Data Processing Agreement

Last updated: 17 July 2026

This agreement governs how SKYE SYSTEMS LLC, a Wyoming (USA) limited liability company (registration no. 2026-002017903), with registered address at 5830 E 2nd St, Ste 7000 #36958, Casper, Wyoming 82609, USA("Skye", the "Processor") handles personal data on behalf of the salon using it (the "Controller"). It forms part of our Terms of Service and applies whenever Skye processes personal data for the Controller.

1. Roles

The Controller decides why and how its clients' and staff's personal data is processed. Skye processes that data only on the Controller's documented instructions (using the service as intended is such an instruction), and does not use it for its own purposes.

2. What is processed

• Subject matter and duration: provision of the Skye service for as long as the account is active, plus the deletion window below.
• Data subjects: the Controller's clients and staff.
• Data categories: identity and contact details, booking and treatment history (which can be health-adjacent), notes, marketing preferences, and payment/invoice records.

3. Skye's obligations

• Process personal data only on the Controller's instructions, and tell the Controller if an instruction appears to breach data-protection law.
• Ensure people authorized to process the data are bound by confidentiality.
• Apply appropriate technical and organizational security measures (tenant isolation with row-level security, access controls, encryption in transit and at rest, audit logging).
• Assist the Controller in responding to data-subject requests, and with security, breach-notification and impact-assessment duties.
• Make available the information needed to show compliance, and allow reasonable audits.

4. Sub-processors

The Controller authorizes Skye to use the sub-processors listed on our Sub-processors page, under contracts with equivalent data-protection obligations. We give advance notice of changes so the Controller can object.

5. International transfers

Skye is established in the United States and some sub-processors are outside the EEA (Stripe, Postmark, Sentry). Where the Controller's personal data reaches them, transfers rely on an appropriate Chapter V transfer safeguard, being finalized before launch; other data stays in the EU.

6. Personal-data breaches

Skye notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, with the information the Controller needs to meet its own notification duties.

7. Return and deletion

On the end of the service, Skye deletes or returns the Controller's personal data, and deletes existing copies, except where law requires retention (such as invoices). The account-deletion flow provides a 30-day recovery window before permanent deletion.

8. Assisting with data-subject rights

Skye provides tools in the dashboard for the Controller to search, export, correct and erase a client's data, and records that requests were handled. Erasure keeps only the financial records the law requires, with personal details removed.

9. California / US (CCPA/CPRA service provider)

Where and to the extent a Controller is a "business" under the California Consumer Privacy Act (as amended by the CPRA) and serves California consumers, Skye acts as a "service provider"for the personal information it processes on the Controller's behalf, and:

• processes it only for the business purpose of providing the Services, on the Controller's instructions;
• does not "sell" or "share" the personal information (as those terms are defined under the CCPA/CPRA);
• does not retain, use, or disclose it for any purpose other than performing the Services, or outside the direct business relationship with the Controller;
• does not combine it with personal information from other sources, except as a service provider may under the CCPA/CPRA;
• certifies that it understands and will comply with these restrictions; and
• assists the Controller in responding to verifiable consumer requests (access, deletion, correction, opt-out).

The consideration under the Terms is for the Services, not consideration for the sale or sharing of personal information.

Questions: info@skye-app.com.