Data processing agreement

This Data Processing Agreement (DPA, Art. 28 GDPR) is part of the terms of use of AllBooking. Parties: the salon is the controller of data about its own clients and employees; Intseo7 OÜ (registration code 14238521, address: Sutste 50-17) is the processor that processes this data on behalf of the salon.

1. Subject and purposes

The processor stores and processes data in order to provide the salon with the service: online booking, calendar, client cards, the salon's website, notifications to clients and employees, reports. Processing lasts as long as the terms of use are in effect.

2. Data and data subjects

• salon clients: name, phone, e-mail, language, bookings and their history, salon notes, consents;

• salon employees: name, contacts, position, schedule, photo, if the salon added it;

• visitors to the salon's website who write via the form: name, contacts, message text.

The salon does not enter special categories of data (for example, health information) into the service, except where this is directly necessary for the service and lawful.

3. Obligations of the processor

• process data only on documented instructions from the salon; these are considered to be these terms and the salon's actions in the cabinet;

• allow access to data only to persons who are obliged to keep it confidential; support sees the salon's data only through temporary access with a stated reason, which is recorded in a log;

• apply security measures: encryption of connections and secrets, access control, two-factor login, audit log, backups;

• help the salon respond to client requests: export of client data and its anonymization are available in the cabinet;

• notify the salon of a data breach without undue delay, and no later than 48 hours after its discovery, and help with assessing the consequences.

4. Subprocessors

The salon gives a general authorization to engage subprocessors. The processor enters into contracts with them with the same data protection obligations and informs the salon in advance of new subprocessors; the salon may object and refuse the service. Current list:

• hosting provider — application servers and databases in the EU;

• file storage (S3-compatible) — logos, photos, documents;

• SMTP2GO — sending emails;

• Cloudflare — DNS, attack protection, Turnstile verification, connecting salon domains;

• Sentry — application error reports;

• AI service (Groq or Anthropic) — translation and generation of the salon's public texts; clients' personal data is not transferred there;

• Stripe, PayPal, EveryPay — subscription payments;

• Vonage — SMS notifications, if the salon connected its own Vonage account.

If a subprocessor is located outside the EEA, transfers are made under the European Commission's standard contractual clauses or another basis under Chapter V GDPR.

5. End of processing

The salon is deleted at the salon's request, upon termination of the contract, or as inactive under the terms of use. After the salon is deleted, data is erased after 30 days (during this time deletion can be cancelled and data exported); from backups, upon their rotation, no later than a further 30 days. Platform invoices are kept as long as accounting law requires.

6. Audits

Upon the salon's request, the processor provides the information necessary to verify compliance with this agreement. An on-site inspection is possible subject to prior arrangement and at the salon's expense. Contact: [email protected].