Between: REPOVIC.DEV LLC d/b/a Softalon ("Softalon" or "Data Processor")
And: [SALON BUSINESS NAME] ("Business" or "Data Controller")

1. Scope and Purpose

This Data Processing Agreement ("DPA") applies when Softalon processes personal data on behalf of the Business in the course of providing the Softalon Services (salon booking, scheduling, client management, and related features). Specifically, this DPA governs the processing of:

Member Data: Information about salon staff members (name, email, phone, avatar)
Client Data: Information about clients who book appointments or are added to the salon's client management system (name, email, phone, notes, custom fields)
Integration Data: Data obtained through integrations (calendar events, messages, marketing lists, payment references) as directed by the Business

This DPA is incorporated into and is part of the Terms of Service between Softalon and the Business. In the event of conflict, this DPA shall prevail for matters of data processing.

2. Definitions

"Personal Data": Any information relating to an identified or identifiable natural person that the Business provides to Softalon.
"Processing": Any operation performed on Personal Data, such as collection, recording, storage, retrieval, use, transmission, or deletion.
"Data Subject": A natural person to whom Personal Data relates (e.g., a Client or Member).
"Data Controller": The Business, which determines the purposes and means of processing Personal Data.
"Data Processor": Softalon, which processes Personal Data on behalf of the Data Controller.
"Sub-processor": A third-party service provider (such as cloud hosting providers) engaged by Softalon to process Personal Data on the Processor's behalf.
"Applicable Data Protection Law": GDPR (EU Regulation 2016/679), CCPA/CPRA (California Consumer Privacy Act), and equivalent regulations in other jurisdictions.

3. Instructions and Authorization

3.1 Scope of Processing

The Business authorizes Softalon to process Personal Data for the following purposes:

Providing the Softalon Services (scheduling, booking management, reminders, client CRM)
Facilitating integrations the Business enables (calendars, payments, messaging, marketing, analytics)
Powering AI features that assist with scheduling and message responses (see Section 3.5)
Fraud prevention, security monitoring, and platform abuse prevention
Complying with applicable laws and responding to lawful legal requests
Maintaining backups and ensuring platform reliability

3.2 Permitted Use

Softalon shall process Personal Data only in accordance with:

Instructions provided in writing by the Business (including via email or through the Softalon dashboard)
This DPA
Applicable Data Protection Law

Softalon shall not process Personal Data for purposes other than those specified above without explicit written consent from the Business.

3.3 Data Subject Rights

The Business is responsible for obtaining any necessary consents from Data Subjects (Members and Clients) before providing their Personal Data to Softalon. The Business shall inform Data Subjects of the processing and their rights under applicable Data Protection Law. Softalon will provide reasonable assistance to the Business in responding to Data Subject rights requests (access, deletion, correction, objection, restriction).

3.4 Integration Compliance

When the Business enables integrations with third-party services (Google Calendar, Stripe, Meta, etc.), both parties acknowledge that:

The Business is responsible for complying with those third-party services' terms and policies
Softalon complies with applicable limited-use policies (e.g., Google's Limited Use Policy for Calendar data)
Data shared with third-party services is subject to those providers' privacy policies
Softalon does not store or process data beyond what is necessary for the integration

3.5 AI Features

Softalon may use AI capabilities to deliver AI-powered features (such as scheduling suggestions and automated message responses). The Business acknowledges that:

AI-generated output may be inaccurate, incomplete, or inappropriate
AI responses are generated automatically in real-time and are not manually reviewed before deployment
The Business should monitor and review AI outputs as part of normal service operations
Softalon does not use Member, Client, or Salon data to train AI models or improve AI services beyond the immediate request
Data provided to AI systems is not used for general model training

4. Softalon's Obligations as Data Processor

4.1 Confidentiality

Softalon shall ensure that any person authorized to process Personal Data (employees, contractors, service providers) is bound by confidentiality. Softalon shall not disclose Personal Data to any person except as authorized by this DPA or required by law.

