Data processing agreement

This is a translation for convenience. The German version is legally binding. Deutsche Fassung lesen (read the German version).

§ 1 Parties and conclusion

This agreement is concluded between the salon that creates an account with Kammzeit (controller, "salon") and Ben Oliver Mallow, sole proprietor, also trading under the name InstantNode, Sickinger Straße 7, 55758 Sien, Germany, email kontakt@kammzeit.de (processor, "we", "us").
The agreement is concluded electronically (Art. 28(9) GDPR). The salon accepts it when registering by ticking the box provided for this purpose. It supplements Kammzeit's terms and conditions. In matters of data protection, this agreement takes precedence over the terms and conditions. On request, we will send the salon a copy by email.
This agreement does not apply to data that we process as an independent controller, such as the salon owner's account and billing data and the information on Kammzeit news. Our privacy policy applies to such data.

§ 2 Subject matter, duration, nature and purpose

Subject matter: provision of the online service Kammzeit for the salon: public booking page with the images uploaded by the salon, dashboard with calendar, customer records, services and team, on the Pro plan also staff logins and waiting list, and automatic emails to the salon's customers and staff.
Duration: the term of the contract under the terms and conditions, until deletion under § 12 has been completed.
Nature of the processing: collection (via the booking form, the waiting list form or by input and upload from the salon), storage, display, modification, resizing and re-saving of images, sending of emails (confirmation, reminder, cancellation, call from the waiting list, staff invitation), export, backup and erasure.
Purpose: online appointment booking, appointment management and waiting list for the salon, dashboard access for its staff and presentation of its booking page.

§ 3 Types of data and categories of data subjects

Customers and prospective customers of the salon: name, email address, phone number (if provided), appointments (service, staff member, time, status such as booked, cancelled or no-show, origin of the booking), the salon's notes in the customer records and on appointments, cancellation links, and technical data during booking (IP address, held only briefly in memory for rate limiting).
People on the waiting list: first name, email address (if provided), requested service and, where applicable, staff member, number and status of the entry, times of joining, being called, completion and notification, the random identifier of the status page (also in the kz_queue cookie on the person's device), and technical data (IP address, held only briefly in memory for rate limiting).
Staff of the salon: name, working hours, services offered and assigned appointments. For staff logins also email address, role, language, time of creation and of the last login, and login links and sessions (only as hashes).
People shown in images: images uploaded by the salon (logo, cover image, photo gallery) with their image descriptions, insofar as people can be recognised in them, for example staff or customers of the salon. We remove metadata such as EXIF data and GPS location on upload; it is not stored.
Special categories of personal data (Art. 9 GDPR) are not intended. If the salon records such information in free-text fields, for example allergies or intolerances, it is responsible for the legal basis, usually the explicit consent of the data subject. The measures set out in Annex 1 apply to this information. Kammzeit does not offer further measures, such as separate encryption. The salon decides whether the level of protection is sufficient for its data.

§ 4 Rights and obligations of the salon

The salon is responsible for the lawfulness of the processing, in particular for the legal basis, for informing its customers, people on its waiting list and staff under Art. 13 GDPR, for the consent of people shown in uploaded images, for handling requests from data subjects and for determining how long data is kept.
The salon has the right to issue instructions (§ 5), to request evidence and audits (§ 13), to object to new sub-processors (§ 9) and to choose between return and deletion after the end of the contract (§ 12).
If the salon discovers errors or irregularities in the processing, it informs us without undue delay.

§ 5 Instructions

We process the data only on documented instructions from the salon, including with regard to transfers to a third country, unless we are required to do so by Union or Member State law. In such a case, we inform the salon of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).
Documented instructions are this agreement, the terms and conditions and the salon's settings and actions in the dashboard. The salon issues further instructions in text form from the email address stored in the account. We keep instructions in text form for the duration of this agreement.
If, in our opinion, an instruction infringes data protection provisions, we inform the salon without undue delay. We may suspend its execution until the salon confirms or changes the instruction.

§ 6 No use for our own purposes

We process the data only to provide the service for the salon. We do not sell it, do not pass it on to third parties, do not use it for advertising, analytics or profiling, and do not use it to train AI models.
We only access the content of the data if the salon requests it, if it is technically necessary for operation, backup, restoration or troubleshooting, if there is a specific suspicion of misuse or a security incident, or if the law requires it.
We only respond to requests from authorities or third parties for the salon's data if there is a legally binding obligation under Union or Member State law, and only to the extent necessary. We inform the salon beforehand insofar as this is legally permitted. We handle requests from authorities of a third country in accordance with Art. 48 GDPR.

