Agreement between The Salon Suite (data processor) and the salon operator (data controller) pursuant to UK GDPR Article 28.
Last updated: 24 March 2026Data Controller ("Controller"): The salon operator who registers for and uses The Salon Suite (identified by the Account holder's details).
Data Processor ("Processor"): The Salon Suite, trading as "The Salon Suite", with registered office at [Your Address], and ICO Registration Number [Your ICO Number].
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service between the Controller and the Processor. By using the Service, the Controller agrees to the terms of this DPA.
In this DPA, the following terms have the meanings set out below. Terms not defined here have the meanings given to them in the UK GDPR or the Terms of Service.
2.1. The Processor shall process Personal Data solely for the purpose of providing the salon management Service to the Controller, as described in the Terms of Service.
2.2. The subject matter and duration of the processing, the nature and purpose of the processing, the type of Personal Data and categories of Data Subjects are as follows:
Subject matter: Processing of Personal Data entered into or generated by the Salon Suite web application in the course of the Controller's salon management activities.
Duration: For the duration of the Controller's subscription to the Service and for up to thirty (30) days following termination, plus an additional thirty (30) days for deletion from backups, unless a longer period is required by UK law.
Nature and purpose of processing: Collection, storage, organisation, retrieval, consultation, use, transmission, and deletion of Personal Data in order to provide salon management functionality, including appointment management, client records, colour formulas, consultation records, client communications, and related business analysis and reporting.
Types of Personal Data: Names, contact details (email address, phone number, postal address), appointment history, service history, colour formulas, consultation notes, marketing preferences, and, where recorded by the Controller, limited health or allergy information relating to hair and beauty services.
Categories of Data Subjects: The Controller's salon clients and prospective clients; the Controller's staff members who are set up as users within the Service; and the Controller as account holder.
2.3. The Processor shall not process Personal Data for any purpose other than those specified in this DPA, unless required to do so by United Kingdom law, in which case the Processor shall inform the Controller of that legal requirement before processing (unless the law prohibits such information on important grounds of public interest).
The Processor shall:
Process Personal Data only on the documented instructions of the Controller (which are set out in this DPA, the Terms of Service and any subsequent written instructions), including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by United Kingdom law. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the UK GDPR or other UK data protection provisions.
Ensure that all persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This includes all employees, contractors and agents of the Processor who may have access to Personal Data in the course of their duties.
Implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by UK GDPR Article 32, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects. These measures are detailed in Section 7 of this DPA.
Not engage another processor (sub-processor) without prior specific or general written authorisation of the Controller, and comply with the requirements set out in Section 5 of this DPA.
Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from Data Subjects exercising their rights under Chapter III of the UK GDPR (access, rectification, erasure, portability, restriction and objection). See Section 9 of this DPA.
Assist the Controller in ensuring compliance with the obligations pursuant to UK GDPR Articles 32 to 36, taking into account the nature of processing and the information available to the Processor. This includes assistance with:
At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of the Service, and delete existing copies unless United Kingdom law requires storage of the Personal Data. The Controller may request data export at any time during the subscription and for thirty (30) days following termination. After this period, the Processor shall permanently delete all Personal Data, including from backup systems, within thirty (30) additional days.
Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in UK GDPR Article 28 and this DPA, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller. See Section 11 of this DPA.
The Controller shall:
The Controller provides general written authorisation for the Processor to engage the following sub-processors for the purposes specified:
| Sub-processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase, Inc. | Database hosting, authentication, data storage | All Client Data, Account Data | EU (Frankfurt) / US |
| Vercel, Inc. | Application hosting and content delivery | IP addresses, usage data (transient) | Global CDN (US, EU) |
| Stripe, Inc. | Payment processing for subscriptions | Billing data (not Client Data) | US / EU |
| Resend, Inc. | Transactional email delivery (appointment reminders, notifications) | Client email addresses, email content | US |
| Twilio, Inc. | SMS delivery (appointment reminders) | Client phone numbers, SMS content | US |
The Processor shall notify the Controller in writing (via email to the address associated with the Controller's Account) at least thirty (30) days before engaging any new sub-processor or replacing an existing sub-processor. The notification shall include the name of the sub-processor, the processing activities to be carried out, and the location of processing.
The Controller shall have the right to object to the appointment of a new sub-processor on reasonable data protection grounds by notifying the Processor in writing within fourteen (14) days of receiving the notification. If the Controller objects and the Processor cannot reasonably accommodate the objection, either party may terminate the affected Service by providing thirty (30) days' written notice.
