Data Processing Agreement

This Data Processing Agreement ("DPA") sets out the terms on which Boona processes personal data on your behalf when you use the Boona platform. It gives effect to Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and equivalent provisions of UK data protection law.

This DPA forms part of the Terms of Service. It applies automatically to every customer — you do not need to request or sign anything separately for it to be in force. If your own compliance process requires a countersigned copy, email contact@boona.app.

Most salon platforms make you email support to see terms like these. We publish them so you can read them before you sign up.

This is the part that matters most, so it goes first.

• You are the controller. Your clients are your clients. You decide what client data you collect, why, and how long you keep it.
• Boona is the processor. We process that data only to provide the platform to you, on your instructions.

Boona acts as an independent controller for a small, separate set of data: your own account and billing details, and the analytics we collect about visitors to boona.app. That processing is described in the Privacy Policy and the Cookie Policy, not here.

We do not use your client data for our own purposes. We do not market to your clients on our own account, and we do not sell your client list.

Subject matter and purpose: provision of the Boona appointment booking and salon management platform to you.

Duration: for as long as you hold a Boona account, plus the retention period in section 9.

Nature of processing: collection, storage, organisation, retrieval, transmission, backup and deletion of personal data, by automated means.

Categories of data subject: your clients; your staff members; and any other individual whose data you enter into the platform.

Categories of personal data:

• Identity and contact data — name, phone number, email address;
• Appointment data — bookings, services taken, history, cancellations, no-shows;
• Free-text notes you or your staff record against a client card;
• Staff data — schedules, working hours, roles and permissions, and payroll settings where you use that feature;
• Communication data — messages and notifications sent through the platform.

We process personal data only on your documented instructions, including in relation to international transfers. Your use of the platform's features, together with the Terms of Service and this DPA, constitutes those instructions.

If we are required by law to process data beyond your instructions, we will inform you before doing so unless that law prohibits us from telling you.

If we believe an instruction from you infringes data protection law, we will tell you.

Access to personal data is limited to personnel who need it to operate or support the platform. Everyone with such access is bound by a duty of confidentiality and is subject to the access controls described on the Security page.

We implement appropriate technical and organisational measures under Article 32 GDPR. These are described in full on the Security page, which forms part of this DPA. In summary: TLS for all traffic, an encrypted private network between servers, hashed passwords, encrypted daily backups with transaction log archiving, cross-region replication, role-based access control within your account, and key-only administrative access.

That page also states plainly which certifications we do not hold. Please read it before making a procurement decision.

You give general authorisation for Boona to engage sub-processors. We impose data protection obligations on each of them no less protective than those in this DPA, and we remain fully liable to you for their performance.

The current sub-processors are:

Google Tag Manager, Google Analytics and Google Ads run on the boona.app marketing site only. They do not have access to your client data and are not sub-processors of it; see the Cookie Policy.

We will give you notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds. If we cannot resolve your objection, you may terminate the affected part of the service.

Boona runs regional shards. Which one holds your data is determined once, at sign-up, by the country you register in.

If you register in an EU or EEA member state, the personal data you process through Boona is stored on EU infrastructure only — the Swedish regional shard, with the central control plane in Germany. No routine transfer of that data to a third country takes place.

This is a technical control rather than an undertaking of intent. Every EU and EEA member state is pinned to the Swedish shard in the sign-up router, and that pin takes precedence over every other routing input, including the interface language. A Russian-language signup from an EU member state is created on the Swedish shard.

For accounts registered in Russia or Belarus, data is stored on the Belarus shard. Where a transfer of personal data to a country outside the EEA occurs, Boona relies on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), together with supplementary technical measures — principally encryption in transit between all sites — assessed as appropriate to the transfer.

If data residency is material to your procurement decision, contact contact@boona.app and we will confirm in writing which shard holds your data.

The platform gives you direct tools to satisfy most requests yourself: you can view, correct, export and delete client records from the dashboard without involving us.

Where a request cannot be handled with those tools, we will provide reasonable assistance, taking into account the nature of the processing, so you can respond within your statutory deadline. Contact contact@boona.app.

If a data subject contacts Boona directly about data we process on your behalf, we will not respond substantively — we will refer them to you and tell you about it.

We will also assist you, on the same basis, with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR.

We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, so that you can meet your own 72-hour notification obligation under Article 33 GDPR.

Our notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

You can export your historical appointment records at any time from the dashboard.

On termination of your account, we delete or return the personal data we process for you, at your choice, after a limited grace period during which you can still export it or reactivate. After that period we delete it from live systems; residual copies in encrypted backups are removed as those backups age out on their normal rotation.

We retain data beyond that only where law requires it, and only for as long as it requires.

Individual client accounts can also be deleted on request — see Delete Account.

We will make available to you the information necessary to demonstrate compliance with Article 28 GDPR, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In practice, we ask that you first accept the information published on the Security page and any written answers we give to your questionnaire. Where that is genuinely insufficient for your compliance obligations, contact us to arrange an audit on reasonable notice, at reasonable frequency, and without disrupting the service to other customers.

Liability under this DPA is subject to the limitations in the Terms of Service, except where those limitations are not permitted by applicable data protection law.

If there is a conflict between this DPA and the Terms of Service on the processing of personal data, this DPA prevails.

Data protection enquiries, sub-processor details, or a countersigned copy of this DPA: contact@boona.app.

Related documents: Privacy Policy · Security · Terms of Service · Cookie Policy