4.2 Security Measures

Softalon implements appropriate technical and organizational measures to protect Personal Data against unauthorized access, accidental or unlawful destruction, loss, alteration, disclosure, or misuse, including:

Encryption: Data is encrypted in transit (HTTPS/TLS) and at rest using industry-standard encryption. Integration credentials (API keys, OAuth 2.0 tokens) are encrypted and never stored in plain text.
Access Controls: Only authorized personnel with a business need may access Personal Data. Multi-factor authentication is required for administrative access.
Network Security: Firewalls, intrusion detection, and continuous monitoring via industry-standard security providers.
Data Isolation: Each Business's data is logically isolated.
Incident Response: Procedures for detecting, investigating, and responding to security breaches.
Regular Audits: Periodic security reviews, penetration testing, and vulnerability assessments.
Backup and Recovery: Regular backups to ensure data availability and recovery in case of incident.

The Business acknowledges that no security measures are completely risk-free and agrees to the security measures described in the Softalon Privacy Policy.

4.3 Sub-processors

Softalon may engage Sub-processors to assist in delivering the Services. The current list of Sub-processors and their functions is maintained at softalon.com/subprocessors and is updated as needed.

Sub-processor Change Process: Softalon will notify the Business of any changes to Sub-processors (additions or replacements) at least 30 days before such changes take effect via email. The Business may object to the use of a new Sub-processor on reasonable grounds relating to data protection by notifying Softalon in writing within 15 days of notice. If the Business objects, the parties will work together in good faith to find an alternative solution. If no resolution is found within a reasonable timeframe, either party may terminate the affected services without incurring early termination penalties.

4.4 Assistance with Data Subject Requests

Softalon shall assist the Business in fulfilling Data Subject rights requests (access, deletion, correction, portability, objection, restriction) by:

Providing tools within the Softalon dashboard for the Business to fulfill requests
Responding to written requests from the Business at [email protected] and providing requested information
Processing requests within 1 month (30 calendar days) of receipt, unless legally required otherwise

4.5 Data Breach Notification

In the event of a suspected or confirmed unauthorized access, disclosure, loss, or alteration of Personal Data ("Data Breach"), Softalon shall:

Notify the Business without undue delay (no later than 72 hours) via email to the address on file
Provide details of the Breach, including: nature and scope of the Breach, categories and approximate number of affected Data Subjects, likely consequences, and measures taken or proposed to address the Breach
Cooperate with the Business's investigation and any regulatory notifications

Softalon shall not delay notification in order to investigate the Breach, though notifications may be updated as more information becomes available.

4.6 Data Return or Deletion

Upon termination or expiration of the Services:

The Business may export its data from Softalon
Softalon will retain Personal Data for 30 days (unless legally required otherwise) to allow the Business to retrieve it, then permanently delete it
Softalon will delete Personal Data from active systems; data in backup systems will be deleted according to standard backup retention schedules (typically within 90 days, unless legally required otherwise)
Softalon may retain anonymized, aggregated data for analytics and business intelligence purposes

5. The Business's Obligations as Data Controller

5.1 Instructions

The Business shall provide clear, documented instructions regarding the processing of Personal Data. Instructions include:

Specification of which Personal Data to collect
Purposes for processing
Retention periods
Recipients of the data (e.g., which Members access which data)
Any special processing requirements

Changes to instructions shall be communicated to Softalon in writing and will be effective once acknowledged by Softalon.

5.2 Lawfulness of Processing

The Business represents and warrants that it has obtained all necessary consents and permissions from Data Subjects to provide their Personal Data to Softalon and that such processing is lawful under applicable Data Protection Law. The Business is responsible for:

Obtaining consent from Members to process their employment/professional information
Obtaining consent from Clients to collect and process their booking and contact information
Ensuring that any minor Clients have proper parental consent before their data is provided to Softalon
Providing transparent privacy notices to Data Subjects
Complying with applicable Data Protection Law (GDPR, CCPA, etc.)

5.3 Accuracy and Deletion

The Business shall ensure that Personal Data provided to Softalon is accurate and kept up-to-date. The Business shall delete or request deletion of Personal Data that is no longer necessary, and Softalon will honor such requests.

5.4 International Transfers

If the Business is located in the EU/EEA and provides Personal Data to Softalon (located in the US), the Business acknowledges that Personal Data will be transferred to and processed in the United States. Where required by applicable data protection law, Softalon will implement appropriate transfer safeguards, which may include encryption, contractual obligations, and other technical and organizational measures. Softalon will make documentation of such safeguards available upon request to the Business.

