LEGAL

Data processing agreement.

Last updated: 11 October 2026

Colour Lab is run by Mateusz Truszczyński, trading as Promptli, a sole trader registered in Poland. Address: Lipcowa 21, 80-178 Gdańsk, Poland. Tax ID (NIP/VAT): PL9570988579. REGON: 383277762. Email: [email protected].

This agreement forms part of the Terms of service. It covers the personal data about your clients and staff that your salon keeps in Colour Lab. Your salon is the controller and we (Promptli) are the processor, as described in Article 28 of the UK GDPR and, where it applies, the EU GDPR.

1. What we process

• Purpose: to provide Colour Lab to your salon: client records, colour formulas, product use and costs, the optional salon diary and optional SMS reminders.
• People: your clients, your staff and other users of your account.
• Data: names, phone numbers, email addresses, appointment and visit history, colour formulas, products used, prices, notes, and staff names and logins. If you record health-related information such as allergies or patch-test results, it is special category data and you must have a lawful basis for it.
• Duration: while the contract lasts, plus the export and deletion period below.

2. Our commitments

We will:

• process the data only on your documented instructions (these terms and your use of Colour Lab), and tell you if we think an instruction breaks data protection law;
• make sure everyone who can access the data is bound by confidentiality;
• keep the security measures in section 3;
• use sub-processors only as set out in section 4;
• help you, as far as reasonably possible, to answer requests from people exercising their rights, and with security, breach notifications, impact assessments and consultations with the ICO;
• tell you without undue delay, and in any case within 48 hours of becoming aware, about a personal data breach affecting your data, with the information we have;
• at the end of the contract, let you export your data for 90 days, then delete it, including from backups, within a further 30 days, unless the law requires us to keep it;
• give you the information needed to show we meet these obligations, and allow reasonable audits on at least 30 days’ notice, at your cost, no more than once a year unless there has been a breach.

3. Security

• Data is encrypted in transit (TLS) and at rest by our hosting providers.
• Each salon’s data is separated by access rules in the database, so users only reach their own salon.
• Access to production systems is limited to the people who need it and protected by strong authentication.
• We keep backups and a separate backup copy of the database in another data centre.
• The tablet app stores your data on the device so it works offline; you are responsible for locking and securing your devices.

4. Sub-processors

You authorise us to use these sub-processors. We will give you at least 30 days’ notice by email before adding or replacing one. If you object on reasonable data protection grounds and we cannot resolve it, you may end the contract without paying for the rest of the minimum term. We make each sub-processor follow data protection obligations equivalent to these.

5. International transfers

Colour Lab data is stored in the EU, which the UK recognises as giving adequate protection. Where a sub-processor handles data in the United States, the transfer relies on the UK Extension to the EU–US Data Privacy Framework for certified providers, or on the UK International Data Transfer Addendum to the EU standard contractual clauses.

6. Liability and order of precedence

The liability terms of the Terms of service apply to this agreement. If this agreement and the Terms conflict on data protection, this agreement wins.

Questions about this agreement: [email protected].