Version 2026-10-23 · English · Personal cloud release

Data Processing Addendum

This addendum forms part of the Tymora Terms of Use when an account holder authorizes cloud processing of salon client records. The account holder or the salon on whose authority it acts is the controller. Bekir Varol, operating Tymora at ul. Parvi Maj 8, Kardzhali, Bulgaria, is the processor for those records. Contact: support@clickhab.com, +359 894 355 676. Tymora acts separately as controller for its own account, security, support and billing administration, as described in the Privacy Policy.

1. Subject, purpose and duration

Processing provides the recordkeeping, authenticated storage, device synchronization, restoration, sharing expressly enabled by the controller, export and deletion features requested through Tymora. It includes receipt, recording, organization, storage, retrieval, transmission to authorized devices or members, and deletion. Processing continues while the controller uses the cloud service and during the documented deletion period or any retention required by law.

2. People and data

Data subjects include salon clients, the controller’s staff and professional contacts. Depending on what the controller enters, data include names, contact details, appointment and service details, preferences, financial entries, notes, photographs, documents and short voice recordings. Optional allergy, skin-sensitivity and other health-related notes can be special-category data. The controller decides whether such content is necessary and establishes the required lawful basis and, where applicable, explicit consent. These data are not required simply to open a basic client record.

3. Instructions and confidentiality

Tymora processes client content only on documented instructions represented by the agreement and the controller’s authorized use of the service, including permitted transfers, unless binding law requires otherwise. Where legally permitted, Tymora informs the controller before legally compelled processing. Tymora informs the controller if an instruction appears to infringe applicable data-protection law. Authorized personnel must be subject to confidentiality obligations. Client content is not sold, used for unrelated advertising or used to train AI models.

4. Security and access

Tymora applies measures appropriate to the processing risks, including verified account authentication, account and salon authorization rules, protected transport, encrypted records and file payloads, restricted operational access and a confirmed deletion workflow. Account encryption keys are stored under owner-restricted Firebase rules; this is not end-to-end encryption against the service operator. Device caches, exports and offline copies require controller safeguards. The controller manages its accounts, staff permissions and lawful access to devices, and reports suspected compromise promptly.

5. Subprocessors and locations

The controller authorizes Google, through Google Cloud and Firebase, to provide authentication, Firestore storage, Cloud Storage, hosting and operational infrastructure for these features. Firestore is configured in Frankfurt, Cloud Storage in Belgium, and Firebase Authentication may process account information in the United States. Related processing can involve other locations as explained in the Privacy Policy. Tymora must impose applicable data-protection obligations on subprocessors and remains responsible for its subprocessor obligations under applicable law. Before adding or replacing a subprocessor for client content, Tymora will provide prior notice and an opportunity to raise a reasoned data-protection objection. International transfers must use a valid applicable transfer mechanism; accepting this addendum does not waive transfer protections. Stripe and Google Play administer payments and do not receive salon client records through the billing integration.

6. Assistance and incidents

Taking account of the nature of processing and information available, Tymora assists the controller with data-subject requests, security obligations, personal-data breach notifications, data-protection impact assessments and prior consultations where required. Tymora notifies the controller without undue delay after becoming aware of a personal-data breach affecting processed client content, provides available information and updates as it becomes available. The controller remains responsible for its own required notices and deadlines. Send requests to support@clickhab.com; do not include unnecessary sensitive client content in ordinary email.

7. Return, deletion and verification

The controller can use available exports before ending the service. Following a confirmed account-deletion request, Tymora deletes personal cloud records, owned salon records and media according to the published deletion process, except data that binding law requires to be retained. Independently owned salons retain their own business records. Offline devices, user exports and third-party copies cannot be remotely guaranteed erased. Tymora makes information reasonably needed to demonstrate its processor obligations available and allows and contributes to audits, including inspections by the controller or its mandated auditor, as required by applicable law. Practical arrangements may protect other customers’ data and system security without excluding statutory audit rights.

8. Mandatory rights

This addendum does not remove obligations or liabilities imposed by applicable data-protection law. Where it conflicts with the Terms on processing client content, this addendum controls. The Privacy Policy describes account administration and current service limitations.