§ 7 Confidentiality

Only the processor in person has access to the data. If we engage other persons, we commit them in writing to confidentiality before their first access, unless they are under an appropriate statutory obligation of confidentiality, and instruct them in the data protection provisions (Art. 28(3)(b) GDPR). This obligation continues after their work has ended.

§ 8 Security of processing

We implement the technical and organisational measures set out in Annex 1 (Art. 28(3)(c), Art. 32 GDPR).
We develop the measures further in line with the state of the art. We may replace them with equivalent or better measures. The level of protection must not be reduced in the process.
The salon is responsible for the security of its access, in particular of its email mailbox, through which logging in takes place. This also applies to the staff logins it issues: it decides who receives access, only gives access to people who need it for their work, and removes it without undue delay when someone leaves or no longer needs it.

§ 9 Sub-processors

No service provider has access to the content of the data. We operate Kammzeit, the database, the backups and email sending on InstantNode's own systems. The service providers named in Annex 2 provide the data centre and network connectivity. As a precaution, we list them as sub-processors; they are deemed approved upon conclusion of this agreement.
The salon gives us general authorisation to engage further sub-processors (Art. 28(2) GDPR). We will notify the salon by email of any intended addition or replacement at least four weeks in advance. The salon may object within this period for data protection reasons. If there is no reasonable alternative, it may terminate the contract without notice with effect from the date of the change. In that case, we refund fees paid in advance on a pro rata basis.
We impose the data protection obligations of this agreement on every sub-processor by contract (Art. 28(4) GDPR) and are liable for it as for our own actions.
Telecommunications providers that merely transport data and the email providers of the recipients of emails are not sub-processors.

§ 10 Place of processing

We process the data exclusively in the European Union, on servers in a data centre in Eygelshoven (Netherlands). Administrative access takes place from the EU or the EEA. There are no transfers to third countries.

§ 11 Assistance to the salon

Data subject rights: The salon can view, rectify, erase and export its customers' data in the dashboard and thus fulfil requests for access, rectification, erasure and data portability itself. It can remove waiting list entries, images and staff logins in the dashboard. Beyond this, we assist it as far as possible with appropriate technical and organisational measures (Art. 28(3)(e) GDPR). We forward requests from data subjects that reach us directly to the salon within three working days and do not answer them ourselves, unless the law requires otherwise.
Further obligations: Taking into account the nature of the processing and the information available to us, we assist the salon with the security of processing, the notification of personal data breaches, the communication of breaches to data subjects, data protection impact assessments and prior consultation of the supervisory authority (Art. 32 to 36, Art. 28(3)(f) GDPR).
Personal data breaches: We notify the salon of any personal data breach affecting the salon's data without undue delay and at the latest 48 hours after becoming aware of it, by email to the address stored in the account. As far as known, the notification contains the nature of the breach, the categories of data concerned, the approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information may be provided in phases. The salon decides whether the supervisory authority or data subjects are notified.
We may charge a reasonable fee for assistance that goes beyond the functions of the dashboard and a minor effort, after first announcing the expected amount, unless the reason for it lies within our area of responsibility.

§ 12 Deletion and return

During the term, the salon can export and delete its data at any time in the dashboard.
After the end of the contract, the salon may choose between return and deletion (Art. 28(3)(g) GDPR). Return takes place by the salon downloading the data in a common, machine-readable format via the export function before the end of the contract. Uploaded images are listed in the export with their address and can be downloaded from there until the end of the contract.
If the salon deletes its account or the contract ends in any other way, we delete all of the salon's data from the live system. It disappears from the backups as they rotate, at the latest 30 days after the deletion of the account or the end of the contract. We are under no obligation to store this data any longer.
On request, we confirm the deletion in text form.

§ 13 Evidence and audits

We make available to the salon all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR, usually through this agreement, Annex 1 and written information on request (Art. 28(3)(h) GDPR).
If this is not sufficient, the salon may carry out audits, including inspections, itself or through an auditor who is bound to confidentiality and is not a competitor of ours. Inspections must be announced in text form with four weeks' notice, take place during normal business hours, at most once per calendar year, and must not disrupt operations. They do not extend to data of other salons. Access to the data centre is subject to its operator's rules. Audits at the request of a supervisory authority or following a data breach do not count towards the annual limit.
The salon bears the costs of an audit unless it reveals a material breach of this agreement for which we are responsible.

§ 14 Liability

Towards data subjects, the parties are liable under Art. 82 GDPR. Art. 82(5) GDPR applies to recourse between the parties. Otherwise, the liability provisions of the terms and conditions (§ 13) apply. Liability that cannot be limited by law remains unaffected.

