draft-2026-10-10
Salon data processing agreement
Draft for Mohamed’s review. Not approved legal advice or an effective agreement.
Parties and status
Review draft under UK GDPR Article 28. The salon is the controller and the approved platform operating entity is the processor. The legal names, addresses, privacy contacts, effective date and authorised signatures must be completed before execution.
Processing schedule
Subject matter: hosted salon appointment and business administration. Duration: the service term followed by the approved return/deletion and backup-expiry period. Nature: recording, organising, storing, retrieving, displaying, transmitting through approved integrations and deleting on instruction. Purposes: bookings, service administration, authorised communications and reporting. Data subjects: salon clients, staff and authorised business contacts. Data: identity/contact details, appointment records, service choices, consent, communications and payment references. Special-category processing is excluded unless expressly documented and approved.
Documented instructions
The processor shall act only on the controller’s documented instructions, including for international transfers, unless UK law requires otherwise. It shall inform the controller of that legal requirement unless prohibited by law. It shall immediately tell the controller if an instruction appears to infringe applicable data protection law. The controller determines the purposes and lawful bases and provides the required notices.
Confidentiality and security
The processor shall ensure that authorised personnel are bound by confidentiality and have only the access needed for their duties. It shall maintain appropriate technical and organisational measures under Article 32. The final security schedule must describe access controls, tenant separation, encryption, logging, vulnerability management, incident handling, backups, recovery testing and retention controls without claiming unverified certifications or service levels.
Sub-processors
The processor shall not appoint a sub-processor without the agreed written authorisation. For general authorisation it shall give advance notice of additions or replacements and an opportunity to object. Equivalent data protection duties shall be imposed by contract; the processor remains responsible for the sub-processor’s performance. The actual register and notice/objection periods require approval.
Rights and assistance
Taking account of the nature of processing, the processor shall provide appropriate assistance with data subject requests and the controller’s duties under Articles 32 to 36, including security, breach notification, impact assessments and prior consultation. It shall direct requests to the controller unless authorised to respond, and shall not use them to create its own client relationship.
Personal data breaches
The processor shall notify the controller without undue delay after becoming aware of a personal data breach, provide available information about affected data, likely consequences and mitigation, and cooperate with investigation and required notifications. Incident contacts and escalation arrangements must be confirmed.
Transfers
Processing locations and remote access must be documented. Any restricted international transfer shall use an approved UK GDPR mechanism and the required assessment and supplementary measures. This draft does not assert that a particular transfer mechanism is already in place.
Return, deletion and audit
At the controller’s choice on termination, the processor shall return or delete the personal data and delete existing copies unless UK law requires retention. Backup expiry and any limited retention must be documented. The processor shall make compliance information available and allow and contribute to audits and inspections by the controller or an authorised auditor, under reasonable security arrangements that do not prevent the legal right.
Approval schedule
Before execution confirm the legal parties, lawful instructions, permitted data, retention and backup expiry, approved sub-processors and locations, transfer safeguards, security measures, incident contacts, audit arrangements and exit/export procedures. Review against current ICO guidance, including changes following the Data (Use and Access) Act.