Data processing agreement
Last updated 25 October 2026
This agreement is part of Henva's salon terms. It applies whenever Henva (“Henva”) handles personal data for a salon (“the salon”). Under the UK GDPR and the Data Protection Act 2018, the salon is the controller and Henva is its processor.
1. What Henva processes
- Whose data: the salon's clients (and guests booked by them), its owner and team, and people who contact the salon through Henva.
- What data: names, mobile numbers, email addresses, bookings and visit history, notes, marketing consent, messages and their delivery, sales and payments (card type and last four digits only), loyalty points, gift cards, waitlist places, check-ins, and the team's rotas, clock-ins, breaks and time off. No special category data is asked for; the salon shouldn't put health or other sensitive details in notes.
- What for: to provide the service in the salon terms: bookings, reminders and other messages, the till, the staff area, reports, and support when the salon asks.
- How long: while the salon uses Henva, then as in section 8.
2. Instructions
Henva processes the data only on the salon's instructions, which are these terms and what the salon does in Henva (for example sending a campaign or deleting a client's details), unless the law requires otherwise, in which case Henva tells the salon first unless the law forbids it. Henva tells the salon if it thinks an instruction breaks data protection law.
3. People
Only people who need to (Henva's team, for support and to keep the service running) can reach the data, and they're bound to keep it confidential. Support visits to a salon's admin are read only and logged.
4. Security
Henva keeps the data safe with measures that include:
- encryption of everything sent to and from Henva (HTTPS) and of the database where it's stored;
- each salon's data walled off from every other salon's by the database itself;
- two-step login for salon owners and Henva's team, and signed-in devices for tills and tablets that the owner can remove;
- an activity log of refunds, voids, device changes, support visits and client deletions;
- bot checks on public forms, and limits on repeated attempts;
- no client names, emails or phone numbers in error reports.
5. Other companies (subprocessors)
The salon agrees that Henva uses the companies below. Each is bound by written terms that protect the data at least as well as this agreement. Henva tells the salon owner before adding or replacing one, and the salon can object; if we can't resolve it, the salon can stop using Henva. Henva stays responsible for them.
| Company | What for | Where |
|---|---|---|
| SupabaseThe database and sign-ins: where all the data is kept | The database and sign-ins: where all the data is kept | London, UK |
| NetlifyRuns the website and the app | Runs the website and the app | USA |
| ResendSends emails | Sends emails | USA |
| The SMS WorksSends text messages, when the salon switches texts on | Sends text messages, when the salon switches texts on | UK |
| Meta (WhatsApp)Sends WhatsApp messages, when the salon switches them on | Sends WhatsApp messages, when the salon switches them on | Ireland and USA |
| SquareTakes card payments on the salon's card machine | Takes card payments on the salon's card machine | UK and USA |
| SentryTells Henva when something breaks (without names, emails or phone numbers) | Tells Henva when something breaks (without names, emails or phone numbers) | Germany (EU) |
| CloudflareChecks that bookings and password resets come from people, not bots | Checks that bookings and password resets come from people, not bots | Worldwide |
Where a company keeps data outside the UK, the transfer is covered by the UK's adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. Helping the salon
- Requests from people: Henva gives the salon the tools to answer them. The owner can download a client's data and delete a client's details from the client record. If a request comes to Henva, we pass it to the salon.
- Breaches: if personal data is lost or reached by someone who shouldn't, Henva tells the salon owner without undue delay, and within 48 hours of finding out, with what we know, so the salon can tell the ICO within its 72 hours where needed.
- Assessments: Henva gives the information the salon reasonably needs for a data protection impact assessment or to talk to the ICO.
7. Checks
Henva gives the salon the information it reasonably needs to show this agreement is being kept, and answers reasonable questions about it. Write to hello@henva.co.uk.
8. Keeping and deleting
The salon instructs Henva to apply these limits automatically:
- clients with no booking, visit, waitlist place or check-in for 3 years are anonymised (name, mobile, email, notes and blocked reason removed);
- the wording of messages is deleted after 12 months;
- raw technical records from payment and messaging companies are deleted after 90 days;
- sales, refunds, payments, day closes and the activity log are deleted after 7 years (HMRC asks for 6 years after the end of the salon's financial year).
When the salon stops using Henva, Henva gives the owner a final export on request and deletes the salon's data within 90 days, unless the law requires Henva to keep it.