§ 15 Term and changes

This agreement applies for as long as the contract for Kammzeit exists and beyond that until deletion under § 12 has been completed. It cannot be terminated separately.
Changes to this agreement are governed by § 15 of the terms and conditions. For sub-processors, § 9 takes precedence. Changes must not reduce the level of protection of the data.
German law applies. The place of jurisdiction is governed by § 16 of the terms and conditions. If a provision is invalid, the rest of the agreement remains valid. The invalid provision is replaced by the statutory provisions, in particular Art. 28 GDPR.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Physical access control

The servers are located exclusively in the data centre of Skylink Data Centers B.V. in Eygelshoven (Kerkrade), Netherlands, with the measures customary there for access control, video surveillance, power supply and fire protection.

System access control

Login to the dashboard, including staff logins, only via a one-time link sent to the email address on file, valid for 15 minutes and usable only once. Kammzeit does not use passwords.
Each staff login has its own email address. If the salon removes a login or deletes the associated staff member, all sessions of that login end immediately. Without a Pro plan or if the staff member is inactive, the login is blocked and current sessions are ended on the next request.
Login links and session identifiers are stored in the database only as SHA-256 hashes.
Sessions expire after 30 days and end immediately on logout. The session cookie is HttpOnly, Secure and SameSite=Lax.
Rate limiting against mass requests, for example for login and booking.
Server administration only by the processor via encrypted connections (SSH).

Data access control

Only the processor has access to servers, database and backups.
A salon account only sees the data of its own salon.
Roles in the salon account: owners have full access. Staff logins only see the calendar, customer records and waiting list and maintain their own working hours. Settings, images, plan, services, team, export and deleting customers are reserved for the owner. Rights are checked on the server with every request.
Waiting list status pages can only be reached via a random address that cannot be guessed. The screen for the salon only shows numbers, no names.
The installable app (service worker) only stores static files on the device, no pages containing customer or account data.
Requests that change data in the dashboard are only possible via POST, and their origin is checked (protection against cross-site request forgery). A content security policy prevents external scripts from being loaded.

Separation control

Tenant separation in the application: each record is assigned to exactly one salon, and every query in the dashboard is limited to the logged-in salon.
Each salon has its own booking page on its own subdomain.
The application runs as its own restricted system user that may only write to its data directory.

Transfer control

All connections to the website, booking pages and dashboard are encrypted with TLS.
Emails are sent via InstantNode's own mail servers in the EU.
No disclosure of data to third parties, no tracking or analytics services, no third-party content on the pages. Links to social networks are plain links without embedded content.
No tracking pixels and no click tracking in emails.

Uploaded images

Only JPG, PNG and WebP are accepted, no SVG (it could contain script). At most 5 MB per image, protection against images with an excessive number of pixels (decompression bombs).
Every image is read on the server, resized and re-saved. In the process all metadata is removed, in particular EXIF data, camera data and GPS location.
The images are stored in the database on the servers in the EU and are included in the backups. They are delivered without cookies; a salon's booking page only serves that salon's own images.

Input control

Appointments store the time of creation and their origin (online booking or entry by the salon). Waiting list entries store the times of joining, being called and completion.
Kammzeit does not store which login (owner or staff) created or changed an entry.
No access logs. Error logs are deleted automatically after 14 days.

Availability control

Regular backups of the database on InstantNode systems in the EU, kept for at most 30 days.
Redundant power supply and network connectivity in the data centre. Filtering of overload attacks (DDoS) at the network edge.

Deletion control

When an account is deleted, all of the salon's data is deleted, including customer records, appointments, waiting list, staff, staff logins, services, images, login links and sessions. Backups rotate after at most 30 days.
Expired sessions are deleted automatically.
Waiting list entries are deleted automatically, at the latest on the day after they were made.

Organisational measures

Access only by the processor; other persons only after a written commitment to confidentiality (§ 7).
Review of the measures whenever the system changes significantly.
Defined procedure for data breaches, including notification of the salon (§ 11(3)).

Annex 2: Sub-processors

None of these service providers has access to the content of the data. Data traffic is encrypted with TLS.

Skylink Data Centers B.V., Eygelshoven (Kerkrade), Netherlands. Purpose: data centre, colocation, power and physical network infrastructure for InstantNode's servers. Location: EU (Netherlands), no transfer to third countries.
Ferdinand Zink, trading as Tube-Hosting, Schlesierstr. 7, 97631 Bad Königshofen i. Grabfeld, Germany. Purpose: connecting InstantNode's IP addresses to the internet and filtering overload attacks using PletX technology (processes only connection and traffic data such as IP addresses, no content), and provision of rented servers in the same data centre. Location: EU (data centre in Eygelshoven, Netherlands; registered office in Germany), no transfer to third countries.

The payment service provider Stripe only processes the salon's billing data, as an independent controller, and no data of the salon's customers. It is not a sub-processor.