Belcome Data Processing Agreement

Version 2026-10-12

This Data Processing Agreement ("DPA") is between the business that accepts it in Belcome ("Customer") and Design Master Solutions, LLC, a Massachusetts limited liability company that operates Belcome ("Belcome", "we"). It forms part of the Belcome Terms of Service ("Terms"). It applies when Customer's business is established outside the United States, or when the data protection law of the European Union, the European Economic Area, the United Kingdom, Brazil, Canada, Australia or New Zealand applies to Client Data. If the DPA and the Terms conflict on the processing of personal data, the DPA wins; if the DPA and a Schedule conflict, the Schedule wins.

1. Definitions

• Client Data: personal data that Customer, its team or its clients put into the Service, as defined in the Terms, and the staff work records Customer keeps in the Service (schedules, time off, services performed, commissions). It does not include the sign-in account data of Customer's team members, which Belcome handles as a controller under the Belcome Privacy Policy.
• Data Protection Law: the laws that apply to the processing of Client Data, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as retained in UK law ("UK GDPR") with the Data Protection Act 2018, Brazil's Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD"), Canada's PIPEDA, Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020.
• Controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings in the GDPR, and the equivalent terms of the other Data Protection Laws (for the LGPD, "controlador", "operador", "titular" and "incidente de segurança").
• Sub-processor: a third party Belcome engages to process Client Data for the Service.

2. Roles

Customer is the controller of Client Data. Belcome is its processor (under the LGPD, "operador"). Belcome is a separate controller only of the data described in the Belcome Privacy Policy (business accounts, the website, and the optional contact profile a client confirms by code to prefill bookings on other businesses' pages).

3. Instructions

Belcome processes Client Data only on Customer's documented instructions. The Terms, this DPA and the settings Customer chooses in the Service (including the integrations it connects) are those instructions. Belcome will tell Customer if, in its opinion, an instruction breaks Data Protection Law. Belcome does not sell Client Data, does not use it for advertising and does not use it to train artificial intelligence models.

4. Subject matter, duration and details

The subject matter is the provision of the Service. The duration is the term of the Terms plus the deletion period in section 11. The nature, purpose, data subjects and categories of data are in Annex I.B of Schedule 1, which applies to every region.

5. Confidentiality

Belcome allows access to Client Data only to its personnel who need it to run, secure or support the Service, who are bound by confidentiality and who use multi-factor authentication. Support access to a Customer's account is used only to answer Customer's request, for security, or when the law requires it.

6. Security

Belcome keeps the technical and organisational measures in Annex II of Schedule 1. It may improve them; it will not lower the overall level of protection.

7. Sub-processors

Customer gives Belcome a general authorisation to use the sub-processors in Annex III of Schedule 1. Belcome will give at least 30 days' written notice (email to the account owner and an update at www.belcome.app/subprocessors) before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may end the Terms and receive a pro-rated refund of prepaid fees for the unused period. Belcome binds each sub-processor to data protection terms that are no less protective than this DPA and remains responsible for it.

Integrations Customer chooses to connect (for example accounting, marketing, calendar or analytics tools, and analytics tags placed by Customer on its booking page) are not Belcome sub-processors: they receive data on Customer's instruction and under Customer's own contract with that provider. For med spas and other health businesses, integrations that would receive client details stay off.

8. Assistance with data subject requests

The Service lets Customer find, export, correct and delete a client's data. If Belcome receives a request from Customer's client, it will send it to Customer without undue delay and will not answer it itself unless Customer asks. Belcome will help Customer, taking into account the nature of the processing, with data protection impact assessments and prior consultations.

9. Personal data breaches

Belcome will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Data, with the information Customer needs to meet its own duties (for the GDPR and UK GDPR, 72 hours to the supervisory authority; for the LGPD, the period set by ANPD Resolution CD/ANPD No. 15/2024; for Australia, the Notifiable Data Breaches scheme; for New Zealand, a notifiable privacy breach; for Canada, a breach of security safeguards creating a real risk of significant harm).

10. Audits

Belcome will make available the information needed to show compliance with this DPA, including its AWS compliance reports under NDA where AWS allows, and will answer reasonable written security questionnaires once a year. Customer may audit, itself or through an independent auditor bound by confidentiality, on 30 days' written notice, at its cost, once a year, or after a personal data breach or a supervisory authority request.

