Data Processing Agreement

Status of this document

This draft still contains company and policy details that Lonsa must confirm. It must not be used as the final agreement.

1. Roles, scope, and instructions

The business customer is controller and Lonsa is processor for salon-customer data. Processing is limited to booking and communication management for the service term plus the confirmed deletion period, on documented instructions unless law requires otherwise.

2. Lonsa obligations

• Confidentiality and appropriate technical and organisational measures.
• Proportionate assistance with rights requests, incidents, DPIAs, and regulators.
• Breach notice without undue delay with available relevant information.
• Compliance information and reasonable audits that protect other customers and security.
• Return or deletion after service termination under the confirmed retention schedule.

3. Subprocessors, transfers, and security annex

[TO CONFIRM] add the final subprocessor list, notice and objection process, locations, transfer safeguards, and detailed security controls.