GDPR and data processing agreement
This page is for salons with clients in Europe, the United Kingdom or Canada, and for anyone who wants to know how data processing is arranged. It also serves as the data processing agreement between the salon and KAIZER Booking: by accepting the Terms, the salon accepts this page too.
Updated 24 September 2026
The key points
Roles and duties
Roles
The salon is the controller: it decides what data about its clients to collect and why. KAIZER Booking is the processor: it stores the data and works on it only on the salon's instructions and only to run the program.
What the processor undertakes
- To process data only on the salon's instructions, which are expressed by the program's settings and by this document.
- Not to use the salon's client data for its own purposes, not to sell it and not to pass it on for advertising.
- To let only staff who need it for support and maintenance near the data, and only with a key.
- To apply the protection described on the Security page: a separate database for every salon, an encrypted connection, hashed passwords, a limit on login attempts, daily backups.
- To use only the sub-processors listed below, and only those the salon switched on itself.
- To tell the salon about a breach that affected its data without undue delay after we learn of it.
- To help the salon answer its clients' requests: exporting everything about a person and deleting them for good are available to the owner right in the program.
- At the end of a subscription, to let the data be exported and then delete it together with the backups on their own schedule.
Sub-processors
Services that receive data when the salon switches the matching integration on: Stripe and Square (payments), Intuit QuickBooks (books), Google (calendar), Resend (e-mail), GreenAPI (WhatsApp), Meta (ads, hashed fingerprints only), Plaid (the salon's bank feed), Anthropic (translation of templates without client data), DigitalOcean (the server in the USA). Changes to this list are announced in the program under What's new. The full list, with what each service does and where: Sub-processors.
Data and client rights
Where data is processed
On a server in New York, USA. For clients in Europe this is a transfer outside the EU. It rests on the standard contractual clauses, included in this document by reference, and on the protection described above.
Rights of the salon's clients
A client of a salon may learn what data exists about them, correct it, ask for it to be deleted, restrict its processing or receive a copy. The request goes to the salon. The owner fulfils it in the program: a card can be corrected, exported as one file and deleted for good, including photos, documents, letters and the name on every appointment. If the salon does not answer, write to us and we will pass the request to the owner.
Time limits
The salon answers a client's request within 30 days. We answer salons' requests within 5 working days. Backups are kept for 30 days, so deleted data leaves the backups within a month.
What the salon does
What depends on the salon
- Having a lawful basis for collecting data and sending mailings: consent, or a contract with the client.
- Telling clients that their data is kept in the program, for example in its own policy.
- Collecting only what the work needs and not keeping what is not needed.
- Giving staff access only to the sections they need and closing it in time.
Contact
Data processing questions, and any other: support@kaizerbooking.com.