Data Processing Addendum
1. Parties and roles
Customer determines which authorized users and technician information are submitted and why the salon uses the Service. For that Customer Data, Customer acts as the controller, business, or equivalent responsible party under applicable privacy law, and Salon Standard Pro acts as processor, service provider, or equivalent. Each party remains independently responsible for personal data it controls for its own account administration, billing, security, and legal purposes.
2. Processing instructions
Salon Standard Pro will process Customer Personal Data only to provide, secure, maintain, support, and improve the subscribed Service; comply with documented Customer instructions consistent with the agreement; and comply with applicable law. The Terms, Customer’s use and configuration of the Service, support requests, and lawful written directions are documented instructions. We will notify Customer if we believe an instruction violates applicable privacy law, unless prohibited from doing so.
We will not sell Customer Personal Data, share it for targeted advertising, retain or use it outside the business relationship except as permitted by law, or combine it with personal data received from unrelated customers except as allowed for security, fraud prevention, or properly de-identified analytics.
3. Customer responsibilities
Customer will provide required privacy notices, obtain necessary permissions, limit data to what is relevant, configure access appropriately, and respond to its personnel’s requests. Customer will not instruct us to process prohibited or unnecessary high-risk data, including client medical records, Social Security numbers, or full payment credentials.
4. Confidentiality and security
We will restrict Customer Personal Data to personnel and providers who need it and are subject to confidentiality obligations. We maintain reasonable safeguards appropriate to the Service, including authentication, role and tenant access controls, encrypted transport, private file storage, database access policies, security logging, backup controls, vulnerability and provider management, and incident-response procedures. Customer is responsible for credential security, shared-device controls, user removal, and authorized access within its salon.
5. Subprocessors
Customer authorizes Salon Standard Pro to use subprocessors for hosting, database, authentication, file storage, security, content delivery, support, email, notification, and related operations. Core providers may include Supabase, Cloudflare, Zoho, and payment or communications providers used for the relevant function. We will require subprocessors that process Customer Personal Data to protect it through written obligations appropriate to their services. We remain responsible for our obligations under this Addendum.
Customer may object to a new subprocessor on reasonable data-protection grounds by emailing us promptly after notice. We will work in good faith on a commercially reasonable solution. If none is available, either party may discontinue the affected feature or Service.
6. Individual requests and compliance assistance
If we receive a privacy request relating solely to Customer Personal Data, we may direct the requester to Customer. Taking into account the nature of processing, we will provide reasonable assistance for access, correction, deletion, portability, appeals, data-protection assessments, and regulator inquiries when required by applicable law. Customer is responsible for evaluating and responding to the request. Extraordinary assistance may be charged at a mutually agreed rate where law permits.
7. Security incidents
We will notify Customer without undue delay after confirming unauthorized acquisition of or access to Customer Personal Data that requires notice under applicable law. Notice will include available information reasonably needed for Customer to understand the incident and meet its obligations. We will investigate, mitigate, and provide reasonable updates. Notice is not an admission of fault. Incidents caused solely by Customer credentials, devices, or instructions remain Customer’s responsibility, but we will reasonably assist.
8. Government requests
Unless legally prohibited, we will notify Customer of a binding government demand specifically seeking Customer Personal Data and will disclose only what we reasonably believe is legally required.
9. Return and deletion
During an active account, Customer may use available export functions to obtain supported records. Cleaning logs follow the rolling 90-day retention period described in the Privacy Policy. After termination, we will delete or de-identify remaining Customer Personal Data under our operational retention and backup schedules unless law requires retention. Customer should export required records before cancellation or expiration. Encrypted backup copies may remain until normal rotation and will remain protected from routine use.
10. Information and audits
On reasonable written request, we will provide information reasonably necessary to demonstrate compliance with this Addendum, such as relevant policies, system descriptions, or third-party assurance materials then available. If that is insufficient and applicable law requires an audit, the parties will agree on a narrowly scoped, confidential review that avoids exposing other customers’ data or creating security risk. Customer bears its audit costs unless the audit identifies a material breach by us.
11. International processing
The Service is currently designed for United States operations and processing. Customer will contact us before using the Service in a way that requires an international data-transfer mechanism or foreign-law addendum.
12. Processing details
| Subject matter | Providing salon pedicure compliance, records, document, notification, and support software |
|---|---|
| Duration | The subscription term plus the retention and deletion periods described in the agreement |
| Nature and purpose | Collection, storage, organization, retrieval, display, export, support, security, backup, and deletion as needed to provide the Service |
| People | Salon owners, managers, technicians, contractors, and other authorized users |
| Data types | Names, business contact information, professional license information, roles, schedules, salon records, user activity, support content, screenshots, device and security information |
| Special data | Not intentionally required. Customer must not submit medical records, Social Security numbers, full payment credentials, biometric templates, or other unnecessary sensitive data |
13. Priority and contact
If this Addendum conflicts with the Terms on processing Customer Personal Data, this Addendum controls. All other Terms remain effective. Questions and written instructions may be sent to info@salonstandardpro.com.