Data processing agreement

This English version is provided for customers outside Poland. It has not yet been reviewed by a lawyer. If anything in it differs from the Polish version, or something is unclear, please contact us at [email protected].

This agreement is part of the Rytuo terms of service. It is concluded when the Salon accepts it on starting to use the app. Version of 2026-10-07.

1. Parties

Controller: the salon or other business using the Rytuo app ("Salon"). Processor: LIFTAYA Sebastian Maćkowski, ul. Kapelanów Wojskowych 1A/26, 44-194 Knurów, Poland, EU VAT ID PL9690838055, which operates Rytuo ("Rytuo"). Contact for data matters: [email protected].

2. Subject matter, nature and purpose of processing

The Salon entrusts Rytuo with processing personal data to the extent necessary to provide the app's services: running the rota and bookings, the client database, handling messages through the Rytuo Assistant (a virtual assistant based on an AI model; website, Messenger, Instagram, WhatsApp), selling vouchers, sending reminders and calculating staff pay. Rytuo processes data only on the Salon's documented instructions, which are the terms of service, this agreement and the Salon's actions in the app. This agreement applies to processing subject to the EU General Data Protection Regulation (GDPR) and, where the Salon is in the United Kingdom or the processing is otherwise subject to it, the UK GDPR and the Data Protection Act 2018.

3. Types of data and categories of data subjects

• The Salon's clients: name, phone, email, visit and payment history, the content of messages to the Salon, marketing consents, visit notes. Health information (for example pregnancy or contraindications) only if the client provides it or the Salon records it in a note.
• The Salon's employees and contractors: name, contact details, rota, number of visits, pay data, time clock records and documents, if the Salon adds them.
• Voucher buyers: name, email; payment data is processed by the payment provider.

4. Duration

For as long as the Salon uses the app. After the contract ends, Rytuo makes a data export available to the Salon for 30 days and then deletes the data, including backups within a further 30 days, unless the law requires it to be kept longer.

5. Rytuo's obligations

• Processes data only to provide services to the Salon; does not use it for its own purposes, advertising or training AI models, and does not combine it with other salons' data.
• Ensures confidentiality: only authorized persons bound by confidentiality have access.
• Applies security measures (Article 32 GDPR / UK GDPR): isolation of each salon's data at database level, encrypted connections (HTTPS), encryption of access tokens, role-based access control, a change log (who changed what and when), daily backups and servers in the EU.
• Helps the Salon respond to data subjects' requests (access, rectification, erasure, portability) and with its obligations under Articles 32 to 36.
• Notifies the Salon of a personal data breach without undue delay, and no later than 36 hours after discovering it, with the information the Salon needs to notify the competent supervisory authority (for example the ICO in the United Kingdom or the authority in the Salon's EU country).
• Makes available the information needed to demonstrate compliance and allows audits at a time agreed in advance, no more than once a year unless there has been a breach.
• At the end of the contract, deletes or returns the data as described in section 4.

6. Sub-processors

The Salon gives general authorization for Rytuo to use the providers listed below. Rytuo informs the Salon by email at least 14 days before adding or replacing a sub-processor; the Salon may object and terminate the agreement. Rytuo imposes the same data protection obligations on its sub-processors.

Messages from Messenger, Instagram and WhatsApp reach Rytuo through the Meta platform on the basis of the connection set up by the Salon; Meta acts towards the Salon under its own terms.

7. International transfers

Where a sub-processor processes personal data outside the European Economic Area or, for UK data, outside the United Kingdom, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework and its UK Extension where the provider is certified) or on the European Commission's standard contractual clauses, with the UK International Data Transfer Addendum for UK data.

8. The Salon's obligations

The Salon is responsible for the legal basis for processing its clients' data (for example performing the service, or consent to marketing), for informing them about the processing and for the accuracy of the data entered into the app. The Salon records clients' marketing consents in the app before sending marketing messages.

9. Liability and final provisions

The parties' liability is governed by Article 82 GDPR / UK GDPR and the terms of service. Matters not covered here are governed by the terms of service, the GDPR (and the UK GDPR where applicable) and Polish law. We announce changes to this agreement by email at least 14 days before they take effect.

Version 2026-10-07. English version published on 9 November 2026.