Legal

This Data Processing Agreement ("DPA") forms part of the Terms of Service between BookMyNails ("Processor", "we", "us") and the salon owner ("Controller", "you") who uses the BookMyNails platform at bookmynails.ca.

This DPA sets out the terms under which BookMyNails processes personal data on behalf of salon owners, in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

• Data Controller — The salon owner who determines the purposes and means of processing personal data of their customers.
• Data Processor — BookMyNails, which processes personal data on behalf of the Data Controller.
• Data Subject — An identifiable individual whose personal data is processed (e.g., salon customers).
• Personal Data — Any information about an identifiable individual, as defined under PIPEDA.
• Processing — Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• Sub-processor — A third-party service provider engaged by BookMyNails to assist in processing personal data.

3.1 Categories of Data Subjects

• Salon customers who book appointments
• Salon owners and staff members

3.2 Types of Personal Data Processed

• Contact information: names, email addresses, phone numbers
• Booking data: appointment history, service preferences, notes
• Communication data: SMS messages, email confirmations, marketing preferences
• Payment data: transaction records (card details processed by Stripe, never stored by BookMyNails)
• Technical data: IP addresses, browser information, usage logs

3.3 Purpose of Processing

• Providing and operating the booking platform
• Sending booking confirmations, reminders, and notifications
• Processing payments on behalf of salon owners
• Sending marketing communications when consent is obtained
• Generating analytics and reports for salon owners
• Maintaining platform security and preventing fraud

3.4 Duration

Personal data is processed for the duration of the service agreement. Upon termination, data is handled per Section 9.

• Process personal data only on documented instructions from the Controller
• Ensure authorized persons have committed to confidentiality
• Implement appropriate technical and organizational security measures
• Not engage sub-processors without prior authorization
• Assist the Controller in responding to data subject requests
• Delete or return all personal data upon service termination

Security Measures

• Encryption in transit (TLS 1.2+) and at rest
• Role-based access controls and multi-factor authentication
• Regular security assessments
• Automated backup and disaster recovery
• Logging and monitoring of data access

• Ensure lawful basis for data collection and processing
• Obtain necessary consents from customers
• Provide clear privacy notices to customers
• Comply with CASL before sending commercial messages
• Respond to data subject access requests

BookMyNails uses the following sub-processors:

Under PIPEDA, data subjects have the right to:

• Access — Request a copy of personal data held
• Correction — Request correction of inaccurate data
• Deletion — Request deletion, subject to legal retention
• Portability — Request data in a structured format
• Withdrawal of Consent — Withdraw consent at any time
• Complaint — File a complaint with the Privacy Commissioner of Canada

In the event of a breach, BookMyNails will:

• Notify affected salon owners within 72 hours
• Provide details of the breach, data affected, and number of subjects
• Describe measures taken to mitigate the breach
• Cooperate with the Privacy Commissioner as required under PIPEDA

• Data retained while the account is active
• Deleted or anonymized within 90 days of account termination
• Backups purged within 30 days after primary deletion
• Payment records retained up to 7 years (Canadian tax law)

Some sub-processors are US-based. BookMyNails ensures transfers comply with PIPEDA, sub-processors are bound by contractual obligations, and data is encrypted in transit and at rest.