The Processor shall:
6.1. The Processor acknowledges that certain sub-processors listed in Section 5 are located outside the United Kingdom. Where Personal Data is transferred to a country outside the UK that has not received an adequacy decision from the Secretary of State, the Processor shall ensure that appropriate safeguards are in place in accordance with UK GDPR Article 46, including:
For such transfers, the Processor shall put in place appropriate safeguards in accordance with UK GDPR Article 46, including the ICO International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures.
6.2. The Processor shall conduct transfer impact assessments for each international transfer, evaluating the legal framework of the recipient country and any supplementary measures necessary to ensure an essentially equivalent level of protection.
6.3. The Processor shall inform the Controller if it becomes aware of any change in circumstances that may affect the lawfulness or adequacy of safeguards for international transfers, and shall cooperate with the Controller to implement additional safeguards if necessary.
6.4. Copies of the relevant transfer mechanisms are available upon request by emailing hello@thesalonsuite.uk.
7.1. In accordance with UK GDPR Article 32, the Processor implements and maintains the following technical and organisational security measures:
7.2. The Processor shall regularly test, assess and evaluate the effectiveness of these measures and shall update them as necessary to reflect changes in technology, threats, and the nature of the Personal Data processed.
8.1. The Processor shall notify the Controller of any Data Breach without undue delay and in any event within twenty-four (24) hours of becoming aware of the breach.
8.2. The notification shall include, to the extent available at the time of notification:
8.3. Where it is not possible to provide all information at the time of initial notification, the Processor shall provide the information in phases without further undue delay as it becomes available.
8.4. The Processor shall cooperate with the Controller and take commercially reasonable steps to assist in the investigation, mitigation and remediation of the Data Breach.
8.5. The Processor shall document all Data Breaches, including the facts relating to the breach, its effects and the remedial action taken, in accordance with UK GDPR Article 33(5).
8.6. The 24-hour notification period under this DPA is designed to give the Controller sufficient time to meet their own obligation to notify the ICO within 72 hours of becoming aware of a breach (UK GDPR Article 33(1)).
9.1. If the Processor receives a request directly from a Data Subject exercising their rights under UK GDPR Chapter III (including rights of access, rectification, erasure, restriction, portability and objection), the Processor shall promptly notify the Controller and shall not respond to the request directly unless authorised to do so by the Controller or required by law.
9.2. The Processor shall assist the Controller in fulfilling Data Subject requests by:
9.3. The Processor may charge a reasonable fee for assistance with Data Subject requests that are manifestly unfounded, excessive or require substantial bespoke technical work beyond the Service's standard functionality.
10.1. The Processor shall provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (DPIAs) under UK GDPR Article 35, where the Controller's use of the Service is likely to result in a high risk to the rights and freedoms of Data Subjects.
10.2. The Processor shall provide the Controller with such information about the Processing as may be reasonably necessary for the Controller to carry out a DPIA, including information about the Processor's security measures, sub-processors and data flows.
10.3. Where a DPIA indicates that prior consultation with the ICO is required under UK GDPR Article 36, the Processor shall cooperate with the Controller and the ICO as necessary.
11.1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in UK GDPR Article 28 and this DPA.
11.2. The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent third-party auditor mandated by the Controller, subject to the following conditions:
11.3. The Processor may satisfy audit requirements by providing:
11.4. Audits shall be limited to once per twelve-month period, unless a Data Breach has occurred or the Controller has reasonable grounds to believe the Processor is in breach of this DPA.
12.1. This DPA shall commence on the date the Controller creates an Account and shall continue for the duration of the Controller's use of the Service.
12.2. This DPA shall automatically terminate when the Controller's subscription ends and all Personal Data has been deleted or returned in accordance with Section 3.7.
12.3. Obligations in this DPA that by their nature should survive termination shall continue to apply after termination, including Sections 3.2 (Confidentiality), 3.7 (Deletion or Return of Data), 8 (Data Breach Notification) and 13 (Governing Law).
12.4. Upon termination:
13.1. This DPA is governed by and construed in accordance with the laws of England and Wales.
13.2. Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.
13.3. In the event of any conflict between the terms of this DPA and the Terms of Service, the terms of this DPA shall prevail with respect to data protection matters.
For any questions regarding this Data Processing Agreement or data protection matters, please contact: