Data Processing Agreement

Controller: The business that has created an account on Salonera and uses the platform to manage its clients and bookings.

Processor: Salonera, which processes personal data on behalf of the Controller to deliver the booking platform.

The Processor processes personal data solely to deliver the booking platform on behalf of the Controller. This includes: storing and displaying client information, handling appointment bookings, sending booking confirmations and reminders, and related technical operations.

Categories of data subjects: the Controller's clients (individuals who book or receive services). Types of personal data: name, email address, phone number, booking history.

The Controller is responsible for having a valid legal basis for the processing of client data, typically GDPR Art. 6(1)(b) (performance of a contract) or Art. 6(1)(f) (legitimate interest).

The Controller shall inform its clients about the processing and their rights, and ensure that data entered into the platform is accurate.

The Processor shall process personal data only on documented instructions from the Controller, unless processing is required by EU or Norwegian law.

The Processor shall ensure that persons authorized to process the personal data have committed to confidentiality.

The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of data in transit (TLS) and at rest, role-based access control, and regular review of security measures.

The Processor uses subprocessors listed on our subprocessor page. The Controller hereby grants general prior authorization for the use of subprocessors, provided that the Processor informs the Controller of changes and gives the Controller an opportunity to object.

The Processor shall ensure that all subprocessors are bound by equivalent data protection obligations through their own data processing agreements.

Some subprocessors are located outside the EEA (see the subprocessor list for details). Transfers to third countries are made under Standard Contractual Clauses (SCCs) pursuant to GDPR Art. 46(2)(c).

View the full subprocessor list

The Processor shall assist the Controller in fulfilling its obligation to respond to data subject requests for the exercise of rights under GDPR Chapter III (access, rectification, erasure, data portability, objection).

If the Processor receives a request directly from a data subject, the request shall be forwarded to the Controller without undue delay.

The Processor shall notify the Controller without undue delay, and no later than 36 hours, after becoming aware of a personal data breach.

The notification shall include: the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address the breach.

Upon termination of the agreement, the Processor shall, at the Controller's choice, delete or return all personal data and delete existing copies, unless retention is required by applicable law.

The Controller may export its client data at any time via the platform's export function (CSV export from the client overview).

The Controller has the right to conduct audits, including inspections, to verify that the Processor complies with this agreement. The Processor shall make necessary information available and contribute to such audits.

This Data Processing Agreement applies for as long as the Controller has an active account on Salonera. Upon termination, the provisions on deletion and return of data in section 8 apply.

This agreement is governed by Norwegian law. Disputes that cannot be resolved amicably shall be settled by the Oslo District Court.