11. Return and deletion

Customer can export Client Data while the account is active and for 30 days after it ends. After that, Belcome deletes Client Data from the live systems; encrypted backups are overwritten on their normal cycle, within 35 days. Belcome keeps only what the law requires it to keep, and protects it under this DPA.

12. International transfers

Client Data is stored in the United States (Amazon Web Services, region us-east-1, Northern Virginia). Each transfer of Client Data to Belcome as importer is governed by the Schedule for Customer's region:

• EU and EEA: Schedule 1, the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, Module Two.
• United Kingdom: Schedule 2, the ICO International Data Transfer Addendum to those Clauses.
• Switzerland: Schedule 1 with the adjustments in Schedule 1, section 1.9.
• Brazil: Schedule 3, the standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024, in Portuguese, adopted in full (published at www.belcome.app/pt/clausulas-anpd/).
• Canada, Australia and New Zealand: no transfer clauses are required by those laws for a service provider; Belcome's obligations in this DPA give the comparable protection required by PIPEDA principle 4.1.3, Australian Privacy Principle 8 and New Zealand Information Privacy Principle 12.

Belcome is not certified under the EU-U.S. Data Privacy Framework; it relies on the clauses above.

13. Government access

If a public authority asks Belcome for Client Data, Belcome will try to redirect it to Customer, will notify Customer unless the law forbids it, will challenge a request it considers unlawful, and will disclose only the minimum required. These commitments add to Clause 15 of the Standard Contractual Clauses.

14. Health data and children

Where Customer is a med spa or another health business, Client Data may include data concerning health. Customer is responsible for its legal basis (for the GDPR and UK GDPR, a condition in Article 9(2), usually explicit consent; for the LGPD, Article 11) and uses the consent fields of the Service's forms to collect it. Belcome applies the extra safeguards described in Annex I.B. Customer is responsible for the consent of a parent or guardian when it books a minor.

15. Liability and term

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses forbid those limits. This DPA lasts as long as Belcome processes Client Data for Customer.

16. Representative

Belcome is not established in the EU or the UK. Belcome will appoint a representative under Article 27 of the GDPR, established in the EU, and a representative under Article 27 of the UK GDPR, established in the United Kingdom, and will publish their names and contact details in this DPA and in the Belcome Privacy Policy before it serves the first health business (such as a med spa, wellness or skincare business) established in the EU, the EEA or the United Kingdom. Until then, Belcome does not publish the booking page of such a business. Write to info@designmastersolutions.com on any matter about this DPA.

Schedule 1: EU Standard Contractual Clauses

1.1 Incorporation

The standard contractual clauses for the transfer of personal data to third countries set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Official Journal of the European Union L 199, 7 June 2021, p. 31) ("EU SCCs"), Module Two (transfer controller to processor), are incorporated into this DPA by reference and completed as follows. Customer is the data exporter and Belcome is the data importer. Accepting this DPA in the Service has the same effect as signing the EU SCCs and Annex I.A.

Official text: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj (read on 12 October 2026).

1.2 Choices in the clauses

• Clause 7 (docking clause): not included.
• Clause 9(a): Option 2, general written authorisation; the time period is 30 days (section 7 of the DPA).
• Clause 11(a): the optional independent dispute resolution body is not included.
• Clause 13(a): the supervisory authority is the one in Annex I.C.
• Clause 17: Option 2. The EU SCCs are governed by the law of the EU Member State where the data exporter is established; where that law does not allow third-party beneficiary rights, by the law of Ireland.
• Clause 18(b): the courts of the EU Member State where the data exporter is established.

1.3 Clause 8.9 audits and Clause 8.5 deletion

Audits under Clause 8.9 follow section 10 of the DPA. Certification of deletion under Clause 8.5 and Clause 16(d) is given on Customer's written request.

1.4 Annex I.A: List of parties

Data exporter

• Name: the business that accepts this DPA in Belcome, as recorded in its Belcome account.
• Address: the business address recorded in its Belcome account.
• Contact person's name, position and contact details: the account owner, at the email recorded in the account; data protection officer or EU representative, if the business has one, as it records them.
• Activities relevant to the data transferred: operating a salon, barbershop, spa, med spa or studio and using Belcome for its calendar, online booking, client records, payments and messages.
• Signature and date: by acceptance in the Service, on the date recorded in the acceptance log.
• Role: controller.

