Data processing agreement
This data processing agreement (“DPA”) is part of the terms for salons. It meets the requirements of article 28 of the General Data Protection Regulation (GDPR). The salon accepts it when it opens its ZalonFlow account, before any customer data is processed. We record which version was accepted, by whom and when.
1. Parties and roles
The salon that uses ZalonFlow is the controller. NFlow Solutions (KVK 73838306, Gretha Hofstralaan 64, 3136 LS Vlaardingen, the Netherlands), which provides ZalonFlow, is the processor. Words such as “personal data”, “processing” and “personal data breach” have the meaning they have in the GDPR.
2. Subject and duration
We process personal data only to provide ZalonFlow to the salon, as described in Annex 1. This DPA runs as long as we process personal data for the salon.
3. Instructions
- We process personal data only on the salon's documented instructions. The salon's settings and actions in ZalonFlow, these terms and this DPA are those instructions.
- We do not use the salon's data for our own purposes. We act as controller only for what we need to run the service safely: billing the salon, security logs and short-lived abuse protection (see our privacy policy).
- If the law requires us to process data in another way, we tell the salon first, unless the law forbids that.
- If we think an instruction breaks the GDPR, we tell the salon.
4. Confidentiality
Everyone who works for us and can access the salon's data is bound to confidentiality. Our team opens a salon's admin only for support or when the salon asks, and each such access is recorded in the audit log.
5. Security
We take appropriate technical and organisational measures to protect the data, as described in Annex 2. We may improve these measures, as long as the level of protection does not go down.
6. Sub-processors
- The salon gives general permission for the sub-processors in Annex 3.
- We tell the salon by email at least 30 days before we add or replace a sub-processor. The salon may object for a good reason; if we cannot solve the objection, the salon may end the agreement before the change takes effect.
- Each sub-processor is bound by data protection obligations at least as strict as this DPA. We remain responsible for them.
7. Transfers outside the EEA
The database is in the European Union. Where a sub-processor processes data outside the European Economic Area, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission's standard contractual clauses.
8. Helping the salon
- Requests from people: ZalonFlow gives the salon tools to see, correct, export and anonymise a customer's data. If a person contacts us directly, we pass the request to the salon without delay and do not answer it ourselves, unless the salon asks us to.
- Other obligations: we help the salon, as far as reasonable, with security, data protection impact assessments and questions from the supervisory authority.
9. Personal data breaches
If we discover a personal data breach that affects the salon's data, we inform the salon without undue delay and no later than 48 hours after we discovered it. We tell the salon what happened, which data and people are affected, the likely consequences and what we are doing about it, and we keep the salon updated. The salon decides whether to notify the authority and the people involved.
10. End of the agreement
After the agreement ends, the salon chooses: it can export its data and ask us to delete it at once, or use the default period of 90 days to export it. After that we delete or anonymise the personal data. Backups are overwritten within 30 days. Records that the salon must keep by law, such as bookkeeping records, are kept for the legal period (7 years) without customer names where possible and are then removed.
11. Audits
We give the salon the information it needs to show that this DPA is met. The salon may have an audit carried out, at its own cost, at most once a year and with at least 30 days' notice, by an independent auditor bound to confidentiality. An extra audit is possible after a personal data breach or when the supervisory authority asks for one. The audit must not disturb our service or reveal other salons' data.
12. Liability and order of documents
The liability rules of the terms for salons apply to this DPA. If this DPA and the terms disagree about personal data, this DPA applies. Dutch law applies. If the English, Dutch and Thai versions differ, the English text applies.
Annex 1: Processing details
| People | Personal data | Purpose | Kept |
|---|---|---|---|
| Customers of the salon | Name, email, phone number, language, bookings and visit history, notes written by the salon, amounts paid | Appointments, reminders, the salon's customer file | Until the salon's retention period after the last visit (default 24 months), then anonymised automatically |
| Customers who pay online | Amount, payment method, Stripe payment reference (no card numbers) | Payments, deposits, refunds | 7 years, with the bookkeeping |
| Buyers and recipients of gift vouchers and packages | Name, email, message, code, balance | Selling and redeeming vouchers and packages | Until the voucher or package expires, and the sale for 7 years |
| Customers on receipts and invoices | Name and, for business customers, company details | Receipts, invoices, daily close | 7 years, then removed |
| Customers and staff who receive messages | Email address or phone number and the message | Confirmations, reminders and notices by email, and by WhatsApp only to people whose agreement the salon recorded | Email content 90 days; WhatsApp number on messages 1 year; delivery records with the bookkeeping |
| Staff (therapists) | Name, clock-in PIN (stored hashed), shifts, commissions, tips and advances | Schedules, therapist queue, pay statements | Pay statements 7 years; shifts like bookings |
| Staff with a sign-in | Name, email, language, device address for push notifications | Access to the admin, notifications | While the person has access; push addresses removed after 6 months unused |
| People shown on the salon website | Therapist photo and short text; reviewer name and review | The salon's own website | Until the salon removes them |
Special categories: salons may note health information that matters for a treatment, such as pregnancy or an injury. That is special-category data (GDPR article 9): the salon may store it only with the customer's explicit consent and only what the treatment needs. ZalonFlow shows a warning on the note field. Other sensitive data must not be entered.
Annex 2: Security measures
- Database and files stored in the European Union (Frankfurt); data encrypted in transit (TLS) and at rest by the database provider.
- Each salon's data is separated at database level (row-level security), checked by automated tests.
- Passwordless sign-in with one-time links; only invited people can sign in; session cookies are httpOnly.
- Our own team uses two-step sign-in, and access is limited to what each person needs.
- An append-only audit log records support access and important actions (kept 2 years).
- No card data is stored: card payments are handled by Stripe.
- Bot protection and rate limits on public forms; server logs contain no email addresses, phone numbers or private links.
- Automatic daily jobs anonymise or remove data at the end of its retention period.
- Backups by the database provider, overwritten within 30 days, and a tested export of a salon's data.
Annex 3: Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Supabase | Database, file storage, sign-in | Data stored in the EU (Frankfurt); company in Singapore and the US, support access under standard contractual clauses |
| Cloudflare | Hosting of the app, bot protection | Global network; EU–US Data Privacy Framework / standard contractual clauses |
| Stripe | Billing of ZalonFlow's own subscription. Customer payments run under the salon's own agreement with Stripe; Stripe is not our sub-processor for those | EU and US; Data Privacy Framework / standard contractual clauses |
| Resend | Sending emails | US; Data Privacy Framework / standard contractual clauses |
| Meta Platforms Ireland | WhatsApp messages (only with the WhatsApp add-on) | EU and US; standard contractual clauses |
| DeepL | Translation of the salon's own texts (only if switched on; no customer data) | EU (Germany) |