К содержанию
Master's Kit

На сайт

DPA / Data Processing Agreement

Customer / Controller: the entity stated in the Agreement or the Order. This public version is a template: the Customer's name is inserted when a specific business is onboarded.
Masterskit / Processor: GetScale LLP, BIN 230940007660
Processor address: 010017, Astana, Turkistan street, 14A, Kazakhstan
Contact: [email protected]

1. Purpose and roles

1.1. This DPA forms part of the Masterskit License Agreement and applies where Masterskit processes personal data on behalf of the Customer.

1.2. The parties' roles are determined by applicable law and the specific processing activity. B2B status under the License Agreement does not by itself determine a party's role in relation to personal data.

1.3. For the customer database of a salon, studio or professional, the Customer generally determines the purposes and means of processing, and Masterskit acts as a processor or authorised person in the relevant legal sense.

1.4. The DPA applies from the start of processing until its termination, including the export and deletion period under section 12.

2. Documented instructions

2.1. Masterskit processes Customer Data only for:

2.2. The Customer gives documented instructions through this DPA, the Order, feature settings and separate written instructions. Masterskit processes data within the scope of those instructions.

2.3. If an instruction of the Customer, in Masterskit's reasonable opinion, infringes applicable law, Masterskit promptly informs the Customer and may suspend performance of the instruction until it is confirmed, amended or withdrawn.

2.4. Masterskit does not sell Customer Data and does not use it for its own behavioural advertising or for training third-party models where such use is incompatible with its role as processor.

3. Data subjects and categories

3.1. Subjects: salon/professional customers, the Customer's employees and representatives, account users and business contacts.

3.2. Data: names, contact details, appointments and services, interaction history, technical data, notes, documents and photographs uploaded by the Customer.

3.3. Special categories of data, biometric and medical information, and data of minors must not be transferred without suitable functionality, a lawful basis held by the Customer and the safeguards required by law.

4. Masterskit obligations

Masterskit shall:

  1. maintain confidentiality;
  2. restrict access on a need-to-know basis;
  3. bind personnel and contractors to confidentiality;
  4. implement the technical and organisational security measures actually in place;
  5. provide reasonable assistance to the Customer where required by law;
  6. notify the Customer of a confirmed personal-data incident without undue delay and, unless applicable law requires a shorter period, normally no later than 5 business days after confirmation of the incident;
  7. assist the Customer in responding to data-subject requests;
  8. assist with data protection impact assessments and prior consultations with the competent authority where required by law;
  9. handle requests from public authorities within the limits of law and inform the Customer of such requests unless the law prohibits notification;
  10. after termination of the licence, ensure return/export and deletion in accordance with the Agreement and law.

5. Customer obligations

The Customer:

  1. determines the purposes and lawful bases of processing;
  2. provides lawful documented instructions;
  3. provides required notices and consents;
  4. remains responsible for the lawful collection and transfer of data to Masterskit;
  5. ensures the accuracy and currency of its customer database;
  6. does not instruct processing of data prohibited by applicable law or the Agreement;
  7. has the right to transfer the data to Masterskit and does not thereby infringe third-party rights;
  8. concludes a separate arrangement with Masterskit where required for special categories of data.

6. Subprocessors

6.1. Masterskit may engage subprocessors from the current list disclosed in the interface, on the website or on request to [email protected].

6.2. The Customer gives general authorisation to engage subprocessors where applicable law permits.

6.3. Masterskit imposes the necessary data-protection obligations on subprocessors and is liable to the Customer for their engagement.

6.4. For GDPR, the Customer may object to a new subprocessor on reasonable data-protection grounds within 15 calendar days after notification, where such a mechanism applies to the relevant processing.

6.5. If the objection is justified and the parties do not find another solution, the Customer may terminate the relevant feature or the Agreement; the unused part of the paid period is refunded pro rata.

6.6. Masterskit gives advance notice of new subprocessors affecting the processing of Customer data through the interface, the website or by e-mail where technically practicable.

7. International transfers

7.1. International transfers take place only on a lawful basis and with the safeguards required by law.

7.2. For the EEA, a GDPR Chapter V mechanism applies, including Standard Contractual Clauses (SCC) where necessary and the UK Addendum where applicable.

7.3. For Kazakhstan, the requirements of the Law "On Personal Data and its Protection" apply, including territorial storage and cross-border transfer requirements.

7.4. For the United States, applicable processor/service-provider requirements are determined by federal and state law; California CCPA/CPRA applies where relevant.

7.5. For other jurisdictions, mandatory local requirements apply to the relevant processing.

7.6. On the Customer's request, Masterskit provides information about the transfer mechanism applicable to a specific subprocessor.

8. Security

8.1. Masterskit applies technical and organisational measures appropriate to the actual processing risk.

8.2. Such measures may include access management, authentication, protection of transmission channels, logging, backup, vulnerability management and incident response — only to the extent that the relevant measures are actually in place.

8.3. A detailed internal description of the architecture is not part of the public DPA where its disclosure could create additional security risk.

8.4. Masterskit personnel with access to Customer Data are bound by confidentiality obligations that survive the end of their work with the data.

9. Data-subject requests

9.1. Where a request concerns Customer Data processed on the Customer's behalf, Masterskit may direct the individual to the Customer and provides reasonable technical assistance where required by law or this DPA.

9.2. Assistance covers the available tools for searching, exporting, correcting and deleting data in the interface and is provided within a period allowing the Customer to meet its legal requirements.

9.3. The Customer, as the party determining the purposes of processing, is responsible for responding to the data subject.

10. Incidents

10.1. Masterskit notifies the Customer of confirmed personal-data incidents without undue delay.

10.2. Unless applicable law requires a shorter period, notification is sent normally no later than 5 business days after confirmation of the incident. A shorter period set by law for the controller is not breached provided Masterskit notified the Customer without undue delay after confirmation of the incident.

10.3. The notification contains the information available at the time: the nature of the incident, the categories and approximate volume of affected data and subjects, possible consequences, measures taken and proposed, and a contact point. The notification may be supplemented as the investigation progresses.

10.4. Masterskit provides reasonable assistance to the Customer in meeting its obligations to notify the competent authority and data subjects where required by law.

11. Information and audits

11.1. Masterskit provides information reasonably necessary to demonstrate compliance with this DPA.

11.2. On the Customer's reasonable request and with reasonable prior notice, an audit may be carried out on business days without creating a security or confidentiality risk for other customers; the auditor is bound by confidentiality.

11.3. Routine physical audits are not included in standard self-service plans; extended enterprise procedures may be agreed separately.

12. Return and deletion

12.1. The Customer normally has 30 calendar days after termination to export available data.

12.2. After that period Masterskit may delete data from active systems, except data that must be retained by law, for accounting/tax purposes, to protect rights or to resolve a dispute.

12.3. Backups are deleted or overwritten according to the actual backup cycle.

12.4. On the Customer's request, Masterskit confirms the deletion of data processed on its behalf from active systems.

12.5. The Customer is responsible for exporting its data in good time within the period stated in clause 12.1.

13. Priority

13.1. Mandatory local law prevails over the general DPA terms where required, and stricter mandatory requirements of the relevant jurisdiction take precedence.

13.2. For the processing of personal data, the DPA prevails over the License Agreement in the event of a conflict.