Data Processing Agreement

Document ID: LEG-2 Version: v1 Effective date: the date this version is published (shown at the top of the published page). Acceptance: accepted per salon when you set up that salon, recorded with the document, its version, your account, the time, and your IP address and browser. Forms part of the Terms of Service (LEG-1).

---

1. Parties and roles

This Data Processing Agreement ("DPA") forms part of, and is governed by, the Terms of Service between:

• Salony Ltd ("Processor", "we", "Salony"), a company registered in England and Wales with company number 17476230, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, acting as a data processor; and
• the Tenant ("Controller", "you"), the salon business that registers for and uses the Salony service, acting as a data controller in respect of its own customers' personal data.

This DPA governs the Processor's processing of personal data on behalf of the Controller under UK GDPR Article 28. Where the Processor processes the Controller's own account and operator data (the salon owner's and staff's names, contact details, login credentials, billing preferences), the Processor acts as a controller for that data; that processing is governed by the Salony Privacy Notice (https://salony.co.uk/privacy), not by this DPA.

---

2. Definitions

Terms not defined here have the meaning given in UK GDPR (Regulation (EU) 2016/679 as it forms part of UK law by virtue of the European Union (Withdrawal) Act 2018) and the Data Protection Act 2018. "Personal data", "processing", "data subject", "special category data", "personal data breach", and "supervisory authority" (the Information Commission, which replaced the Information Commissioner's Office on 30 September 2026, "the Commission") each carry their UK GDPR meaning. "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.

---

3. Subject matter, duration, nature and purpose (Art 28(3) opening words)

UK GDPR Article 28(3) requires this DPA to set out the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subject.

• Subject matter: the Processor's provision of the Salony salon-management service (bookings, client records, automated client communications, calendar and staff management) to the Controller.
• Duration: for the term of the Controller's use of the service, plus the deletion/return period in clause 11.
• Nature and purpose: storing, organising, retrieving, transmitting and otherwise processing the Controller's customer personal data solely to deliver the service and on the Controller's documented instructions.
• Type of personal data: see Annex A.
• Categories of data subject: the Controller's customers (salon clients), and where applicable the Controller's staff acting within the Controller's account.

---

4. Processing only on documented instructions (Art 28(3)(a))

4.1 The Processor shall process the Controller's personal data only on the Controller's documented instructions, including with regard to international transfers, unless required to do otherwise by domestic law; in which case the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 The Controller's documented instructions are: (a) this DPA; (b) the Terms of Service; (c) the configuration choices the Controller makes within the Salony product (for example enabling or disabling automated reminders or marketing sends), each recorded by the Processor with its date and the account that made it; and (d) any further written instruction the Controller gives via hello@salony.co.uk.

4.3 The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes UK GDPR or other data protection law (Art 28(3) final paragraph).

4.4 The Processor shall not process the Controller's personal data for its own purposes, including analytics, product improvement or training of AI models, except in anonymised form or on the Controller's documented instruction.

---

5. Confidentiality (Art 28(3)(b))

5.1 The Processor shall ensure that persons authorised to process the personal data (employees, contractors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

5.2 The Processor shall ensure that access to the Controller's personal data is limited to those personnel who need access to perform the Processor's obligations, on a least-privilege basis.

---

6. Security of processing (Art 28(3)(c) and Art 32)

6.1 The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by UK GDPR Article 32. These measures are described in Annex B and include, as a baseline:

• multi-tenant logical isolation so that one tenant cannot access another tenant's data, enforced at the application layer on every tenant query and, as defence in depth, by database Row-Level Security on the core tenant tables (including all booking, client-profile and health records);
• encryption of personal data in transit (TLS on all service endpoints); at-rest protections as described in Annex B;
• access controls, authentication separation between platform and tenant scopes, and logging of access to client and health records;
• automated daily database backups, copied offsite, with a tested restore procedure (recovery point: up to 24 hours; point-in-time recovery is not currently provided);
• regular testing, assessment and evaluation of the effectiveness of these measures (Art 32(1)(d)), including automated tests that gate every production deploy and a review of these measures at least once a year.

