This Data Processing Addendum ("DPA") supplements the Stylacal Terms of Service. It applies to all processing of Customer Personal Data by Stylacal on behalf of Customer in connection with the delivery of the scheduling Services.
1. Scope, Roles & Subject Matter
Customer acts as the Data Controller (or processor on behalf of a third party) and Stylacal acts as the Data Processor. Stylacal processes personal data solely for the purpose of providing, maintaining, and supporting the scheduling software as instructed by Customer.
- Categories of Data Subjects: Customer's employees, contractors, consultants, and end-clients booking appointments.
- Types of Personal Data: Contact details (names, emails, telephone numbers), booking timestamps, service preferences, intake responses, and attendance records.
2. Customer Instructions & Compliance
Stylacal shall process Customer Personal Data only in accordance with Customer’s documented instructions, including with respect to transfers of personal data outside the European Economic Area, unless required to do so by applicable statutory law.
3. Technical & Organizational Measures (TOMs)
Stylacal implements state-of-the-art technical and organizational measures to ensure a level of security appropriate to the risk:
| Security Domain | Technical Implementation |
|---|---|
| Encryption in Transit | All HTTP and API communications are encrypted using modern TLS 1.3 / TLS 1.2 with strong cryptographic cipher suites. |
| Encryption at Rest | Database volumes, persistent disks, and automated backups are encrypted using AES-256 standard encryption. |
| Logical Multi-Tenant Isolation | Every database query, background job, and export projection is strictly scoped by composite workspace_id and business_id keys, preventing cross-tenant data leakage. |
| Access Control & Authentication | Administrative access requires multi-factor authentication (MFA); client portals use time-bound one-time passcodes (OTP). |
| Egress Security Guard | Outbound network calls (SMTP delivery, webhooks) pass through an egress guard that denies private, loopback, and link-local IP ranges. |
4. Sub-processor Governance
Customer provides general authorization for Stylacal to engage third-party sub-processors to assist in delivering the Services. A current list of approved sub-processors is maintained publicly on our Sub-processors Directory.
Stylacal shall notify Customer of any intended changes or additions to sub-processors at least 30 days in advance. Customer may object to such changes on reasonable data protection grounds within 14 days of receiving notice.
5. Security Incident & Breach Notification (72 Hours)
In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Stylacal shall notify Customer without undue delay, and in any event within 72 hours of becoming aware of the breach. The notification shall describe the nature of the breach, the affected data categories, and the corrective measures taken or planned.
6. Cross-Border Transfers & Standard Contractual Clauses
Where personal data is transferred outside the European Economic Area, Switzerland, or the United Kingdom to countries not recognized as providing an adequate level of data protection, the parties agree to be bound by the European Commission's Standard Contractual Clauses (Module 2: Controller to Processor), incorporated herein by reference.