1. Parties and subject matter
The customer identified in the proposal is controller of data it decides to manage in NexTan. Power Tan Unipessoal Lda., company number 510531024, acts as processor for that processing. This agreement covers contracted functionality and does not replace the lawful grounds the salon must establish for individuals. Publication alone does not constitute an individually executed agreement.
2. Operations, duration and categories
Processing may include collection, recording, organisation, storage, retrieval, updating, authorised disclosure, export and deletion during service provision and agreed closure operations. Individuals may include salon customers, prospects, staff and users. Data includes identity, contacts, activity, appointments, sales, payments, consents and signatures; health information only where required by the record form and a lawful purpose.
3. Instructions and lawfulness
Power Tan processes data only on documented customer instructions unless legally required otherwise, informing the customer where permitted. The customer ensures transparency, lawful grounds under Articles 6 and, where relevant, 9 GDPR, minimisation and authorised access. Power Tan informs the customer if it considers an instruction contrary to data protection rules. It does not use salon customer data for its own advertising or to train public models.
4. Confidentiality and security
Authorised people are bound by confidentiality and access data only as needed for their roles. The parties document risk-proportionate measures, including access profiles, credential protection, secure communications, incident management and backup, recovery and deletion procedures. Actual configurations, responsibilities and recovery procedures must appear in operational schedules; no unagreed certification or availability level is presumed.
5. Sub-processors and location
Sub-processors require specific or general written customer authorisation and equivalent protection obligations. Before processing starts, the provider schedule identifies the hosting and email contracting entity, services, locations and any access from outside the EEA. The current provider is commercially identified as PTisp; its legal entity and actual locations must be confirmed in the contractual documents. Material changes are notified with an opportunity for reasoned objection.
6. International transfers
Transfers outside the EEA require instructions and appropriate legal mechanisms, including an adequacy decision or standard contractual clauses where applicable, plus necessary assessment and supplementary measures. Choosing a language or a location in another country does not itself authorise transfers to any provider.
7. Rights and assistance
Power Tan assists the customer, taking account of the processing and available information, with rights requests, impact assessments and legally required consultations. Requests received directly from individuals about salon data are referred to the customer without independent decisions on their merits unless legally required. The parties cooperate to meet applicable deadlines.
8. Personal data breaches
On becoming aware of a personal data breach covered by this agreement, Power Tan informs the customer without undue delay and provides available details about its nature, impact and response, in phases if needed. The customer assesses notification duties to authorities and individuals with Power Tan’s required assistance. Incidents and decisions must be documented.
9. End of service and audit
At the end of processing, the customer chooses data return or deletion unless retention is legally required. The parties agree the format, deadline and procedure beforehand, including backups and restricted access during transition. Commercial suspension does not immediately destroy records. Power Tan provides information needed to demonstrate compliance and permits proportionate audits under the law while protecting other customers’ data.
10. Execution
The applicable version and controller identification accompany the accepted proposal. Provider, security and closure schedules must be completed before use as part of the agreement. Contact info@nextan.eu for instructions and questions. Power Tan’s own contracting and billing operations are described separately in the Privacy Policy.