6.2 The Processor shall not materially reduce the overall level of protection given by the measures in Annex B, and shall tell the Controller of any change that would.

6.3 The Processor shall take steps to ensure that any natural person acting under its authority who has access to personal data does not process it except on instructions from the Controller (Art 32(4)).

---

7. Sub-processors (Art 28(2) and 28(4))

7.1 The Controller gives the Processor general written authorisation to engage sub-processors, subject to this clause. The Processor shall inform the Controller of any intended addition or replacement of a sub-processor at least 30 days in advance, giving the Controller the opportunity to object on reasonable data protection grounds within 14 days (Art 28(2)). If an objection cannot be resolved, the Controller may end its use of the service before the change takes effect.

7.2 The current list of authorised sub-processors is in Annex C and in the sub-processor register (SUB_PROCESSORS.md), which the Processor keeps up to date by notice under clause 7.1. At the date of this version the sub-processors are:

Google (calendar sync) and Anthropic (AI layer) are planned, not engaged: those features are switched off in production and no personal data flows to them. Meta (Twilio's sub-processor for the WhatsApp channel) is likewise planned, because WhatsApp messaging is not enabled; only SMS is live. SMS network carriers are not sub-processors. Each planned provider becomes a sub-processor only when its feature is enabled; this DPA and the sub-processor register must be updated, and the Controller notified with a right to object, before that change.

7.3 Where the Processor engages a sub-processor, it shall impose on that sub-processor, by contract, the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures (Art 28(4)). The Processor remains fully liable to the Controller for the performance of that sub-processor's obligations.

---

8. Assistance with data-subject rights (Art 28(3)(e))

8.1 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil the Controller's obligation to respond to requests to exercise data-subject rights under UK GDPR Chapter III (Articles 12 to 23), including:

• right of access (Art 15): the Processor provides the means for the Controller to retrieve a copy of a data subject's data held in the service;
• right to rectification (Art 16): the Controller can correct customer records in-product;
• right to erasure (Art 17): the Processor provides a deletion action that deletes the data subject's personal data from all live systems (backups expire under clause 11.3). Special-category records (consultations, patch tests and health notes) are by default pseudonymised and access-restricted rather than deleted: every direct identifier is removed, and the record is retained and re-identifiable only by the Controller, through an access-restricted match key, when needed to deal with a legal claim. Such records are retained for the Controller's insurance and legal-claims period (default 7 years, Art 17(3)(e) and Art 9(2)(f)), then deleted automatically. For a client who was under 18 at the time of the service, the default is 7 years or until the client's 25th birthday, whichever is later. The retention period is the Controller's decision; the default applies unless the Controller instructs otherwise;
• right to restriction (Art 18) and objection (Art 21): the Controller can suspend processing/marketing for a data subject in-product;
• right to data portability (Art 20): the Processor provides export of the Controller's customer and booking dataset in a structured, commonly used, machine-readable format.

8.2 Where a data subject contacts the Processor directly with a rights request relating to the Controller's customer data, the Processor shall, within 2 working days, refer that request to the Controller and not respond directly except to acknowledge and redirect.

8.3 Where the Controller needs help beyond the self-service tools in clause 8.1, the Processor shall provide it within 5 working days of the Controller's request. This includes help with a data subject's complaint to the Controller under section 164A of the Data Protection Act 2018.

---

9. International transfers (Art 28(3)(a), Chapter V)

9.1 The Processor hosts the Controller's personal data in the United Kingdom (IONOS). The Processor shall not transfer the Controller's personal data outside the UK except as set out below, or on the Controller's instruction and under an appropriate transfer mechanism under UK GDPR Chapter V. The Controller authorises the following transfers by accepting this DPA:

9.2 Where a transfer relies on the UK Addendum or the UK International Data Transfer Agreement, the Processor shall carry out and keep a transfer risk assessment.

---

10. Breach assistance (Art 28(3)(f) and Art 33(2))

10.1 The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's personal data (Art 33(2)). Where not all the information is available at once, it may be provided in phases. The notification shall, as far as possible, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

10.2 The Processor shall assist the Controller in meeting the Controller's own obligations under Articles 32 to 36, including the Controller's obligation (where it applies) to notify the Commission within 72 hours under Article 33 and to notify affected data subjects under Article 34. The operational detail of this process is set out in the Processor's breach response procedure, available on request.

