Data Processing Agreement

Terms such as "personal data", "processing", "controller", "processor", "data subject", "sub-processor" and "personal data breach" have the meaning given to them in the GDPR.

• •Controller: the salon using Lean Salon. You determine the purposes and means of processing your clients' and staff's personal data.
• •Processor: Lean Salon (eenmanszaak, Pijnsweg 29, 6419 CH Heerlen, the Netherlands, KvK 42089738). We process that data on your instructions, to provide the service.
• •Sub-processor: a third party we engage to help deliver the service, who also processes personal data on our behalf (see section 5).

This DPA applies for as long as Lean Salon processes personal data on your behalf under our Terms of Service, from the start of your account until the data is deleted or returned in accordance with section 11.

We process personal data solely to provide the Lean Salon service: scheduling and managing appointments, processing payments, sending reminders and confirmations, responding to WhatsApp messages, showing marketing statistics from accounts you connect, and generating business insights for you as the salon.

We do not share contact details of your clients, such as names, email addresses or phone numbers, with AI providers. Before a WhatsApp message reaches the AI model behind our WhatsApp assistant, client names, email addresses, phone numbers and bank account numbers are automatically replaced by placeholders. The model receives the conversation with these placeholders, your services and opening hours, and details of the client's most recent appointment (treatment, day and staff member). Other information a client types in the chat is passed on as written. Other AI features work only with aggregated business figures or supplier and product information, never with data of individual clients. We may use different AI providers and may change provider over time; see section 5.

• •Categories of data subjects: your clients, and your staff members with a Lean Salon login.
• •Categories of personal data: name, email address, phone number, date of birth (if you record it), appointment history, payment status, notes you add about a client, and message content exchanged via our WhatsApp assistant.
• •Special categories of personal data: we do not require or expect you to enter special categories of personal data (for example health data) into free-text fields, and ask you not to do so beyond what is strictly necessary for providing your services.

We will:

• •Process personal data only on your documented instructions, including regarding international transfers, unless required to do otherwise by EU or member state law.
• •Ensure that people authorised to process personal data are bound by confidentiality.
• •Implement appropriate technical and organisational security measures, as described in section 8.
• •Assist you, as far as reasonably possible, in responding to requests from data subjects exercising their GDPR rights (access, rectification, erasure, restriction, portability, objection).
• •Assist you in meeting your own obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments), taking into account the nature of processing and the information available to us.
• •Delete or return all personal data at the end of the provision of services, as described in section 11.
• •Make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for audits as described in section 10.

You give us general authorisation to engage the following sub-processors, each bound by their own data processing agreement with us. Each receives only the data it needs for its task:

• •Microsoft Azure: hosting, infrastructure and login (Microsoft Entra), in the Northern Europe region. Stores all data in Lean Salon.
• •Mollie: payment processing. Receives the payment details needed for a payment, such as amount, description and payment method.
• •Mailgun: sending and receiving email. Receives email addresses, names and the content of emails we send or receive on your behalf.
• •Meta (WhatsApp Business Platform): WhatsApp messaging. Receives your clients' phone numbers, WhatsApp profile names and the content of WhatsApp messages, including reminders and confirmations (for example first name, treatment and time) and, where relevant, the email address a client uses for a booking or gift voucher. Meta does not receive dates of birth from Lean Salon.
• •Google (Gemini), OpenAI, Anthropic (Claude) and Mistral AI: AI processing as described in section 3, without client contact details.

If we intend to add or replace a sub-processor, we will inform you in advance (for example by email or a notice in the dashboard). You may object on reasonable data protection grounds within a reasonable period after notice; if we cannot address your objection, either party may terminate the affected part of the service.

We aim to host and process data within the European Economic Area (EEA). Our hosting infrastructure (Microsoft Azure) runs in the Northern Europe region.

Some of our sub-processors (including OpenAI and Anthropic, both based in the United States) are located outside the EEA. For these, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

We use industry-standard technical and organisational measures to protect personal data, consistent with our Privacy Policy:

• •Hosting with Microsoft Azure (Northern Europe region), with encryption of data in transit (TLS) and at rest.
• •Passwords, API keys and other secrets are never stored in source code, but managed via Azure Key Vault.
• •Access to Azure resources uses Managed Identity, avoiding long-lived credentials that could leak.
• •Strict separation of data between salons at the database level (Row-Level Security), so that one salon's data is never accessible to another salon.
• •Role-based access within your own dashboard (for example owner versus staff member), and a record of changes to client data.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and in any case within 48 hours of becoming aware, so you can meet your own obligation to notify the competent data protection authority within 72 hours where required. Our notification will include what we know at that time about the nature of the breach, the likely consequences, and the measures taken or proposed.

On reasonable written request, we will make available relevant documentation to demonstrate our compliance with this DPA. We allow for an audit, including inspections, once per calendar year with reasonable advance notice, or promptly following a confirmed personal data breach. Audits are carried out in a way that avoids unreasonable disruption to our operations and other customers, and reasonable costs may be agreed in advance.

Upon termination of your use of Lean Salon, we will, at your choice, delete or return all personal data processed on your behalf, and delete existing copies, unless EU or member state law requires us to retain the data (for example invoice data under the applicable tax retention rules; see our Privacy Policy for specific retention periods).

Liability under this DPA is governed by the limitation of liability clause in our Terms of Service.

This DPA is governed by the same law and jurisdiction as our Terms of Service.

Questions about this DPA? Email us at legal@leansalon.com.