Data importer

• Name: Design Master Solutions, LLC (operator of Belcome).
• Address: 116 Kennedy Dr, Malden, MA 02148-3494, United States.
• Contact person's name, position and contact details: Alan de Bortolo, Manager, info@designmastersolutions.com. EU representative and UK representative: section 16 of the DPA.
• Activities relevant to the data transferred: providing the Belcome service (calendar, online booking, front desk, client records, forms, payments and appointment messages) as processor.
• Signature and date: on the date of Customer's acceptance in the Service.
• Role: processor.

1.5 Annex I.B: Description of transfer

Categories of data subjects

• Customer's clients and prospective clients (people who book, are booked, join a waitlist, buy a gift card or membership, or fill in a form), including minors booked by a parent or guardian.
• Customer's team members (as work records: schedules, time off, services performed, commissions).
• People who contact Customer through Belcome (messages, reviews, the AI receptionist).

Categories of personal data

• Identity and contact: first and last name, email, mobile phone, preferred language, date of birth or birthday when Customer collects it, address for at-home visits.
• Bookings: appointments, services, team member, times, location, status, cancellations, no-shows, waitlist entries, reviews.
• Client file: notes, service history, product purchases, loyalty points, gift cards, memberships, before-and-after photos, form answers and e-signatures.
• Payments: amounts, currency, tips, refunds, payment method type and the last four digits of a card. Full card numbers are entered directly with Stripe and never reach Belcome.
• Messages: consent to text or WhatsApp messages and its record, appointment messages sent (which never name the booked service), replies such as STOP, messages handled by the AI receptionist.
• Technical: IP address and browser data of the public booking pages (for security and bot protection).

Sensitive data transferred and safeguards

For med spas and other health businesses: data concerning health (medical history, allergies, medications, treatment notes, consent forms and treatment photos). Safeguards: the data stays on AWS services covered by Belcome's AWS Business Associate Addendum; integrations that would receive client details stay off; calendar sync shows only "Busy"; text, WhatsApp and push messages never name the service; access is limited by team role; every change to a client file adds a record to an append-only audit trail; error reports strip names, emails and phone numbers before leaving Belcome's servers. Belcome does not ask for and is not designed to hold special category data for businesses that are not health businesses.

Frequency of the transfer: continuous, for as long as Customer uses the Service.

Nature of the processing: hosting, storage, organisation, retrieval, display, transmission of messages and notifications, payment processing through Stripe, backup and deletion.

Purposes of the transfer and further processing: to provide the Service under the Terms, to keep it secure and working, to give support Customer asks for, and to meet legal duties.

Retention: as Customer decides in the Service; deleted 30 days after the account ends, with encrypted backups overwritten within 35 days (section 11 of the DPA). Security logs up to 12 months.

For transfers to sub-processors: subject matter, nature and duration as in Annex III, for the term of the Terms.

1.6 Annex I.C: Competent supervisory authority

The supervisory authority of the EU Member State where the data exporter is established (for a data exporter in Ireland, the Data Protection Commission; in Portugal, the Comissão Nacional de Proteção de Dados; in Spain, the Agencia Española de Protección de Datos).

1.7 Annex II: Technical and organisational measures

Measured on 12 October 2026 against the Belcome code and infrastructure.

• Encryption in transit: TLS 1.2 and 1.3 only on every Belcome API and booking host, with HTTP Strict Transport Security; messages to AWS, Stripe and Google over TLS.
• Encryption at rest: the database (PostgreSQL 17) and cache run on encrypted Amazon EBS volumes; backups in Amazon S3 with server-side encryption (AES-256), versioning, and public access blocked; passwords stored only as one-way hashes.
• Availability and restore: continuous write-ahead-log archiving to S3 (recovery point of 5 minutes), weekly full and daily differential backups (five full backups kept), daily EBS snapshots (seven kept), a scripted restore drill run on the staging environment, health checks and alarms on availability and backups.
• Identification and authorisation: per-user accounts, optional two-step verification (TOTP) for business users, mandatory TOTP for Belcome's internal back office, role-based permissions inside each business, every request scoped to the user's own business, rate limits on sign-in and public endpoints, Cloudflare Turnstile against bots on public booking pages.
• Logging and accountability: append-only audit trail for changes to client files and to legal acceptances; security logs kept up to 12 months.
• Data minimisation: error reports (Sentry) are sent with default personal data off and a filter that removes names, emails and phone numbers; notifications carry generic text and internal references only; messages never name the booked service.
• Infrastructure: a dedicated AWS account for Belcome inside the Design Master Solutions organisation, region us-east-1, covered by the AWS Business Associate Addendum; server administration access (SSH) restricted to an approved network range; no shared hosting.
• Organisation: access to production limited to named Design Master Solutions personnel with multi-factor authentication; changes released through an automated quality gate; incident response under section 9 of the DPA.
• Assistance to the controller: export, correction and deletion of a client in the app; account export for 30 days after closing.

