Data Processing Agreement (DPA)
Version 1.0 · 5/21/2026
Between the PMU Artist (controller) and ISL (processor), pursuant to Art. 28 GDPR.
Subject matter and duration
Processing of the artist's client data for the duration of the subscription, for the purpose of providing the PMU documentation, questionnaire, photo, recipe and decision-support services.
Data categories
Identification, contact, health (questionnaire), aesthetic, photos, PMU sessions.
ISL obligations
- Processing only on the artist's documented instructions;
- Technical measures: encryption, JWT, hashed passwords;
- Notification of security incidents without undue delay;
- Upon termination: deletion or return of the data, at the artist's choice.
Artist obligations
- Written consent / legal basis for the data entered;
- Informing clients about ISL as processor;
- Compliance with the applicable local health and sanitary regulations.
Sub-processors: list. US transfers: SCC where applicable.