# Data Processing Addendum

The Data Processing Addendum for salons that use UNLIMOS, provided by Alison LLC.

## Scope and Roles

This Data Processing Addendum (DPA) applies to the processing of personal data by Alison LLC d/b/a UNLIMOS on behalf of the customer under GDPR, UK GDPR, and CCPA/CPRA.

Customer is the Controller; UNLIMOS is the Processor / Service Provider. UNLIMOS processes customer personal data solely under documented customer instructions to provide the service.

This addendum is part of the Terms at /terms. It implements GDPR Article 28 and CCPA/CPRA service-provider obligations for customer personal data processed in UNLIMOS. UNLIMOS remains an independent controller for account, authentication, billing, security, and its own site. See /privacy#roles.

## Security & Subprocessors

UNLIMOS implements technical and organizational measures to ensure data security, including encryption in transit and at rest, strict tenant separation, access control, and prompt breach notification.

UNLIMOS engages authorized subprocessors (Cloudflare for infrastructure, messaging carriers, payment providers) under data protection obligations at least as restrictive as this DPA.

## Data Subject Rights & Deletion

UNLIMOS assists customers in responding to data subject requests to access, rectify, or erase personal data.

Upon termination of services, UNLIMOS deletes or returns customer personal data in accordance with our data retention and deletion schedule.

## Instructions

The customer instructs UNLIMOS to process customer personal data to provide the service as configured in the product, including integrations the customer enables. The Terms, this addendum, the Privacy Policy, and in-product settings are the documented instructions. UNLIMOS will not process customer personal data for its own marketing or to sell personal information.

## Confidentiality and security

Persons authorized to process customer personal data are bound to confidentiality. Measures include encryption in transit, encryption at rest for stored service data, access controls, encrypted integration secrets such as Instagram and WhatsApp access tokens, and tenant separation. We do not store payment card numbers.

## Subprocessors

The customer authorizes subprocessors under written terms that flow down equivalent obligations. UNLIMOS remains responsible for subprocessors. A current list is available on request at legal@unlimos.com.

## Assistance

Taking into account the nature of processing, UNLIMOS assists the customer with data-subject requests, security incidents affecting customer personal data, and impact assessments where required, primarily through product tools and reasonable cooperation. End-customer CRM requests should usually start with the salon.

## Deletion and return

On termination of the service, or on the customer’s written request, UNLIMOS deletes or returns customer personal data, excluding independent-controller data and lawful retention copies, within a commercially reasonable period. Meta Platform Data follows Meta terms: promptly, and within 90 days of a valid trigger. See /legal/data-deletion.

## International transfers

Where customer personal data is transferred internationally, the parties use appropriate safeguards, including standard contractual clauses where required. Details are available on request from legal@unlimos.com.

## Liability

Liability under this addendum follows the limits in the Terms, except where mandatory law provides otherwise. The customer’s indemnity for unlawful instructions and messaging remains as stated in the Terms.

Canonical: https://unlimos.com/legal/dpa