Data subjects: salon end-clients; salon employees/stylists; suppliers and contacts the Controller records.
Categories of personal data: contact details (name, email, phone), identifiers (client number), appointment history, services, invoices, payments, notes, photos, preferences, gift-card and loyalty balances, email/WhatsApp communication, reviews.
Special categories (Article 9 GDPR) - such as health notes (allergies, medication, skin conditions, pregnancy) - are stored in a dedicated encrypted vault, separated from regular client notes. The Processor applies the following additional safeguards:
• AES-256-GCM envelope encryption using a per-tenant data key, which is itself wrapped at rest with a platform master key.
• The master key is held exclusively in environment variables, separate from database backups; loss of the key renders all vault data permanently unreadable.
• Role-based access control through a dedicated permission flag (can_view_health_notes), auditable per membership; admins are not automatically passed through.
• Immutable access log: every read, write, download and deletion is recorded with actor, IP address and timestamp, and retained for 24 months.
• Default retention of 12 months + 30-day grace period, configurable per note by the Controller.
• Platform impersonation is technically blocked on the health-data routes (defence-in-depth).
The Controller remains responsible for establishing and documenting the appropriate legal basis under Article 9(2) GDPR (typically explicit consent or vital interests). The Processor provides the technical facility to record, prove and withdraw such consent through a separate consent-event log. See the "art9-health-data-vault" runbook for technical details.