Data processing agreement

This data processing agreement ("DPA") forms part of the terms of service between AI Programs Holdings Ltd, a company registered in England and Wales with company number 17516543, whose registered office is at 128 City Road, London, EC1V 2NX, trading as Salonly ("we", "us") and the salon or business that uses Salonly ("you"). You accept it when you accept the terms. It sets out how we handle personal data on your behalf, as Article 28 of the UK GDPR requires.

1. Meaning of words

1.1 "Data protection law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other UK law about personal data that applies, as amended from time to time.

1.2 "Customer personal data" means personal data that we process on your behalf when providing Salonly. It is mainly the personal data of your clients, the people who book with you or call you, and your team, as set out in Annex 1.

1.3 "Health data" means personal data about a person's health, such as allergies, skin conditions, medical conditions, medication, patch-test answers and results, and consultation answers. It is special category data under Article 9 of the UK GDPR.

1.4 "Controller", "processor", "personal data", "personal data breach", "processing" and "data subject" have the meanings given in the UK GDPR. "Sub-processor" means another processor we engage to process customer personal data.

2. Roles

2.1 For customer personal data, you are the controller and we are your processor.

2.2 You are responsible for having a lawful basis for the processing, for telling your clients and callers how their data is used (for example in a privacy notice on your website and the recording notice in your front desk's greeting), and for the instructions you give us.

2.3 For marketing messages to your clients, you are responsible for having their consent or meeting the conditions of the "soft opt-in" under the Privacy and Electronic Communications Regulations. Salonly records the choice clients make when they book online. For clients you import or add yourself, you are responsible for any choice you record.

2.4 For health data, you are responsible for having a condition under Article 9 of the UK GDPR. For a salon or clinic this will normally be the client's explicit consent, which you must ask for and record before you add health data to their record. Only record the health data you need for the treatment.

2.5 We are a controller, not a processor, for the personal data we need to run your account, bill you and keep the service secure. Our privacy policy covers that.

3. Your instructions

3.1 We process customer personal data only on your documented instructions. Your instructions are: the terms of service, this DPA, the way you set up and use the service (for example your services, booking settings, message settings, front desk answers and call handling, and any connections to other systems), and any other reasonable written instructions you send us that are consistent with them. This includes transfers outside the UK as described in section 7.

3.2 If UK law requires us to process customer personal data in another way, we will tell you before we do, unless the law forbids us from telling you.

3.3 We will tell you straight away if we think an instruction breaks data protection law.

3.4 We do not use customer personal data for our own purposes. We do not sell it, we do not send your clients marketing of our own, and we do not use it to train our own AI models.

4. Our people

Everyone we authorise to process customer personal data is bound by a duty of confidentiality, whether by contract or by law, and has access only as far as their work needs.

5. Security

5.1 We take appropriate technical and organisational measures to protect customer personal data, as Article 32 of the UK GDPR requires. Annex 2 describes them.

5.2 We may update these measures as long as the overall level of protection does not go down.

6. Sub-processors

6.1 You give us general written authorisation to use the sub-processors listed in Annex 3.

6.2 We will tell you by email at least 30 days before we add or replace a sub-processor. You may object on reasonable data protection grounds within that time. If we cannot address your objection, you may end the agreement before the change takes effect and we will refund any fees you have paid in advance for the period after it ends.

6.3 We put a written contract in place with each sub-processor that gives customer personal data at least the protection this DPA requires. We remain responsible to you for our sub-processors' performance of those obligations.

6.4 Deposits are taken through your own Stripe account, under your own agreement with Stripe. For those payments Stripe acts under its agreement with you; we pass Stripe only what it needs to take the deposit, such as the client's name, email address and the booking.

7. Transfers outside the UK

7.1 Our servers and database are hosted in the United Kingdom. Some sub-processors process customer personal data outside the UK, mainly in the United States and the European Economic Area, as Annex 3 shows.

7.2 We only make those transfers with a safeguard that UK data protection law recognises: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, known as the UK-US data bridge, for recipients certified to it), or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses issued under section 119A of the Data Protection Act 2018. You can ask us for a copy of the relevant safeguard.

8. Helping you with people's rights

8.1 If someone asks us to exercise their data protection rights about customer personal data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to.

8.2 Your dashboard lets you find, read, correct and export a client's record, and record when a client stops marketing messages. Where you need more, for example deleting a client's data from our systems, we will help you within a reasonable time, taking into account the nature of the processing.

9. Helping you with your other obligations

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations on security, personal data breaches, data protection impact assessments and consulting the Information Commission (the UK regulator, known as the ICO).

10. Personal data breaches

10.1 We will tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting customer personal data.

10.2 We will give you the information you need to meet your own obligations, as far as it is available to us: what happened, the categories and rough numbers of people and records affected, the likely consequences and what we have done or plan to do. We will add to it as we learn more, take reasonable steps to contain the breach and work with you on next steps.

11. When the service ends

11.1 You can export your clients, appointments and records at any time while your subscription runs. When it ends, we stop processing customer personal data except to store it until it is deleted. If you want a copy after it ends, ask us within 90 days and we will provide one in a common format.

11.2 We delete customer personal data from our systems 90 days after your subscription ends, unless UK law requires us to keep it. Copies in our backups are deleted within a further 14 days, as the backups roll over.

11.3 Front desk call audio, and our voice provider's copy of each transcript, are deleted by that provider 90 days after each call in any case, while your subscription is running.

12. Showing that we comply

12.1 We will make available to you the information reasonably needed to show that we meet our obligations under Article 28 of the UK GDPR.

12.2 We will allow for and contribute to audits, including inspections, by you or an auditor you appoint who is bound by confidentiality. You must give us at least 30 days' notice, keep audits to normal working hours and to once a year (unless a regulator requires more, or after a personal data breach), and pay your own costs. We may first answer with written information, and only arrange an inspection if that is not enough to show compliance.

13. Liability and length

13.1 Each of us is liable for our own breaches of data protection law. The limits of liability in the terms of service apply to this DPA, except where the law does not allow them to.

13.2 This DPA lasts for as long as we process customer personal data.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption in transit: all connections to Salonly, and between Salonly and our sub-processors, use TLS (HTTPS). Webhooks we receive are checked with signatures.
• Access to accounts: you and your team sign in with single-use email links that expire quickly; two-step sign-in is available to every customer. Sessions use secure, HTTP-only cookies.
• Access by our staff: only staff who need it can reach the back office, and they must use two-step sign-in. Administrative actions are recorded in an audit log, kept for two years.
• Separation between customers: every request is checked against the account it belongs to, so one salon cannot see another's clients or data.
• Health data: recorded only where you confirm the client's explicit consent, and shown only to signed-in members of your own team.
• Payments: card details are entered on Stripe's pages and never reach our servers.
• Secrets: sign-in secrets and keys are encrypted or kept out of the database, and never sent to the browser.
• Abuse protection: public pages and endpoints, including booking pages, are rate limited, and suspicious use can be blocked.
• Retention: data is deleted automatically on a fixed schedule, as set out in our privacy policy and in section 11.
• Backups: the database is backed up daily on our UK server and backups are kept for 14 days, with access limited to administrators.
• Monitoring: the service is monitored for availability and security problems.
• Suppliers: we use established sub-processors with their own data processing terms and security programmes, listed in Annex 3.

Annex 3: Sub-processors

ElevenLabs also uses suppliers of its own, such as its cloud hosts, under its contract with us. Its full list is at compliance.elevenlabs.io/subprocessors.