DUBHCORE — GDPR Rights and Account Deletion (public text)

Version 1.0 — Date: 30 August 2026 — Final version Describes only the functions actually available in the application (VERIFIED on code).

Your rights

As a data subject you may exercise the following rights (Art. 15–22 GDPR):

Access to your personal data;
Rectification of inaccurate data (profile modification);
Erasure ("right to be forgotten");
Restriction of the processing;
Portability of the data;
Objection to the processing, where applicable;
Withdrawal of consent, where the processing is based on consent (e.g. Google Calendar integration, and the consent to health data under Art. 9 for Tattoo/Piercing), without prejudice to the lawfulness of the prior processing.

Consent to health data (Art. 9). The adult client can view and withdraw their consents to health data directly from the app (section "Health data consents"). For minor clients, consent is given by the parent/guardian in the studio and is withdrawable by authorised staff. The withdrawal has effect for the future, does not equate to automatic deletion of the data (which may be retained in the presence of another legal basis/obligation) and any new consent constitutes new evidence.

For the data processed by the Studio as Controller (data of the studio's clients), the rights are exercised towards the Studio; DUBHCORE provides assistance as Processor.

Functions available in the app (VERIFIED)

Export your data (portability): you can download your data in JSON format. For security, the operation requires confirmation with password.
Delete your account: you can delete the account; the operation requires confirmation with password.
Client deletion (by the Studio/Admin): staff can delete a client with a data summary and explicit confirmation; the client's personal account is removed only if not linked to other studios.
Data modification: you can update your profile data in the account settings.
Unlinking from a studio: possible, with a block in the presence of confirmed future appointments or unarchived signed documents.

Important notes (retention — coherent with the Data Retention Schedule V1)

Account deletion does not mean the immediate deletion of all data. May be retained, where applicable: data subject to a legal obligation, fiscal documentation (up to 10 years where required), documentation strictly necessary for the defence of rights, the evidence of consent/withdrawal (Art. 9), and the data temporarily present in the backups until their scheduled rotation.
Signed documents are retained as immutable snapshots (evidentiary/defensive policy ~10 years, linked to the limitation period under Art. 2946 Italian Civil Code — not a GDPR obligation).
Structured health data follows the retention V1 of 12 months after completion/cancellation; it is distinct from the consent evidence and is not automatically retained for 10 years.
Withdrawal of consent to health data (Art. 9): prevents further processing based on consent for the future; does not render the prior processing unlawful; does not automatically equate to the immediate deletion of all data; the historical evidence of the grant/withdrawal may be retained according to the Retention Schedule; the underlying health data remains distinct from the consent evidence.
The indicated periods are a documentary policy (not yet automated via TTL/jobs; only verified TTL: reset token 30 minutes). No unimplemented automatic deletion is promised. For the clients' data, the Studio is Controller and may give retention instructions when justified.

How to contact us

To exercise your rights or for questions about the processing: info@dubhcore.com. You also have the right to lodge a complaint with the supervisory authority (in Italy: Garante per la protezione dei dati personali).