Data Processing Agreement (DPA)

1. Parties and conclusion

This data processing agreement (the "DPA") is concluded between the Salon as controller and the SalonGo Operator as processor under Article 28 of Regulation (EU) 2016/679 (GDPR).

The DPA forms part of the Terms of Service and is concluded when the Salon registers. It applies for as long as the Service is used and until data is deleted under section 10.

2. Subject matter, nature and purpose

The processor stores and processes personal data the Salon puts into the Service in order to provide it: calendar and bookings, client records, checkout and receipts, payroll, reports, reminders and messages to clients on the Salon's instruction, backups and support.

3. Categories of data subjects and data

Data subjects: the Salon's clients, staff and contractors.

Data: name, phone, email, date of birth, booking and service history, payments and receipts, notes, photos, loyalty data; for staff also role, revenue, commission, wages and tips.

Special categories (e.g. health data such as allergies) only if entered by the Salon. The Salon is responsible for having a legal basis under Article 9 GDPR.

4. Controller's instructions

The processor processes data only on the Salon's documented instructions: this DPA, the Terms of Service and the settings and actions the Salon makes in the Service.

If the processor considers an instruction unlawful, it will inform the Salon.

The processor does not use the data for its own purposes, but may create anonymised aggregate statistics that are not personal data.

5. Confidentiality and security

Persons authorised to process data are bound by confidentiality.

The processor implements technical and organisational measures under Article 32 GDPR, including: encrypted transfer (HTTPS/TLS), hashed passwords, logical separation of salons' data, role-based access, minimal operator access, regular backups, access logging and regular software updates.

6. Sub-processors

The Salon gives general authorisation for sub-processors. Current list:

• Vercel Inc. – hosting (EU, Frankfurt),
• Neon Inc. – database (AWS, Frankfurt),
• Resend (Plus Five Five Inc.) – emails to clients and users,
• Google Ireland Ltd. / Firebase Cloud Messaging – push notifications,
• Functional Software Inc. (Sentry) – error reporting,
• Stripe Payments Europe Ltd. – payments (if the Salon uses payments through the Service).

The processor will inform the Salon by email or in the app at least 14 days before adding or replacing a sub-processor. The Salon may object on reasonable grounds; if no agreement is reached, the Salon may terminate and receive the proportional part of the paid period.

The processor imposes equivalent data protection obligations on sub-processors and remains responsible for their compliance.

Transfers outside the EU rely only on an adequacy decision (e.g. EU-US Data Privacy Framework) or Standard Contractual Clauses.

7. Assistance with data subject rights

The Service lets the Salon find, correct, export and delete data. If the Salon cannot handle a request itself, the processor provides reasonable assistance on request.

If the processor receives a request directly, it forwards it to the Salon and does not handle it unless authorised.

8. Personal data breaches

The processor notifies the Salon of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information available under Article 33(3) GDPR, so the Salon can meet its notification duty.

9. Further assistance and audits

The processor provides reasonable assistance with data protection impact assessments (DPIA) and prior consultation with the supervisory authority.

The processor provides information needed to demonstrate compliance with this DPA. Audits require 30 days' written notice, at most once a year, during business hours, without disrupting operations and without access to other salons' data; the Salon bears the costs unless a material breach is found.

10. Termination: return and deletion

After termination, the Salon may export its data within 30 days or request it in a common machine-readable format. The processor then deletes the data; backups are cleared within a further 90 days at the latest, unless the law requires retention.

11. Liability and governing law

Liability is governed by Article 82 GDPR and the Terms of Service.

This DPA is governed by Czech law. In case of conflict with the Terms of Service on data protection, this DPA prevails.