Data Processing Agreement

1. Roles, scope, and instructions

This DPA forms part of the Terms. The Customer is controller and Lonsa is processor for salon-customer data. Documented instructions cover appointment and WhatsApp communication management, availability, security, support, and selected integrations for the service term and published deletion periods.

Data subjects are salon customers and business contacts. Data includes name, phone/WhatsApp ID, service, date, time, appointment status, limited conversation status, inactive Flow compatibility metadata where applicable, and support information. Special-category data is prohibited.

2. Lonsa obligations

• Confidentiality and risk-appropriate technical and organisational measures.
• Reasonable assistance with rights, security, DPIAs, and regulators.
• Confirmed breach notice without undue delay with available relevant information.
• Compliance information and reasonable remote-first audits that protect security and other customers.
• Return or deletion at termination under the Privacy Notice, except limited legal retention.

3. Subprocessors and transfers

The authorized subprocessors are Vercel, Render, Resend, Cloudflare, Meta, Google, and STRATO for the purposes described in the Privacy Notice. Lonsa provides at least 30 days’ notice of a material new subprocessor and allows a reasoned objection within 14 days. Applicable adequacy decisions or EU Standard Contractual Clauses protect transfers outside the EEA.

4. Security and Customer duties

Controls include tenant isolation, TLS, hashed authentication capabilities, encrypted provider credentials, Meta signature verification, encrypted inactive Flow compatibility data, opaque contextual tokens, replay prevention, five-minute database-time holds, fresh Calendar checks, idempotency, redacted logging, paid-production backups, retention jobs, and tested deletion.

The Customer maintains a lawful basis and notices, secures its accounts, follows WhatsApp requirements, gives lawful instructions, responds primarily to salon-customer requests, and does not submit special-category data.