Data Processing AgreementHow Slot handles your clients’ data.

Parties, scope and acceptance

This Data Processing Agreement (“DPA”) is between the business that holds a Slot account (the “Business”, the controller) and SIA Slot Booking (“Slot”, the processor; company details beside this text). It forms part of the Terms of service and is accepted together with them: the owner ticks the box before paying, or presses Accept when a new version is published. Slot records which version was accepted, when, in which language and by which login.

It covers the personal data that Slot processes on the Business’s behalf in providing the service: the Business’s clients, their bookings and the records the Business keeps about them (“Client Data”). It does not cover what Slot decides for itself as a controller, such as client accounts, the visit reliability summary, security and billing; the Privacy Policy describes that.

What is processed, for whom and why

Instructions, and the roles of the two parties

Slot processes Client Data only on the Business’s documented instructions: the Terms, this DPA, the settings the Business makes in the console and what the Business and its team do with the features. Slot tells the Business if it believes an instruction infringes data protection law.

These defaults are part of the instructions, and the Business accepts them: a client card that nobody has touched and that has no visit for 730 days is anonymised automatically; a client’s own note on a booking is cleared 730 days after the visit; e-mails to clients are sent as “Business via Slot” from Slot’s address, with the Business’s contact address, when it has set one, as the reply address.

Slot does not use Client Data for its own purposes, except where Slot is a controller of its own and says so in the Privacy Policy: the account of a client who has a Slot account, the visit reliability summary (which counts the no-show marks that salons make), security and the prevention of abuse, and the duties the law puts on Slot. The Business is the controller of its client cards and bookings, chooses its legal bases, informs its clients and is responsible for the lawfulness of what it enters or imports.

Confidentiality

Slot lets only people who need it for the service reach Client Data, and they are bound to confidentiality. Access to the production system is limited to Slot’s administrator; the administrator’s sign-ins and actions in the platform console are logged.

Security of processing

Slot takes measures that fit the risk (Article 32). Those in place are:

• Hosting and network: servers in the European Union, behind Cloudflare; encrypted connections (HTTPS with HSTS); a firewall that allows only SSH and web traffic; the database and the application reachable only from the server itself.
• Servers: SSH with keys only, limited attempts and fail2ban; security updates installed automatically; the application runs as an unprivileged user in a systemd sandbox; secrets kept in files readable only by the application account and the administrator, never in the code repository.
• Access control: every request is checked against the signed-in person’s business and role; the owner, administrators and specialists see only what their role allows, and a specialist sees only their own bookings; one business never sees another’s data.
• Sign-in: passwords stored only as hashes; sign-in and reset codes stored as hashes and short-lived; session tokens stored as hashes; protection against cross-site requests; limits on attempts and a temporary lock after repeated wrong passwords; an optional second factor for the platform administrator.
• Application: rate limits on public routes; strict security headers and a content security policy; uploaded photos checked and stripped of hidden metadata; the log of booking events holds ids and counts, not names, phone numbers or e-mail addresses.
• Audit trail: actions in the console are recorded (who did what, with the IP address for 12 months).
• Backups: database backups every night, kept in rotation (14 daily, 8 weekly and 6 monthly copies), readable only by the administrator; copies that leave the server are encrypted.
• Data minimisation and deletion: the daily cleanup anonymises idle client cards, clears old notes and deletes expired records; a salon’s client cards can be exported and erased from the console.

Slot reviews these measures when the service changes and may improve them; it will not make them weaker in a way that lowers the protection of Client Data.

Sub-processors

The Business gives Slot a general authorisation to use the sub-processors below, which process Client Data on Slot’s behalf. Slot uses Hetzner and Cloudflare under their data processing terms, which impose data protection obligations equivalent to those of this DPA, and remains responsible for them. Telegram is used only when the Business connects it, under Telegram’s own terms.

Stripe, which takes the Business’s subscription payments, is not a sub-processor of Client Data: it handles the Business’s own billing details, as its own controller and as Slot’s provider. The map provider and the address-suggestion service do not receive Client Data.

When Slot wants to add or replace a sub-processor, it tells the owner at least 30 days before, by e-mail to the owner’s address, and updates this list (and the version of this DPA) when the change takes effect. Within that time the Business may object on reasonable data protection grounds. If the parties cannot agree, the Business may cancel the subscription before the change takes effect and export its data under section 10.

Transfers outside the European Economic Area

Client Data is stored in the European Union. Cloudflare belongs to a group with a parent company in the United States, and Telegram may process data outside the EEA. Where Client Data is transferred outside the EEA, Slot makes sure that a transfer tool applies, where applicable: an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses, with additional measures where needed. If standard contractual clauses apply, they prevail over this DPA where they conflict.

Helping the Business

Slot helps the Business, as far as possible and taking into account the nature of the processing, to answer the requests of its clients (access, correction, erasure, restriction, portability, objection):

• the console exports a client’s card (with notes, tags, points, visits, reviews and the salon’s block) and the lists of clients and bookings as files, and erases a card’s personal data, which stays erased;
• a client with a Slot account can download and delete their own account, which detaches the salon’s records from it;
• if a client writes to Slot about data that the Business controls, Slot points them to the Business and, where it can identify the Business, tells it;
• Slot answers the Business’s reasonable questions and helps with a data protection impact assessment or a consultation with the authority, and with its security and breach duties, as far as they concern the service.

Slot keeps a journal of requests it answered, with counts only and no names, for 3 years.

Personal data breaches

If Slot becomes aware of a breach of security that affects Client Data, it tells the Business without undue delay, in a way and at a time that lets the Business meet its own duty to notify the supervisory authority within 72 hours. The message goes to the owner’s e-mail address and says what is known: what happened, the data and the approximate number of people concerned, the likely consequences and what is being done. Slot goes on helping with the Business’s own notices to the authority and to the people concerned.

Return and deletion of data

• During the subscription the Business can export and delete Client Data itself in the console.
• After the subscription ends (cancelled, or a free access that has run out), online booking stops at once; for 30 days the owner and the administrators can read and export everything but change nothing; the Business can reactivate until Slot deletes its data.
• After those 30 days the console closes. Nothing is deleted automatically: Slot deletes the Business’s data when the owner asks in writing from the owner’s own address, or at its own initiative, and in either case no sooner than 30 days after the end. Deleting removes the clients, bookings, reviews, photos, team, services, pages and integrations of the Business, and its billing records at Slot. Slot does not tell the Business’s clients: if they have bookings ahead, tell them yourself before you leave.
• What remains: copies in backups, until the copy expires (up to about six months), and not used for anything but recovery; if a backup is restored, deletions made since are repeated; audit entries kept for 5 years (administrator’s actions and money-related entries, ids and counts only); the Business’s billing records at Stripe, under Stripe’s rules; and anything the law requires Slot to keep. The Slot accounts of the clients belong to the clients and are not deleted.

Information and audits

Slot gives the Business the information needed to show that it complies with Article 28, including a written answer once a year to the Business’s reasonable questions about security and sub-processors, and contributes to audits. An on-site or technical audit is possible when the law or a supervisory authority requires it or after a breach of Client Data, with reasonable written notice, during working hours, at the Business’s cost, under confidentiality, and without endangering the data of other businesses.

Term, order of precedence, liability and law

This DPA applies while Slot processes Client Data for the Business. If it conflicts with the Terms on a matter of data protection, this DPA prevails. Liability is as set out in the Terms, but nothing here limits liability that the law does not allow to be limited. Latvian law applies, and the data protection law of the European Union and Latvia.

Contact

Questions about this DPA or about the processing of Client Data: [email protected], and the details of the operator beside this text.