Parties and roles
The salon customer is the controller and Reserveira, operated by Galleira Studio, is the processor for personal data submitted to the salon workspace or public booking flow. This addendum forms part of the Reserveira Terms. Each party will meet the obligations that apply to it under the GDPR and applicable data-protection law.
Processing details
Processing lasts for the subscription and the deletion period. Its purpose is to host salon settings, calculate availability, create and manage appointments, send notifications, support connected messaging, prevent abuse, and provide support. Data subjects include salon clients, staff, owners, and contacts. Data can include identity and contact details, appointment and service details, availability, messages, account identifiers, and audit information. Salons must not submit special-category data unless a separate lawful arrangement and safeguards are in place.
Instructions and confidentiality
Reserveira will process personal data only on the salon’s documented instructions expressed through use of the service, these terms, and support requests, unless law requires otherwise. People authorised to process the data are bound by confidentiality and receive access only where needed.
Security
Reserveira maintains proportionate technical and organisational measures including encrypted transport, encrypted integration credentials, role-based access, mandatory multi-factor authentication, tenant-isolating database policies, private booking tokens, logging, dependency review, backups, rate limits, and incident procedures.
Sub-processors and transfers
The salon gives general authorisation for the providers on the Sub-processors page. Reserveira imposes data-protection obligations appropriate to their services and remains responsible for its processor duties. Material additions will be published in advance. Valid objections should be sent promptly to nagiyev@galleira.studio. Restricted transfers use an adequacy decision or approved safeguards, including Standard Contractual Clauses where applicable.
Assistance
Taking into account the nature of processing, Reserveira will reasonably assist the salon with data-subject requests, security assessments, breach duties, and regulator enquiries. If Reserveira receives a request concerning salon-controlled data, it will direct the request to the salon unless prohibited by law.
Incidents
Reserveira will notify the salon without undue delay after becoming aware of a personal-data breach affecting salon-controlled data and provide information reasonably available about its nature, likely consequences, affected data, and mitigation. The salon remains responsible for notifications it is legally required to make.
Return and deletion
At the end of the service, Reserveira will delete or return salon-controlled data on request unless law requires retention. Operational data is removed according to the deletion procedure; isolated backups expire on their normal cycle. Reserveira may retain only the limited records needed for legal claims, security, or statutory accounting.
Evidence and audits
Reserveira will make information reasonably necessary to demonstrate compliance available to the salon. Audits should use existing reports first, protect other customers and system security, occur during normal business hours, and be limited to once annually unless an incident or regulator requires more.
Priority
If this addendum conflicts with the general Terms on processing personal data, this addendum controls. Mandatory data-protection law always prevails.