Version 2026-10-20.

Data-processing schedule

Scope and roles

This schedule forms part of the salon terms between the salon business and So Critical Ltd, trading as SunbedHQ ("we"). It applies where the salon is controller and we process personal data on its behalf under the UK GDPR and Data Protection Act 2018.

The subject matter is providing and supporting the salon's booking and customer administration service. Processing lasts for the agreement and the return or deletion period described below. Its purposes are managing appointments, minutes, customer records, consultation records, payment references and staff administration. Operations include collection, recording, organisation, storage, retrieval, permitted disclosure, correction, export and deletion.

People covered are the salon's customers and prospective customers, staff and authorised representatives. Data includes identity and contact details, dates of birth and age-check records, bookings, attendance, minutes, purchases, payment and refund references, consultation answers including health information where supplied, consent and terms records, and staff access and activity records.

We act separately as controller for our own shared identity, account security and business billing purposes. Stripe has its own data-protection roles for payment services under the applicable Stripe agreements; this schedule does not make Stripe our processor for all payment activities. Roles follow the actual purposes of processing.

The salon's instructions and responsibilities

The salon determines lawful purposes, provides documented instructions and ensures an Article 6 lawful basis, and an Article 9 condition where health or other special-category data is involved. It must provide privacy information, keep data accurate, minimise collection, set appropriate retention periods and handle individuals' rights. General acceptance of terms is not itself explicit consent to health-data processing.

We will process only on documented instructions, including for international transfers, unless UK law requires otherwise. In that case we will inform the salon of the legal requirement before processing unless the law prohibits this. We will immediately inform the salon if we consider an instruction infringes applicable data-protection law.

Confidentiality and security

We will ensure people authorised to process salon data are bound by confidentiality obligations. We will implement and maintain technical and organisational measures appropriate to risk under Article 32, considering the data, technology, costs and processing context.

These measures will include access limited by role and need, appropriate authentication and access review, tenant separation, protection during storage and transmission appropriate to risk, vulnerability and incident management, and arrangements for resilience, recovery and regular security testing. We will review measures as risks change.

Other processors and transfers

We must obtain the salon's specific prior written authorisation for each subprocessor before it processes salon data. The request must identify the provider's legal entity, work, processing locations and any relevant transfer safeguards. An addition or replacement needs fresh authorisation; silence is not approval. This schedule grants no blanket permission to appoint unspecified providers.

We will put equivalent data-protection obligations into a written contract with each authorised subprocessor and remain responsible to the salon for its performance. We will not transfer salon data outside the UK without documented instructions and safeguards required by applicable law.

Assistance and accountability

Taking account of the nature of processing, we will assist through appropriate technical and organisational measures, insofar as possible, with requests to exercise individuals' rights. We will pass on requests concerning salon data and follow the salon's instructions rather than decide them ourselves.

We will notify the salon of a personal data breach without undue delay after becoming aware of it, share available relevant information and provide updates. Taking account of processing and information available to us, we will assist with security, breach assessment and notifications, data-protection impact assessments and prior consultation with the regulator.

We will provide information necessary to demonstrate compliance and allow and contribute to audits, including inspections by the salon or its mandated auditor. Reasonable arrangements for notice, confidentiality and protecting other customers must not prevent necessary oversight.

Return and deletion

On request, we will support access to and export of salon data in a reasonable machine-readable form. At the end of services, we will, at the salon's choice, return or delete the data and delete existing copies unless UK law requires retention. We will explain any required retention and restrict use accordingly.

Backup copies awaiting deletion will be kept beyond ordinary use until removed through the normal documented backup cycle. If restored for recovery, the return or deletion instruction will be reapplied. Contact [email protected] to give instructions or arrange assistance.