Data Processing Addendum
Last updated May 1, 2026
1. Scope
This DPA forms part of the Terms of Service between you (the “Controller”) and PocOS (the “Processor”) and applies whenever we process personal data on your behalf.
2. Subject matter and duration
We process personal data for the duration of your subscription, solely to provide the Service as instructed by you through your use of the product.
3. Categories of data subjects
Your salon's customers, employees, and any other individuals whose data you choose to store in the Service.
4. Categories of personal data
Identification data (name, contact), appointment data, service history, billing records, and any free-text notes you enter.
5. Processor obligations
We process data only on documented instructions, ensure personnel are bound by confidentiality, implement appropriate technical and organisational measures, and assist you with data subject requests and impact assessments.
6. Sub-processors
You provide general authorization for us to engage sub-processors. We maintain a current list and will notify you of additions or changes at least 30 days in advance.
7. International transfers
Where transfers occur outside the EEA, UK, or your local jurisdiction, we rely on standard contractual clauses or equivalent safeguards.
8. Security
We maintain administrative, physical, and technical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure.
9. Breach notification
We will notify you without undue delay after becoming aware of a personal data breach and provide reasonable information to help you meet your own notification obligations.
10. Audits
We make available all information necessary to demonstrate compliance and allow for audits, including via third-party reports such as SOC 2 when available.
11. Return and deletion
Upon termination, we return or delete personal data within 30 days, except where retention is required by law.
12. Contact
DPA questions? Email privacy@pocos.app.