Data Processing Agreement

1. What the words mean

• Salon data: personal information that you or your team put into FullColumn, or that your clients give through your booking page, forms and messages.
• Privacy law: the Privacy Act 1988, including the Australian Privacy Principles, and any other privacy law that applies to you.
• Other words mean what they do in our Terms of Service.

2. What we handle, and why

• Whose information: your clients, people who book with you or buy your gift vouchers, and your team.
• What information: contact details and birthdays; appointments and visits; notes and alerts; colour formulas; consultation answers, which can include health information, with signatures; photos; sales, payments and account credit (never full card numbers); messages; and whether each client has agreed to marketing.
• Why: only to provide FullColumn to you, as the Terms of Service describe and as you set it up.
• For how long: while you use FullColumn, and afterwards as When you leave says.

3. Your instructions

We handle Salon data only on your instructions: the way you use FullColumn and its settings, and anything else you ask us in writing. We don’t use it for our own purposes: not for marketing, not to sell, and not to train artificial intelligence.

If the law requires us to do something else with Salon data, we’ll tell you first unless the law forbids it. If we think an instruction of yours breaks privacy law, we’ll tell you.

4. Our people

• Only our staff who need Salon data to do their work can reach it, and they’re bound to keep it confidential.
• We only see inside your salon when an owner allows it (Settings → Security), for 1 to 30 days at a time, and they can take it back whenever they like. Each visit is for an hour at most, with a reason, and is shown to you and recorded.

5. Security

We protect Salon data with measures including these:

• Every connection is encrypted.
• Each salon has a database of its own, separate from every other salon’s.
• Photos are stored privately, under addresses nobody can guess, and shown only through your salon’s own pages to people with access.
• Passwords are stored as secure hashes and sign-ins as hashes of their tokens; wrong passwords and codes are limited; and sign-in cookies only work for your salon.
• Two-step sign-in for your team, and always for our own staff.
• Permissions for each team member, including hiding clients’ contact details from those without permission.
• Keys such as two-step sign-in keys are encrypted, with a key of your salon’s own.
• A record of every sign-in and action by our staff.
• 30 days of history for your salon, so it can be put back to an earlier time.

We review these measures and improve them over time, and won’t make them weaker overall.

6. Sub-processors

You agree to us using these providers to help run FullColumn:

• Each has agreed to protect information at least as well as this agreement asks of us, and we’re responsible for what they do.
• We’ll tell you at least 30 days before adding or replacing one. If you object for a good reason, you can end your plan before the change, and we’ll refund anything you’ve paid for time after it ends.
• Your own Stripe account, which takes your card payments, is between you and Stripe: Stripe isn’t our sub-processor for it.

7. Helping you

• FullColumn lets you find, correct, download and remove a client’s information, so you can answer their requests yourself. If a client asks us directly, we’ll send them to you, and tell you.
• We’ll give you the information you reasonably need to meet your obligations under privacy law.

8. Data breaches

If a breach affects Salon data, we’ll tell you without undue delay, and within 72 hours of knowing about it, with what we know: what happened, what information and whose, and what we’re doing about it. We’ll act to contain it, and help you assess it and tell the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

9. Outside Australia

Salon data is stored in Cloudflare’s Oceania region. Some of our sub-processors store or access information in other countries, as their list shows. We take reasonable steps to make sure they handle it in line with the Australian Privacy Principles.

10. When you leave

• You can download all of your Salon data at any time, including after your plan ends.
• We keep it for 90 days after your plan ends (or your free trial ends without one), then delete it, emailing your team 30 and 7 days before. We delete it sooner if an owner asks us in writing. It leaves your salon’s history within 30 days of being deleted, and photos are deleted 31 days after nothing uses them.

11. Showing we keep to this

We’ll give you the information you reasonably need to check that we keep to this agreement, such as answers to a security questionnaire, once a year or after a data breach. Contact us at contact@fullcolumn.com.

12. This agreement and the Terms

This agreement is part of our Terms of Service, and lasts as long as we hold Salon data. If they disagree about Salon data, this agreement wins. The Terms’ limits on liability apply to it.