1.8 Annex III: List of sub-processors

The data exporter authorises these sub-processors (Clause 9(a), Option 2; the list is also published at www.belcome.app/subprocessors). All process Client Data in the United States unless noted.

1.9 Switzerland

For transfers subject to the Swiss Federal Act on Data Protection (FADP), the EU SCCs apply with these changes: references to the GDPR are to the FADP; the competent supervisory authority in Annex I.C is the Federal Data Protection and Information Commissioner; "Member State" in Clause 18(c) includes Switzerland so that data subjects in Switzerland can sue there.

Schedule 2: UK International Data Transfer Addendum

This Schedule is the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, in force 21 March 2022, issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 ("UK Addendum"). It applies to transfers of Client Data subject to the UK GDPR.

Official text: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf (read on 12 October 2026). The ICO states it plans to update the IDTA and the Addendum during 2026 after the Data (Use and Access) Act 2025 and that the current versions should be used until then.

Part 1: Tables

Table 1: Parties

• Start date: the date Customer accepts this DPA in the Service.
• Exporter (who sends the Restricted Transfer): Customer, with the legal name, trading name, main address, registration number and key contact recorded in its Belcome account.
• Importer (who receives the Restricted Transfer): Design Master Solutions, LLC; trading name Belcome; main address 116 Kennedy Dr, Malden, MA 02148-3494, United States; key contact Alan de Bortolo, Manager, info@designmastersolutions.com.
• Signature: acceptance in the Service (Part 2, Section 2 of the UK Addendum allows any legally binding form).

Table 2: Selected SCCs, Modules and Selected Clauses

The version of the Approved EU SCCs which this Addendum is appended to is Schedule 1 of this DPA, including the Appendix Information, with these modules and options:

Table 3: Appendix Information

• Annex 1A, List of Parties: Schedule 1, section 1.4.
• Annex 1B, Description of Transfer: Schedule 1, section 1.5.
• Annex II, Technical and organisational measures: Schedule 1, section 1.7.
• Annex III, List of Sub-processors: Schedule 1, section 1.8.

Table 4: Ending this Addendum when the Approved Addendum changes

Which Parties may end this Addendum as set out in Section 19: Importer.

Part 2: Mandatory Clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

For transfers under the UK Addendum, the competent supervisory authority is the Information Commissioner, and the governing law and courts are those of England and Wales (UK Addendum, Part 2, Sections 12(c), 15(j), 15(k), 15(m) and 15(n)).

Schedule 3: Brazil (ANPD standard contractual clauses)

For Customers established in Brazil, or when the LGPD applies to the transfer of Client Data to Belcome in the United States, the standard contractual clauses approved in Annex II of Resolution CD/ANPD No. 19 of 23 August 2024 apply, adopted in full and without change, in the Portuguese text published at www.belcome.app/pt/clausulas-anpd/. Under Article 16, § 3 of that Regulation, Sections I, II and III of Annex II are an annex to the instrument accepted between Customer (exporter, controller) and Belcome (importer, operator).

Sources (read on 12 October 2026)

• Commission Implementing Decision (EU) 2021/914 of 4 June 2021, OJ L 199, 7.6.2021, p. 31: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914
• ICO, International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, in force 21 March 2022: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf
• ICO, What are standard data protection clauses (the UK IDTA and the Addendum)?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/
• Resolução CD/ANPD nº 19, de 23 de agosto de 2024, DOU 23/08/2024, edição 163, seção 1, p. 123: https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396
• GDPR (Regulation (EU) 2016/679), Articles 9, 27, 28, 33 and 46: https://eur-lex.europa.eu/eli/reg/2016/679/oj