Data Processing Agreement

This agreement is part of the Terms of Service. It covers the personal data of your clients that Miali processes for you, and applies under Kenya's Data Protection Act, 2019 and similar laws elsewhere. By using Miali for your business, you agree to it.

1. Who Is Responsible for What

• You are the data controller for your clients' data: you decide which clients you add, what you record about them and how you contact them.
• Miali is your data processor: it stores and uses that data only to provide Miali to you, following your instructions as you give them through the app.
• For your own account data (your sign-in, billing and usage), Miali is the controller. See the Privacy Policy.

2. What Miali Processes for You

• Client names, WhatsApp numbers, email addresses and dates of birth.
• Notes, formulas and preferences, and allergy and sensitivity notes. Allergy notes are health information and can only be saved once you confirm the client agreed.
• Appointments, payments, rewards, packages, reviews and photos clients upload to their booking.
• Phone numbers from bookings a client started but didn't finish.
• Whether a client agreed to offers, and any request to stop messages.

Miali uses this data to run your bookings, send confirmations, reminders and the messages you choose to send, and show you your records and reports. It never sells it or uses it to market to your clients itself.

3. What Miali Commits To

• Your instructions only: Miali processes your clients' data only to provide the service, unless the law requires otherwise.
• Confidentiality: only people who need to, for support or to keep Miali running, can access it, and they are bound to keep it confidential.
• Security: data is only reachable through Miali's own servers, encrypted in transit, and stored with providers that encrypt it at rest. Links in messages use signed or random ids so they can't be guessed.
• Helping with client requests: from a client's profile you can download their data, correct it, pause Miali's messages to them, record whether they agreed to offers, and delete them. Clients can also reply STOP on WhatsApp or unsubscribe from emails themselves.
• Breaches: if a breach affects your clients' data, Miali tells you without undue delay, and where possible within 48 hours, with what is known, so you can meet your own duty to notify the Data Protection Commissioner within 72 hours.
• Providers: Miali uses the providers listed below and holds each to data protection terms at least as protective as this agreement. We update this list before adding a provider and announce changes in the app.
• Deletion: when you delete your account, your clients' data is deleted after the grace period described in the Terms of Service. You can export it first from account settings.

4. Your Responsibilities

• Only add clients you have a relationship with, and keep their details accurate.
• Tell clients you use Miali to manage bookings. Your booking page and Miali's emails already say so.
• Only send offers, rebooking reminders and review requests to clients who agreed. Miali enforces this for the messages it sends, using the consent you record.
• Honour any client request to see, correct or delete their data, or to stop messages.
• Register with the Office of the Data Protection Commissioner if the law requires it for your business. Most independent beauty professionals are exempt, but health services (for example IV therapy or medical skin treatments) must register.

5. Transfers Outside Kenya

Miali's providers store or process data outside Kenya, in the countries listed below. Miali relies on each provider's data protection terms and security safeguards for these transfers, as Kenya's Data Protection Act allows.

6. Providers (Subprocessors)

7. Contact

Questions about this agreement or a data request? Email privacy@miali.app.