Subprocessors
This is a translation of the Dutch page Subverwerkers. If the two differ, the Dutch text prevails.
In short
- A subprocessor is a company we engage that processes your salon's data in doing so.
- This page lists every subprocessor we use now and is annex C of the Data Processing Agreement.
- We announce a new subprocessor by e-mail at least 30 days in advance, and you can object to it.
- If we find no solution together after your objection, you can end the agreement at no cost.
- Data leaves the EEA only if the GDPR provides a ground for it, such as the EU-U.S. Data Privacy Framework.
- Services that only receive data we are responsible for ourselves are listed separately at the bottom.
This is a summary; the articles below are binding.
1. What this list is
1.1 Saloon (we) processes the data the salon (you) records in the platform, such as that of customers and team members, as a processor: on the salon's behalf, under the Data Processing Agreement. A processor is whoever processes personal data on behalf of somebody else. For that work we engage other companies. If such a company receives the salon's data in doing so, it is a subprocessor.
1.2 This page is annex C of the Data Processing Agreement. It lists every subprocessor we use now.
1.3 We impose on every subprocessor, in a written agreement, the same data protection obligations as the Data Processing Agreement contains (article 7 of that agreement).
1.4 The EEA is the European Economic Area: the European Union, Iceland, Liechtenstein and Norway. The GDPR is the General Data Protection Regulation.
2. Changes
2.1 If we want to add or replace a subprocessor, we e-mail the salon owner's address at least 30 days before the new subprocessor receives any of the salon's data. At the same time we put the change on this page.
2.2 You can object within those 30 days, giving your reason, by e-mail to [not known yet]. We then look for a solution together. If we find none before the new subprocessor starts, you can end the agreement as of that date, at no cost.
2.3 This page shows the date of the current version and the earlier versions.
3. The subprocessors
3.1 These companies process the salon's data:
| Subprocessor | What for | Which data | Where | Ground for transfer outside the EEA |
|---|---|---|---|---|
| Railway | Hosting of the platform: the servers, the database and the queues | All data in the platform | European Union (region eu-west) | To be confirmed (US company) |
| Cloudflare — R2 | Storage of photos and documents | The files the salon uploads | European Union (R2 EU jurisdiction) | To be confirmed |
| Cloudflare — Pages, DNS and proxy | Hosting of the back office and the app; domain names and passing on traffic | The requests that pass through Cloudflare, with the visitor's IP address | Global network | To be confirmed |
| Mailjet (Sinch) | Sending e-mail, including on the salon's behalf to its customers; tracking delivery (not opens or clicks) | Name and e-mail address of the recipient, the full content of the message, whether it was delivered | To be confirmed | To be confirmed |
| Sentry | Error reports from the platform | Technical data about an error; request contents, cookies, query parameters in addresses and sign-in details are removed beforehand | European Union | Not applicable (stored in the EU) |
| Google — Firebase Cloud Messaging | Push messages to team members' devices | The device's code, the title and text of the message, which may contain a customer's name and an appointment | United States | EU-U.S. Data Privacy Framework |
| Google — Maps Places | Address suggestions while a user types an address, for example a customer's | The text the user types in the address field | United States | EU-U.S. Data Privacy Framework |
3.2 The EU-U.S. Data Privacy Framework is a decision of the European Commission (article 45 of the GDPR): a US company certified under it offers an adequate level of protection.
4. Other services we use ourselves
4.1 The services below are not subprocessors. They receive no data the salon records in the platform, only data Saloon itself is responsible for, such as a visitor's IP address or a user's sign-in:
- Google — Sign in with Google: for users and accounts with Saloon that sign in with Google.
- Google — reCAPTCHA: protection against spam on the newsletter and contact forms on the website.
- Google — Fonts: the typeface on part of the website and in the app.
- Map services: OpenStreetMap for every map (the back office, the website's salon pages and the app), and Nominatim to look up a salon's position.
- Unsplash: sample photos in the app and on the website.
4.2 What these services receive and why is set out in our Privacy Statement.