WeDoAnyNail

Data Processing Agreement

Version 2026-10-20. Part of our Terms of Service.

This Data Processing Agreement ("DPA") is between the business that uses WeDoAnyNail ("you", the controller) and WeDoAnyNail ("we", the processor). It forms part of our Terms of Service and applies whenever we process personal data on your behalf to provide the Service. It is intended to meet the requirements of Article 28 of the UK GDPR and, where it applies to you, of the EU GDPR (together, "Data Protection Law"). You accept it by accepting the Terms of Service, which also meets the requirement for it to be in writing, including in electronic form.

1. Scope and roles

For the personal data of your clients, your staff and anyone else that you or your clients enter into the Service ("Client Data"), you are the controller and we are the processor. Annex 1 describes the processing. Where we process personal data for our own purposes, such as your account and billing details, we are a controller and our Privacy Policy applies.

You are responsible for the lawfulness of the processing and of your instructions. That includes having a lawful basis and any consent needed, for example for marketing messages or for health information you record, and giving your clients the information the law requires, such as the privacy policy on your booking page.

2. Your instructions

We process Client Data only on your documented instructions: the Terms of Service, this DPA, and your use and settings of the Service. We process it otherwise only where the law requires us to, and we will tell you before doing so unless the law forbids it. We will tell you straight away if we believe an instruction infringes Data Protection Law.

Your instructions include that we may:

  • delete payment card numbers, security codes, bank login details, passwords or login codes that we find in notes or other free-text fields, where the Terms of Service do not allow them. Doing so is not a personal data breach;
  • remove or restrict content as described in section 9 of the Terms of Service;
  • create anonymous, aggregated information from the use of the Service, which identifies no person, and use it to run and improve the Service. Once it is anonymous, it is no longer Client Data.

3. Confidentiality

Everyone we authorise to process Client Data is bound by a duty of confidentiality and has access only as far as their work requires.

4. Security

We take the technical and organisational measures described in Annex 2 to protect Client Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (Article 32). We may update these measures, as long as the overall level of protection is not reduced.

5. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 3. We will tell you about any intended addition or replacement at least 30 days in advance, by email or in your account. You may object on reasonable data protection grounds within that time. If we cannot reasonably address your objection, you may end your subscription before the change takes effect, and we will refund the fees you paid for the period after it ends. We impose data protection obligations on each sub-processor that are at least as protective as this DPA, and we remain responsible to you for their performance.

6. International transfers

We host the Service and store Client Data in the United Kingdom. For customers in the EU or EEA, the European Commission's adequacy decision for the United Kingdom covers the transfer to us. We transfer Client Data outside the UK, or onward from the EEA, only to the sub-processors in Annex 3, and only with an appropriate safeguard under Data Protection Law, such as adequacy regulations or decisions (including the EU-US Data Privacy Framework and its UK Extension) or standard contractual clauses.

7. Helping you

  • Requests from individuals. The Service lets you find, correct, export and delete client records, and lets your clients download or delete their own data in their customer account. Where you need more help to answer a request, we will assist you with appropriate measures as far as reasonably possible. If someone sends a request to us, we will forward it to you without undue delay and will not answer it ourselves unless you ask us to.
  • Your other obligations. Taking into account the nature of the processing and the information available to us, we will help you meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation with a supervisory authority (Articles 32 to 36).
  • We may charge reasonable costs for help that goes beyond the features of the Service, unless it is needed because we broke this DPA.

8. Personal data breaches

We will notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Client Data. We will give you the information you reasonably need to meet your own obligations as it becomes available, and take reasonable steps to contain the breach and reduce its effects.

9. Deletion and return of Client Data

When your account ends, you can ask us for an export of Client Data within 30 days. After that we delete Client Data, unless the law requires us to keep it. Client Data in database backups is deleted when those backups are deleted, which we do once they are no longer needed to restore the Service.

10. Information and audits

We will make available to you the information reasonably necessary to show that we comply with this DPA, and allow for and contribute to audits, including inspections, by you or an auditor you appoint who is bound by confidentiality. We will first try to answer audit requests in writing. Inspections need at least 30 days' notice, may take place at most once a year (unless a supervisory authority requires one or after a personal data breach), must not disrupt our business or put other customers' data at risk, and are at your cost.

11. Liability, term and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, to the extent Data Protection Law allows. This DPA applies for as long as we process Client Data for you. If it conflicts with the Terms of Service, this DPA prevails on matters of data protection. It is governed by the same law as the Terms of Service.

Annex 1: Details of the processing

  • Subject matter: providing the WeDoAnyNail online booking and salon management service to you.
  • Duration: your trial or subscription, followed by the deletion period in section 9.
  • Nature and purpose: hosting and storing data; online booking, appointments and the staff calendar; client accounts and login by text code; sending login codes, booking confirmations, reminders and waiting-list texts through your gateway phone; recording marketing consent; exporting and deleting data; security, support and fixing errors.
  • Data subjects: your clients and people who book with you or join your waiting list; your staff and other users of your staff app.
  • Personal data: names; mobile and landline numbers; postal addresses and dates of birth if recorded; appointment history, treatments, stylists, notes and deposit settings; text messages sent and received and their delivery status; marketing consents with date, source and IP address; client login sessions; staff names, email addresses and working hours; technical data such as IP addresses.
  • Special categories: health information, such as allergies, only where you or your clients enter it, for example in notes. You are responsible for having a lawful basis for it, usually the client's explicit consent.

Annex 2: Technical and organisational measures

  • Separation of customers: every salon's data is tagged with the salon, and the application limits every query to the signed-in salon. We check for data leaking between salons when we deploy new versions.
  • Access control: individual accounts for owners and staff, with separate owner and staff roles; passwords stored only as salted hashes; limits and temporary lockouts after repeated failed sign-ins; client login by one-time codes that expire, with limits on attempts; sessions that expire.
  • Encryption in transit: our websites, booking pages and apps are served over HTTPS.
  • Application security: protection against cross-site request forgery, secure and HTTP-only cookies, filtering of the HTML that salons enter, and rate limits on sign-up and password reset.
  • Infrastructure: servers in the United Kingdom on a private network behind a reverse proxy. Administrative access is limited to authorised personnel of WeDoAnyNail.
  • Payment cards: handled only by Stripe and never stored by us.
  • Monitoring: application logs and error monitoring to detect and fix faults and misuse.
  • Backups: a full database backup is taken before each deployment of a new version and stored with access restricted to authorised personnel.
  • Personnel: only authorised people bound by confidentiality can access Client Data, and only as needed for their work.
  • Incidents: personal data breaches are handled and notified as set out in section 8.

Annex 3: Sub-processors

  • Sentry (Functional Software, Inc., USA): error monitoring. When an error occurs, the report can include details of the request, which may contain Client Data. Location: United States. Safeguard: EU-US Data Privacy Framework and UK Extension, or standard contractual clauses.
  • Google Firebase Cloud Messaging (Google): push messages to your SMS gateway phone. Most messages only wake the app; some can include the recipient's number and the text. Location: United States and other countries where Google operates. Safeguard: Google's data processing terms, with the EU-US Data Privacy Framework and UK Extension or standard contractual clauses.

We host the Service on our own servers in the United Kingdom, so there is no separate hosting provider. Stripe and our email provider only process our own customers' account and billing data, not Client Data. Your gateway phone's mobile network is your own provider, chosen by you.