---

11. Deletion or return on termination (Art 28(3)(g))

11.1 On termination of the service, the Processor shall, at the Controller's choice, delete or return all the Controller's personal data and delete existing copies, unless domestic law requires storage of the personal data.

11.2 The Controller may export its data at any time during the term (clause 8.1, portability). On termination the Processor shall provide a final export window of 30 days before deletion.

11.3 Deletion extends to backups in accordance with the Processor's backup rotation. Backups are kept for 30 days on the server and for 90 days offsite, then deleted automatically. Until then, backups are used only to recover from a disaster, and if a backup is ever restored, earlier deletion instructions are applied again before the service resumes.

---

12. Audit and inspection (Art 28(3)(h))

12.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations in Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

12.2 To satisfy clause 12.1 the Processor may, in the first instance, provide its security documentation, its Record of Processing Activities, and responses to a reasonable security questionnaire, each party bearing its own costs. On-site or live-system inspection may be limited to once in any 12-month period, on 30 days' written notice, at the Controller's cost, and conducted so as not to compromise the security or confidentiality of other tenants' data. These limits do not apply to an inspection following a personal data breach affecting the Controller, or one required by the Commission.

---

13. Liability, governing law, order of precedence

13.1 This DPA is governed by the laws of England and Wales and subject to the same liability provisions, exclusions and caps as the Terms of Service, except where a liability cap cannot lawfully be applied to a data protection obligation. Nothing in this DPA or the Terms limits the rights of a data subject, or either party's liability to the Commission. The Processor's liability for its sub-processors under clause 7.3 is subject to that same cap.

13.2 If there is a conflict between this DPA and the Terms of Service in relation to the processing of the Controller's customer personal data, this DPA prevails.

---

Annex A: Type of personal data and categories of data subject

---

Annex B: Technical and organisational measures (Art 32)

The measures below are those in place at the date of this version.

• Tenant isolation: application-layer enforcement of salon_id scoping on all tenant queries; database Row-Level Security, enforced in production, on the core tenant tables (bookings, client profiles, services, staff, loyalty, vouchers and promotions, consultations, patch tests, client notes and health notes) as defence in depth.
• Encryption in transit: TLS/HTTPS enforced on all service subdomains.
• Encryption at rest: passwords are stored only as bcrypt hashes and OAuth tokens are encrypted at application level. The server's database volume is not encrypted at operating-system level (plain ext4, no disk encryption layer), and the hosting provider does not encrypt it either.
• Access control: separated platform and tenant authentication scopes; least-privilege access; bcrypt password hashing.
• Audit logging: access to client profiles, consultations, patch tests, health notes and data exports is logged with timestamp and actor (best-effort: a failed log write does not block the action), and retained for 12 months.
• Backups and recovery: automated daily database dumps with 30-day local retention; nightly offsite copy (since 2026-09-11); restore procedure documented and tested (restore drill passed 2026-09-11); backup-freshness monitoring. Recovery point objective: up to 24 hours. Write-ahead-log archiving / point-in-time recovery is not in place.
• Resilience: health checks, graceful shutdown, error monitoring.
• Breach detection: attempts to reach another tenant's data, and one staff member viewing an unusually large number of clients' health records in a short window, are detected and raised as alerts to the Processor through error monitoring and an operator notification channel. Error monitoring and access logging support investigation.
• Testing: test-gated deployments (continuous integration gates every production deploy). A breach tabletop exercise has not yet been run.

---

Annex C: Authorised sub-processors

See SUB_PROCESSORS.md for the maintained register (name, purpose, location, data categories). Current list: IONOS (hosting, email relay), Cloudflare (offsite backups, EU), Sentry (error monitoring, US), Stripe (subscription billing / tenant card payments, active since 2026-09-29), Twilio (outbound SMS, US, active since 2026-10-25). Planned, not engaged: Google (calendar sync), Anthropic (AI layer), and Meta (Twilio's WhatsApp sub-processor, pending WhatsApp).