Personal Data Processing Agreement (booking system)

This data processing agreement (the “Agreement”) is concluded in electronic form, in accordance with Art. 28(3) and (9) GDPR, between the salon owner using the Future Life online booking system (the “Controller” or the “Salon”) and Future by Life sp. z o.o., with its registered office in Szczecin, ul. Jana Kazimierza 11A lok. 6, 71-620 Szczecin, KRS 0001199212, NIP 9552591446 (the “Processor” or the “Company”). The Agreement is concluded when the acceptance box is ticked while creating the salon on the website and remains in force for as long as the booking system is used.

1. Subject matter and nature of processing

The Controller entrusts the Company with the processing of personal data for the purpose of providing the online booking system service: accepting and handling bookings, maintaining the calendar and client records, sending confirmations, reminders and requests for reviews (e-mail, SMS), the salon’s internal settlements (remuneration, rent, inventory) and statistics. The processing is continuous and takes place in the Company’s IT systems.

2. Type of data and categories of data subjects

• clients of the Salon: first and last name, telephone number, e-mail address, history and details of visits, the Salon’s notes, marketing consents, reviews; and – if the Salon enters them – information on contraindications and the course of treatments, which constitute data concerning health (Art. 9 GDPR);
• employees and associates of the Salon (including chair or station renters): first and last name, e-mail, role, schedule, remuneration terms entered by the Salon.

The Controller declares that it has a legal basis for processing the entrusted data, in particular the explicit consent of clients to the processing of health data (Art. 9(2)(a) GDPR) or another basis under Art. 9(2) GDPR, and that it fulfils the information obligation towards clients (Art. 13 GDPR). The Company makes available on the Salon’s booking page a template information notice on processing, which the Salon may supplement with its own text.

3. Obligations of the Processor

• processes data solely on the Controller’s documented instructions – use of the system’s functions by the Salon and its team and the settings entered in the panel are deemed to be instructions;
• ensures that persons authorised to process data have committed themselves to confidentiality;
• applies technical and organisational measures appropriate to the risk (Art. 32 GDPR): encryption of transmission (TLS), encrypted backups, role-based access control (owner / administrator / specialist / renter – a renter has no access to the Salon’s client database), an event log, separation of health data in the interface, and restriction of access to health data by the Company’s personnel to persons with a managerial role;
• engages only the sub-processors listed in section 5; informs the Controller of any intention to add or change a sub-processor at least 14 days in advance (by e-mail), giving the Controller the opportunity to object, which may result in termination of the Agreement;
• assists the Controller in fulfilling data subjects’ rights (access, rectification, erasure, portability) through panel functions: client search, editing of the client card, the “delete client’s personal data” function, and data export on request;
• assists in meeting the obligations under Art. 32–36 GDPR, including by notifying the Controller of a personal data breach without undue delay and no later than within 48 hours of becoming aware of it;
• after the end of the provision of the service – in accordance with the Controller’s decision – deletes or returns (export) all entrusted data, and deletes copies no later than 90 days after the end, unless Union or Polish law requires storage; deletion of the owner’s account results in immediate deletion of the salon’s data;
• makes available to the Controller the information necessary to demonstrate compliance with the obligations and allows for audits (including inspections) following prior agreement on the date, no more than once a year, unless a breach has occurred.

4. Obligations of the Controller

• enters into the system only the data necessary for the purpose (minimisation) and does not enter sensitive data without a legal basis;
• grants team members access appropriate to their role and withdraws it without delay once the cooperation ends;
• is responsible for the content of messages sent to clients (including for holding consents to marketing communication in accordance with Art. 398 of the Polish Electronic Communications Law);
• informs clients about the processing and about the use of the Future Life platform as a processor.

5. Sub-processors

• hosting provider (VPS servers in the European Economic Area) – infrastructure and backups;
• SMSAPI sp. z o.o., Poland – sending of SMS reminders (only the telephone number and the content of the reminder);
• the Company’s own mail server (EEA) – sending of e-mail messages;
• Cloudflare, Inc., USA – bot protection and content delivery (IP address, technical data) – transfer on the basis of the EU-U.S. Data Privacy Framework / standard contractual clauses;
• Stripe – only the Salon’s billing data (not the data of the Salon’s clients).

The Salon’s client data is not transferred to artificial intelligence providers or used by the Company for its own purposes.

6. Liability and final provisions

Each party is liable for damage caused by processing to the extent resulting from Art. 82 GDPR. The Company is not liable for the consequences of actions of the Salon’s users (e.g. entering data without a legal basis, sharing a login). The Agreement is governed by Polish law. Amendments to the Agreement require notifying the Controller 14 days in advance; continued use of the service constitutes acceptance of the amendments, and an objection gives rise to the right to terminate the Agreement and to have the data returned. The current version of the Agreement and the date of its acceptance are recorded in the salon panel.