This English text is a preliminary translation provided for convenience and has not yet been reviewed by legal counsel. The German version is the authoritative one and prevails in the event of any discrepancy.

Data Processing Agreement (DPA)

Last updated: August 2026

This agreement applies between the partner studio ("controller") and INKLY GmbH, Im Aegler 3i, 8153 Rümlang, Switzerland ("processor"). It takes effect when the studio starts using the platform and supplements the general terms and conditions.

1. Subject matter and duration

INKLY processes personal data of the studio's clients solely to provide the contractually agreed services (appointment management, client records, forms, communication, analytics).

Processing lasts for as long as the subscription is in place. After the contract ends, clause 8 applies.

2. Nature and purpose of processing

Managing appointment requests, bookings and cancellations
Maintaining client records including treatment history
Providing and retaining consent and information forms
Communication between studio and clients (chat, e-mail notifications)
Processing deposits and gift cards via the payment provider
Producing analytics for the studio

3. Categories of data subjects and data

Data subjects: the studio's clients and its staff.

Categories of data:

Master data (name, contact details, date of birth)
Booking and treatment data (service, appointment, artist, price, motif, body area)
Communication data (message history)
Payment-related data (deposit status; card details are processed exclusively by the payment provider)
Special categories: health details from consent forms (allergies, pre-existing conditions, medication, pregnancy). These are collected only on the basis of the data subject's explicit consent.

4. Processing on documented instructions

INKLY processes the data solely on the studio's documented instructions. The configuration in the dashboard and this agreement constitute such instructions. Instructions INKLY considers unlawful are reported to the studio; INKLY may suspend their execution.

5. Confidentiality

All persons at INKLY involved in the processing are bound to confidentiality. That obligation continues beyond the end of their engagement.

6. Technical and organisational measures

INKLY maintains measures appropriate to the risk, in particular:

Encryption in transit (TLS) and encryption at rest with the hosting provider
Role-based access control; studios see only the data of their own business
Authentication via an established identity service, passwords stored only as hashes
Logging of security-relevant events
Regular backups with a restore procedure
Separation of production and test environments

7. Sub-processors

The studio consents to the use of the following sub-processors:

Provider	Purpose	Location
Google Cloud / Firebase	Hosting, database, authentication, file storage	EU / Switzerland
Stripe	Processing deposits, gift cards and subscriptions	USA (standard contractual clauses)
Infomaniak	Sending transactional e-mail (SMTP)	Switzerland
Algolia	Search index for the public studio and artist search	EU
OpenAI	Processing input to the AI features (text, uploaded images)	USA (standard contractual clauses)
Sentry	Error and stability monitoring of the application	EU

Note on the AI features: content processed in AI tools – for example descriptions for the stencil generator or uploaded reference images – is transmitted to OpenAI. Do not submit health details or data identifying a client there.

If a sub-processor changes or is added, INKLY informs studios in advance with reasonable notice. The studio may object on reasonable grounds; if no agreement is reached, it may cancel the subscription effective as of the change.

8. Deletion and return

The studio can export its data (client records, appointments, revenue) as CSV at any time under Settings → Data in the dashboard. After the contract ends, INKLY deletes the data unless statutory retention obligations apply.

For exports in other formats or any questions: info@inkly.ch.

9. Assistance obligations

INKLY provides reasonable assistance to the studio with:

Requests from data subjects (access, rectification, erasure, portability)
Notification of personal data breaches. INKLY informs the studio without undue delay after becoming aware.
Data protection impact assessments, to the extent processing by INKLY is concerned

10. Evidence and audits

On request, INKLY makes available the information necessary to demonstrate compliance with this agreement. Audits take place with reasonable prior notice, during normal business hours and without disrupting operations.

11. Allocation of responsibilities

The studio is the controller for its clients' treatment data. It determines purposes and means, obtains the necessary consents, and answers data subject requests concerning that data.

INKLY is an independent controller for users' account and platform data (registration, login, platform-wide features). The privacy policy applies to that.