К содержанию
Master's Kit

На сайт

Privacy Policy

Operator / Controller: GetScale LLP
Address: 010017, Astana, Turkistan street, 14A, Kazakhstan
Registration details: BIN 230940007660
Privacy contact: [email protected]
Website: https://masterskit.com

1. Scope

1.1. This Policy describes how Masterskit processes personal data through its website, accounts, cloud Software, mobile interfaces, APIs, integrations and payment functions.

1.2. Where a salon, studio or professional uses Masterskit to manage its own customer database, that business generally determines the purposes of processing. In that context, Masterskit acts on the Customer's behalf under the DPA.

1.3. For its own purposes — registration, account administration, billing, security, support, compliance with law and management of contractual relations — Masterskit may act as an independent controller. In that role Masterskit acts as a controller within the meaning of the GDPR (Regulation (EU) 2016/679).

2. Data categories

2.1. Depending on the features used, Masterskit may process:

2.2. Masterskit is not a medical information system and is not intended for keeping medical records. The service may be used by aesthetic-medicine clinics and practitioners for booking, customer records and communications. Special categories of personal data (including health information), biometric data and data of minors may be uploaded only where suitable functionality, the Customer's own lawful basis and the safeguards required by law are in place. Providing that basis and those safeguards is the Customer's responsibility.

2.3. Masterskit accounts are intended for users aged 18 or over. Data of minors may be processed only as part of the customer base of a business that enters it on its own lawful basis.

2.4. Masterskit does not make decisions producing legal effects for an individual solely by automated processing and does not carry out profiling within the meaning of Article 22 GDPR. Features operating on business-defined rules (reminders, reports, prompts) run under the Customer's control.

3. Purposes

3.1. Data is used to:

  1. operate and secure the Software;
  2. manage accounts and access rights;
  3. provide CRM, scheduling, appointments, notifications and analytics functionality;
  4. process payments;
  5. provide support and diagnostics;
  6. maintain information security and prevent abuse;
  7. comply with law;
  8. send service notifications;
  9. develop and improve the product on the basis of aggregated or anonymised data where permitted by law.

3.2. Marketing communications are sent only where there is an applicable lawful basis and the consent or opt-out mechanism required by law. Opting out of marketing is available in every mailing and in the account settings; opting out does not affect service notifications about the operation of the service, payments and security.

4. Legal bases

4.1. Depending on the jurisdiction, processing may rely on contract performance, legal obligations, consent, legitimate interests or another lawful basis provided by applicable law.

4.2. Where separate consent is required, it is obtained separately from accepting the Agreement and this Policy, and its text is published separately (Data Processing Consent).

4.3. For the Republic of Kazakhstan, processing relies on the data subject's consent, performance of the contract, legal requirements or another basis expressly provided by the Law of the Republic of Kazakhstan "On Personal Data and its Protection". Legitimate interest is relied on in jurisdictions where it is recognised as an independent basis.

5. Recipients and subprocessors

5.1. Data may be accessed by Masterskit personnel and contractors who need it to perform their work, and by technical providers of:

5.2. Masterskit does not sell salon customer databases as a standalone product and does not transfer personal data for cross-context behavioural advertising. The Do Not Sell / Do Not Share rights under CCPA/CPRA do not apply because no such transfer takes place.

5.3. The current categories of technical providers and, where required, their names and countries are provided on request to [email protected]. Masterskit keeps this list up to date and discloses changes affecting the processing of Customer data.

5.4. Subprocessors are engaged on terms ensuring a level of protection no lower than that provided by the DPA and are liable to Masterskit for processing within the scope of their mandate.

6. Payment data

6.1. Card details are processed by the connected payment provider: Masterskit does not store the full card number or CVV/CVC. Where Masterskit itself processes payment data, the requirements of payment networks and the applicable security standards apply.

6.2. Masterskit may retain a transaction identifier, amount, currency, date, status and a payment token or other technical details necessary for billing and payment confirmation.

6.3. Processing of payment data by the payment provider is subject to that provider's own policy and to payment-network rules.

