and deletion

While the Services are active, the Client may use the available self-service export tools. The standard CSV export currently contains client contact details and booking history and is not a full database export. Authorised Client administrators (Owner and Manager roles) may instruct KERSIVO to erase an individual shop customer’s profile and related customer-controlled data through the admin tools. Where appropriate, that instruction deletes the customer profile and notes and anonymises or minimises retained historical booking and order contact fields; matching local transactional confirmation records for that customer are removed where applicable. It does not necessarily hard-delete every historical transactional or payment record, and active/unresolved operational records or genuinely in-flight messaging may temporarily prevent erasure until resolved. Local erasure does not prove immediate deletion of residual copies held independently by payment, email, SMS, hosting, monitoring or other providers.

At the end of the Services, the Client may instruct KERSIVO to return and/or delete the Customer Personal Data processed on the Client’s behalf, unless Applicable Data Protection Law requires continued storage. For clarity, moving from Full KERSIVO to KERSIVO Starter does not end the Services for that shop: the processor relationship continues for the active Starter service. The relevant termination boundary is complete departure from KERSIVO for the shop, after any necessary wind-down of existing future operational appointments. Return is available through the self-service CSV where that format suffices, and through reasonable assistance for other categories on documented request. Deletion of the live tenant production graph follows the standard purge process described below. Not every return or deletion instruction is available as a single button in the admin UI.

Unless the Client gives a different lawful instruction before the end of the retention period, KERSIVO applies its standard 30-day post-termination export and retention window after the shop has left KERSIVO completely and any operational wind-down blockers have been resolved. After that window, Customer Personal Data in the live tenant production environment is deleted through the standard purge process, including tenant EmailOutbound and SmsOutbound records and the associated private Blob cleanup lifecycle (best-effort provider object deletion). Current tenant purge also performs best-effort deletion of public media objects that KERSIVO can safely attribute to that tenant, including the tenant-owned public media namespace. Provider/CDN residual copies may persist temporarily, and KERSIVO does not claim that every historical legacy object created outside the current ownership model is guaranteed to be removed by that process.

This obligation does not require deletion of separate records that KERSIVO lawfully retains in its independent-controller capacity, such as billing, tax, legal acceptance or security records. Residual copies may remain temporarily in provider-managed backups or other provider systems (including email, SMS, monitoring, hosting or payment providers where used) where immediate physical deletion is not technically practicable. Those copies remain protected and beyond normal active use until they are deleted or expire through the applicable provider lifecycle. Local deletion does not mean instantaneous erasure from every provider replica.

11. Audit and compliance information

KERSIVO will make available to the Client all information reasonably necessary to demonstrate compliance with the obligations applicable to KERSIVO under Article 28 and this DPA, and will allow for and contribute to audits, including inspections, conducted by the Client or an independent auditor mandated by the Client.

Where reasonable, documentation and written evidence will be used first. Audits must be carried out on reasonable advance notice and during normal business hours, must not provide access to another customer’s data, and must not compromise the security, confidentiality or intellectual property of KERSIVO or another person.

Customer-initiated audits are normally limited to one per twelve-month period, unless required by a regulator or law, following a material Personal Data Breach, or where there is a reasonable evidence-based compliance concern.

The Client bears its own audit costs. KERSIVO may charge reasonable costs for extraordinary assistance beyond the information and cooperation KERSIVO is required to provide under Applicable Data Protection Law, to the extent permitted by law.

12. Client responsibilities

The Client is responsible for:

• having a lawful basis for Customer Personal Data;
• providing required privacy information to its customers and staff;
• issuing lawful instructions;
• keeping account and access permissions appropriate;
• ensuring submitted data is relevant and appropriate; and
• complying with its Controller obligations under Applicable Data Protection Law.

Special category data. KERSIVO does not design the normal Services to require special category personal data. The Client must not intentionally submit special category personal data unless KERSIVO has expressly agreed to such Processing in writing and the Client has a lawful basis. Free-text notes and uploads could technically contain sensitive information; KERSIVO is not marketed as a health or special-category data system.

13. Liability, Terms and hierarchy

This DPA forms part of the Terms. Liability under this DPA is subject to the Terms to the extent permitted by applicable law. Nothing in this DPA creates a separate liability cap that conflicts with the Terms.

Where a mandatory international-transfer mechanism directly applies between the parties to this DPA and conflicts with this DPA, that mechanism prevails only to the extent of the conflict. For all other data-protection matters, this DPA prevails over the Terms to the extent of any conflict.

Nothing in this DPA limits rights or obligations that cannot lawfully be limited.

14. Governing law

This DPA is governed by the law of England and Wales. Disputes are subject to the same jurisdiction framework as the Terms (exclusive jurisdiction of the courts of England and Wales).

Schedule 1 — Details of Processing

Subject matter

Provision of KERSIVO barbershop website, booking, CRM/admin, retail pickup, communications and related operational services.

Duration

For the active KERSIVO service duration — including continued KERSIVO Starter service after a Full downgrade — plus the applicable post-complete-departure export/deletion period and limited residual provider backup lifecycle.

Nature / operations

Collection, recording, organisation, storage, retrieval, display to authorised Client users, booking creation, rescheduling and cancellation, Clients Core and (where included in the Client’s service level) advanced CRM, notes, image and file storage, Full retail order processing, transactional email, optional Full SMS reminders, Starter fixed public payment selection (£5 deposit or full payment) and Full owner-controlled payment mode status recording, migration/import, export, deletion, and security/operational Processing necessary to provide the service.

Purpose

Provide and operate the Client’s KERSIVO service according to the Client’s instructions.

Data subjects

Booking clients; retail customers; barbers; managers and team members; invited staff; individuals represented in legitimate migration or imported business records; and persons legitimately referenced in client records or notes.

