Data processing agreement

1. Parties and subject

This agreement under Art. 28 GDPR forms part of the Lichio terms of service. The customer (salon) is the controller and the operator of Lichio is the processor. It applies for as long as the service is provided.

2. Nature and purpose

Running the salon's website, online booking, calendar and client records, and sending messages to the salon's clients and team.

3. Types of data and data subjects

• The salon's clients: name, phone, e-mail, bookings and visits, notes and tags entered by the salon, newsletter consent, account on the salon's website.
• The salon's team: name, e-mail, role, working hours and absences, records of sign-ins and changes.
• Technical data: IP address and usage logs.
• Special categories (for example health information such as allergies) may be entered in notes only where the salon has a legal basis for it.
• A client's Lichio account: only its link to the customer card at the salon; the account itself is Lichio's as the controller (see the privacy policy).

4. Processor obligations

• Process data only on the customer's instructions, given through the service's settings and use.
• Bind everyone with access to confidentiality.
• Take the technical and organisational measures in point 5.
• Help the customer respond to data subjects' requests.
• Report personal data breaches without undue delay, and no later than 48 hours after becoming aware of them.
• Provide the information needed to demonstrate compliance and allow audits by prior arrangement.
• Erasing clients' data after the retention period the customer sets (36 months after the last visit unless set) and erasing or handing it over on instruction at any time.

5. Technical and organisational measures

• Encrypted connections (HTTPS) and encrypted credentials for external services.
• Each salon's data separated at database level.
• Role-based access, personal accounts with no shared passwords, change logs.
• Daily backups stored in the EU.
• Regular server updates and restricted administrative access.

6. Sub-processors

The customer gives general authorisation for sub-processors. The current list is in the privacy policy. We announce changes in advance by e-mail; the customer may object and, in that case, cancel. Sub-processors are bound by the same obligations as we are.

7. International transfers

Data is transferred outside the EU only with safeguards under Chapter V GDPR, in particular standard contractual clauses.

8. End of processing

When the service ends, we hand the customer their data in a machine-readable format on request and delete it within 30 days. It leaves our backups within a further 30 days unless the law requires us to keep it.

9. Conclusion

An authorised person concludes this agreement for the customer together with the order and confirms it at the first sign-in to the app. We keep the version and the time of the acceptance.