6. International Data Transfers

6.1 Transfers to the United States

Softalon is based in the United States and processes and stores all Personal Data on servers located in the United States. If the Business is located in the EU/EEA or provides Personal Data of EU/EEA residents, the Business acknowledges that Personal Data will be transferred outside the EU/EEA. Where required by applicable data protection law, Softalon will implement appropriate transfer safeguards.

6.2 Supplementary Measures

Softalon implements reasonable technical and organizational measures to protect Personal Data transferred outside the EU/EEA, including:

Encryption: Data encryption in transit (HTTPS/TLS) and at rest using industry-standard encryption
Contractual Obligations: Data processing agreements with Sub-processors that include appropriate data protection clauses
Access Controls: Strict access controls and authentication mechanisms
Regular Audits and Monitoring: Periodic security reviews and vulnerability assessments
Data Minimization: Processing only the Personal Data necessary to provide the Services

These measures are designed to ensure that Personal Data transferred outside the EU/EEA receives a level of protection consistent with that afforded under applicable EU data protection law.

6.3 Legal Requests and Compliance

Softalon shall not disclose Personal Data to any government or law enforcement authority except:

As required by applicable law (subpoena, court order, legal process)
With the Business's prior consent or knowledge
To the extent legally permitted, after notifying the Business

7. Liability and Indemnification

7.1 Liability

Softalon's liability for breach of this DPA shall be governed by the limitations in the Terms of Service between Softalon and the Business. In no event shall either party be liable for indirect, incidental, consequential, special, or punitive damages.

7.2 Indemnification

The Business shall indemnify and hold harmless Softalon from any claims, damages, or losses arising from:

The Business's failure to obtain necessary consents from Data Subjects
The Business's provision of inaccurate, incomplete, or unlawful Personal Data
The Business's violation of applicable Data Protection Law
The Business's violation of Softalon's instructions or this DPA

8. Audits and Compliance

8.1 Audit Rights

The Business may, upon reasonable notice (at least 30 days), audit Softalon's compliance with this DPA by:

Requesting documentation of security measures and data protection practices
Requesting confirmation of Sub-processor changes and data handling procedures (current list at softalon.com/subprocessors)
Submitting written questions regarding data processing

Softalon will provide reasonable cooperation and documentation to demonstrate compliance. Audits may not occur more than once per year unless required by Applicable Data Protection Law.

8.2 Regulatory Audits

Softalon shall cooperate with regulatory authorities (data protection authorities, law enforcement, etc.) in investigations related to this DPA and shall, to the extent legally permitted, notify the Business of such investigations.

9. Data Protection Impact Assessments

If the Business requires a Data Protection Impact Assessment (DPIA) for its processing of Personal Data via Softalon (typically for high-risk processing under GDPR), the Business may request assistance from Softalon. Softalon shall provide:

Information about its data processing practices
Details of security and technical measures
Information about Sub-processors (available at softalon.com/subprocessors)

The Business remains responsible for conducting and documenting the DPIA.

10. Amendment and Termination

10.1 Amendment

This DPA may be amended by Softalon with 30 days' written notice. Material changes (such as new Sub-processors or significant changes to security measures) will be communicated in advance. The Business may object to changes on reasonable grounds by notifying Softalon within 15 days of notice. If unresolved, either party may terminate the agreement.

10.2 Termination

This DPA shall remain in effect for as long as Personal Data is processed under the Services. Upon termination or expiration of the Services:

Softalon shall delete or return Personal Data as described in Section 4.6
Softalon's obligations regarding confidentiality and security shall survive termination for any retained data

11. Contact and Notices

All notices regarding this DPA shall be sent to:

For Softalon (REPOVIC.DEV LLC d/b/a Softalon):
Email: [email protected]
Attn: Privacy Contact
Address: 30 N Gould St #50933, Sheridan, WY 82801, USA

For the Business:
Email: [Business Contact Email]
Attn: [Business Legal or Designated Contact]

12. Entire Agreement

This DPA, together with the Terms of Service between Softalon and the Business, constitutes the entire agreement regarding data processing. Any previous data processing agreements are superseded and of no further effect.

Acceptance

By creating an account and accepting the Softalon Terms of Service, the Business agrees to be bound by this Data Processing Agreement. This DPA is incorporated by reference into the Terms of Service.

No physical signature is required. Acceptance occurs upon account creation and your continued use of Softalon Services constitutes acknowledgment and acceptance of this DPA.

Effective Date: December 15, 2025

Last Updated: December 15, 2025

Ugovor o obradi podataka