Personal data

Name; email; phone; booking and appointment data; service, barber, date, time and status; cancellation/reschedule information; booking management tokens; deposit/payment status and Stripe identifiers (but not full card numbers); CRM tags and notes; client-note images; retail customer email and order contents; staff/barber names, contact and profile data; team invitations and roles; availability/working information where linked to staff; transactional email/SMS delivery data; and uploaded migration/setup material where it contains personal data.

Special category data

Not required or intentionally requested by the standard Services. The Client must not intentionally submit it unless expressly agreed in writing.

Frequency

Continuous or as initiated by the Client or Data Subjects during the service term.

Schedule 2 — Approved Sub-processors

The following are not listed as Sub-processors for Customer Personal Data under this DPA: Google Analytics / Google Ads (tenant analytics disabled; KERSIVO own marketing-controller processing); Stripe Full KERSIVO SaaS billing (KERSIVO independent-controller billing on KERSIVO’s own Stripe account); Stripe Connect payment services described below; and Google OAuth (KERSIVO account/auth context).

OpenAI note. Catalogue and recommendation AI processing remains designed around product/catalogue semantics and is not intended to send Customer Personal Data. Separately, the admin free-text AI assistant is a conditional Customer Personal Data path listed above where that feature is enabled. KERSIVO does not claim that OpenAI always receives tenant data for every Client.

Stripe roles (summary). Three distinct relationships must not be collapsed into a single Article 28 Sub-processor listing:

• A. KERSIVO Full SaaS billing. KERSIVO Starter is £0/month and does not create a KERSIVO SaaS subscription charge. Full KERSIVO is £39/month per physical location and is charged on KERSIVO’s platform Stripe account. KERSIVO is an independent Controller for that business-customer billing data. Stripe provides payment services under Stripe’s Services Agreement / Data Processing Agreement (for a UK Stripe account: contracting DPA entity Stripe Payments Europe, Limited (SPEL); regulated UK payment/e-money services may involve Stripe Payments UK Limited). Stripe may also process as an independent controller for fraud, regulatory and compliance purposes under Stripe’s terms.
• B. Client connected-account payments. Live booking deposits / full upfront booking payments and Full retail card payments use Stripe Connect with direct charges on the Client’s connected Stripe account. New public connected-account onboarding uses Stripe Standard. New public Starter bookings require a payment-ready Standard account; a historical Express connection may remain supported for Full KERSIVO and historical payment/refund continuity where already established, but it does not satisfy the Starter public-launch requirement. Starter customer-created public bookings use the fixed payment-powered model (a £5 deposit or full payment, with a £5 service paid in full); public Pay at shop is not a Starter customer-booking mode. The Client remains merchant / seller and Controller for the End Customer payment. KERSIVO facilitates the technical flow, stores limited payment/refund/account identifiers and statuses, and adds 0% application / platform fee to new Starter and Full booking payments; it does not store full card numbers or CVC. Stripe processing fees are separate. Stripe may separately pay KERSIVO partner compensation / revenue share if KERSIVO qualifies; that is not a fee deducted by KERSIVO from the Client’s booking payment.
• C. Stripe’s independent functions. Stripe may process personal data as processor for User-directed Services and as controller for its own fraud, regulatory, AML/KYC and platform purposes. Stripe Connect is therefore not listed above as a normal KERSIVO Sub-processor for Customer Personal Data merely because KERSIVO facilitates Connect Checkout.

QR and Google service configuration. KERSIVO QR Kit fulfilment contact/delivery data and merchant-managed Google booking-link configuration are primarily business-customer service-administration records handled by KERSIVO in its own controller capacity where applicable. Where those records contain Customer Personal Data supplied on the Client’s instructions, the processor obligations in this DPA apply to that Customer Personal Data. KERSIVO does not claim that the guided Google booking-link flow gives KERSIVO access to edit the Client’s Google Business Profile.

Schedule 3 — Technical and organisational measures

A. Access control

• Authenticated admin access
• Role-based permissions
• Tenant/shop scoping
• Session controls
• Authorised access only

B. Data protection in transit / storage

• HTTPS/TLS for web traffic
• Managed database and storage provider safeguards
• Private Blob storage for client-note and onboarding private assets
• No full payment card storage by KERSIVO

C. Application security

• Environment-managed secrets
• Webhook signature validation
• Selected-route rate limiting / abuse controls
• Input validation
• Upload type/size allowlists
• Private authenticated streaming for new client-note images

D. Tenant isolation

• Shop-scoped database and API access controls
• RBAC checks
• Authenticated private media access

E. Availability / recovery

• Provider-managed database backup / point-in-time recovery capabilities
• Documented recovery procedures

This DPA does not create a public SLA, RPO or RTO unless separately offered in a written commercial agreement.

F. Data minimisation / logging

• Sentry configured with default PII off and additional event scrubbing
• No KERSIVO Google Analytics / Ads tags on live tenant customer surfaces

G. Lifecycle

• Tenant outbox deletion during shop purge
• Production tenant data purge after applicable retention
• Private Blob cleanup lifecycle (best-effort provider object deletion)
• Public Blob cleanup aligned to tenant/record lifecycle (best-effort deletion of publicly attributable tenant media, including the tenant-owned public media namespace; provider/CDN residuals may persist; not a guarantee for every historical legacy object outside the current ownership model)
• Controller records kept separately where lawfully retained for KERSIVO’s own purposes

H. Incident management

• Documented incident-response process
• Operational alerting and error monitoring when configured
• Breach escalation under this DPA

KERSIVO does not claim ISO or SOC 2 certification for KERSIVO, independent penetration tests for KERSIVO, 24/7 staffed monitoring, or antivirus scanning of uploads, unless separately implemented and stated in writing.