7. Cookies

7.1. Essential cookies, local storage and session identifiers are used for authentication, security, storing the selected language and core functionality. The service and the website do not work correctly without them, and they do not require separate consent.

7.2. Optional analytics, advertising and similar technologies are used only after consent where required by applicable law. Consent is given and withdrawn through the cookie settings panel on the website; the choice is stored locally in the browser and can be changed at any time.

7.3. Masterskit honours automated opt-out signals (Global Privacy Control, Do Not Track) to the extent required by applicable law.

7.4. Apart from essential technical values stored only in the user's browser, Masterskit does not set optional cookies without the user's consent.

8. International transfers

8.1. Data may be transferred outside the Customer's or the data subject's country where necessary to operate the Software and permitted by applicable law. Masterskit applies a lawful basis and the safeguards required by law for the specific jurisdiction.

Kazakhstan

8.2. The Law of the Republic of Kazakhstan "On Personal Data and its Protection" applies. Where territorial storage requirements apply to specific processing, the relevant database and/or digital object is located in the Republic of Kazakhstan. Cross-border transfers are carried out subject to the requirements of Kazakh law.

EU / EEA

8.3. Where GDPR applies, Masterskit observes applicable controller/processor requirements and uses a lawful Chapter V transfer mechanism where required, including Standard Contractual Clauses (SCC) and, where relevant, the UK Addendum.

United States

8.4. US privacy obligations depend on applicable federal and state law. California CCPA/CPRA requirements apply where relevant; other state regimes apply according to the data and activity concerned.

Other jurisdictions

8.5. Mandatory local requirements apply to the relevant processing in other countries and territories.

9. Retention, export and deletion

9.1. Masterskit retains data for as long as necessary for the stated purposes, contractual obligations, legal requirements and protection of rights.

9.2. Indicative periods (upper bounds unless the law requires otherwise): account data — for the term of the Agreement and up to 3 years after its termination; payment and accounting documents — for the period set by tax law (at least 5 years); technical security logs — generally up to 12 months; support requests — up to 3 years. Data deleted after the export period cannot be restored (License Agreement, section 14).

9.3. Following B2B licence termination, the Customer normally receives 30 calendar days to export available data before deletion from active systems, subject to legal retention.

9.4. Data may be retained longer where required by mandatory law, for accounting/tax purposes, for dispute resolution or to protect rights. Backups are deleted or overwritten according to the actual backup cycle.

10. Data-subject rights

10.1. Depending on the country, individuals may have rights of access, correction, deletion, restriction of processing, consent withdrawal, objection, portability and complaint to a competent authority. Rights are exercised free of charge.

10.2. Requests are sent to [email protected]. Masterskit responds within the period set by applicable law or, where no such period is set, without undue delay and normally within 30 calendar days. Where there are reasonable doubts about the requester's identity, Masterskit may request verification necessary to protect the data.

10.3. Requests concerning a business customer's customer database may be directed to that business, with Masterskit providing technical assistance where required by law or the DPA.

10.4. If a request is refused, the data subject may complain to the authorised personal data protection authority and, in EU/EEA jurisdictions, to a supervisory authority.

10.5. Withdrawal of consent does not affect the lawfulness of processing carried out before it was received and does not stop processing for which Masterskit has an independent basis.

11. Security and incidents

11.1. Masterskit applies technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and unlawful processing.

11.2. Specific measures depend on the actual architecture. Masterskit does not include promises about a particular technology or certificate in this Policy unless they apply.

11.3. Masterskit notifies the Customer of a confirmed personal data incident without undue delay and assists with notification of the competent authority and data subjects within the periods required by law, including 72 hours under Article 33 GDPR where it applies. The party acting as data controller makes the final notification.

12. Changes and contact

12.1. Masterskit may update this Policy by publishing a revised version with an effective date.

12.2. Masterskit gives notice of material changes to this Policy through the website or the account before they take effect where technically practicable. Where a change affects processing based on consent and the data subject does not agree with it, the data subject may withdraw consent.

12.3. Privacy contact: [email protected].