Data Processing Addendum
This Data Processing Addendum (“DPA”) is part of the Terms of Service between Bell LLC, a Massachusetts limited liability company (“Bell LLC”) and the salon (“Customer”). It applies when Bell LLC processes personal information on the Customer’s behalf (“Customer Personal Data”), such as the names, phone numbers, emails, appointments, notes, signed forms and consent records of the Customer’s clients and staff.
1. Roles
The Customer is the business, controller or owner of Customer Personal Data. Bell LLC is its service provider, processor or contractor, as those terms are used in the California Consumer Privacy Act (as amended) and the comprehensive privacy laws of other states, and the third-party agent under M.G.L. c. 93H and 201 CMR 17.00.
2. Instructions and limits
Bell LLC processes Customer Personal Data only to provide, secure and support the Service, as the Terms and the Customer’s settings instruct, and as the law requires. Bell LLC will not: sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes in the Terms, or outside the direct business relationship with the Customer; combine it with personal information from other sources except as the law allows for service providers; or use it for targeted advertising. Bell LLC certifies it understands and will comply with these restrictions, and will tell the Customer if it can no longer meet its obligations under applicable privacy law, in which case the Customer may take reasonable steps to stop unauthorized use.
3. Confidentiality and personnel
Everyone at Bell LLC with access to Customer Personal Data is bound by confidentiality and has access only as needed. Access to a salon’s account by Bell LLC staff for support is logged with a reason.
4. Security
Bell LLC maintains the safeguards described in Security and a written information security program meeting 201 CMR 17.00, appropriate to the nature of the data.
5. Subprocessors
The Customer authorizes the subprocessors listed on the Subprocessors page. Bell LLC binds each one by written contract to protections at least as strict as this DPA, remains responsible for them, and gives at least 30 days’ notice (by email or on that page) before adding or replacing one. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may cancel the affected service with a pro-rated refund of prepaid fees.
6. Requests from clients
The Service lets the Customer find, export, correct and delete a client’s information. Bell LLC will forward any request it receives about Customer Personal Data to the Customer, and will provide reasonable help for the Customer to respond within legal deadlines, including assistance with data protection assessments where required.
7. Security incidents
Bell LLC will notify the Customer without undue delay, and within 72 hours after confirming a breach of security affecting Customer Personal Data, with the information available about what happened, the data involved, and the steps taken. Bell LLC will help the Customer meet its notification duties under M.G.L. c. 93H and other state breach laws. Unless the law requires otherwise, the Customer decides whether and how to notify its clients and regulators.
8. Return and deletion
The Customer can export its data at any time. Within 30 days after the account ends, Bell LLC deletes Customer Personal Data, except backups (overwritten within 14 days) and records the law requires us to keep, which remain protected by this DPA.
9. Audits
Once a year, or after a security incident, Bell LLC will answer a reasonable written security questionnaire and provide information needed to show compliance with this DPA. On-site audits require mutual agreement on timing, scope, confidentiality and cost.
10. Liability
This DPA is subject to the limitations and exclusions of liability in the Terms, to the extent the law allows.