Skip to main content

Westly terms for salons

Version 2026-10-13

In force from 13 October 2026

1. Who we are and this contract

1.1 Westly is a trading name of Digital Kingston Limited, a company registered in England and Wales (company number 14023080), of Unit C2, Boulevard Industrial Estate, Hull, HU3 4BA. Our VAT number is GB415031251. We are registered with the Information Commissioner’s Office under number ZB586560.

1.2 You can contact us at support@westly.uk, or through the form at westly.uk/contact.

1.3 Businesses only. These terms are a contract between us and the business that signs up to Westly (“you”). Westly is for use in a trade or business only. By accepting these terms you confirm that you are acting for your business and not as a consumer, including if you are a sole trader.

1.4 Accepting these terms. You accept these terms by ticking “I agree” when you go live on Westly. We record the version you accepted, the date and time, and the person who accepted. The person who ticks the box confirms that they have authority to bind the business.

1.5 What makes up the contract. The contract consists of:

If they conflict, Schedule 1 wins on personal data. Otherwise these terms win over the Schedules.

2. Definitions and interpretation

2.1 In these terms:

  • Account means your business’s account on Westly, including every location, team member and setting under it.
  • Account owner means the person who holds the owner role on your Account.
  • Bookable team member means a team member who:
    • can take appointments;
    • is active;
    • has not been archived.
    Receptionists, managers who do not take appointments, and people who have left are not counted.
  • Customer means a member of the public who books with you, or whose details you hold on Westly. Your Customers are not party to this contract.
  • Customer Data means personal data about your Customers and your team that:
    • you, your team or your Customers put into Westly; or
    • Westly creates in providing the Service to you, such as appointment history and message logs.
  • Data Protection Law has the meaning in Schedule 1.
  • Deposit means a card payment a Customer makes when booking online, paid into your own Stripe account (clause 7).
  • Event outside our control has the meaning in clause 17.3.
  • Fees means the charges in clause 5 and Schedule 2.
  • Go live means finishing setup in Westly so that your Account becomes active.
  • Invoice means the monthly VAT invoice we send you, numbered WST-INV-000001 onwards.
  • Marketing messages means messages that promote your business, offers or services, including rebook reminders, birthday offers and campaigns.
  • Service means:
    • the Westly booking, diary, customer, till and messaging software;
    • your public salon page;
    • everything we provide with them.
  • Service messages means texts and emails about a specific booking, such as confirmations, reminders, cancellations and changes of time.
  • Working day means Monday to Friday, except public holidays in England.
  • We, us and Westly mean Digital Kingston Limited.

2.2 “Including” means “including without limitation”. Headings do not affect meaning. “Writing” includes email. A reference to a law includes that law as amended or replaced.

3. The Service, your Account and roles

3.1 What Westly does. Westly gives you:

  • an online diary and a customer list;
  • a till that records what Customers pay you;
  • a public salon page with online booking;
  • automatic emails and, where switched on, texts to your Customers;
  • a monthly invoice for what you owe us;
  • optional card deposits.

3.2 What Westly is not. Westly is a software tool. We are not party to any contract between you and your Customers. You set your own services, prices, opening hours and cancellation policy. You alone are responsible for the treatments you provide, for your premises, and for your insurance.

3.3 Your public page. Your salon page shows the details you enter. You are responsible for:

  • their accuracy, including prices;
  • having the right to use any photos and text you upload.

3.4 Roles. The roles on your Account are:

RoleIn summary
OwnerEverything, including connecting Stripe, downloading all your data and closing (archiving) the Account.
AdminRuns the salon day to day, including team, settings, money and seeing Westly’s invoices. Cannot close the Account.
ManagerRuns the diary, customers and team rotas.
ReceptionistBookings, check-in and the till.
StaffTheir own diary and the customers they see.

The exact permissions of each role are shown in Westly, and we may refine them.

3.5 Your team’s logins. Each person must have their own login. You are responsible for:

  • who you invite;
  • the role you give them;
  • removing people who leave.

Anything done under your Account’s logins counts as done by you, unless it was done by someone who got in because of our failure.

3.6 Our staff. Westly staff can see Accounts only to provide support, billing, security and the Service. Their access is recorded in an audit log.

3.7 Options we switch on. Some features are switched on for your Account when you ask, such as texts and card deposits. We may switch an option off:

  • on 14 days’ notice; or
  • at once, if it is being misused or puts Customers, other salons or the Service at risk.

3.8 Test accounts. Accounts we mark as test or demo accounts are never billed, and we may change or remove them.

4. Starting

4.1 There is no free trial. You can set up your Account free of charge. Your Account becomes billable when you go live.

4.2 The first month is a full month. Your first invoice covers the whole calendar month in which you go live. We do not charge a part month.

5. Fees

5.1 Every price includes VAT at 20%. The figures in this clause and in Schedule 2 are what you pay. Each invoice shows how much of each line is VAT.

5.2 Monthly subscription. You pay according to the number of bookable team members on your Account:

  • £7.50 a month if you have one bookable team member, or none;
  • otherwise, £4.50 for the first and £5.00 for each one after that.

Schedule 2 has worked examples.

5.3 When we count. We count your bookable team members when we prepare each month’s invoice, and that number is used for the whole month. There is no part-month adjustment for people who join or leave during the month.

5.4 New client fee: £4.00. We charge this once for a Customer when all of these are true:

  • (a) the Customer came to you through Westly’s own directory or discovery pages. A Customer who came through your own booking link, your staff, an import or a referral does not count;
  • (b) they had never had a completed visit with you before;
  • (c) their first appointment is marked completed.

We never charge it for:

  • a cancellation or a no-show;
  • a Customer you already had;
  • a Customer you brought yourself.

We charge it at most once for each Customer at your salon. If a completed visit is undone, we credit the fee. How a Customer came to you is recorded when their record is first created, and is shown on your invoice breakdown.

5.5 Texts. Each month you get 25 texts per bookable team member included, and at least 25. The allowance:

  • is shared across your Account;
  • does not roll over.

Each text after that costs 6p. Every text is kept to one standard segment, so one text is one charge. A text that is not sent is never charged; for example, one held back by the limits in clause 8.6. Emails are not charged.

5.6 Card deposit fee: 10%. If you take card deposits (clause 7), we charge 10% of each deposit your Customer pays. For example, on a £20.00 deposit the fee is £2.00, of which £0.33 is VAT.

  • The fee goes on your monthly invoice. It is never taken from the deposit.
  • If the deposit is refunded, we do not charge the fee, or we credit it if it has already been invoiced.
  • The deposit fee and the new client fee are separate. Both can apply to the same first visit.

5.7 Price changes. We may change our prices by giving you at least 30 days’ notice by email.

  • A change applies from the first month that begins after the notice ends.
  • It never changes an invoice for a month already open or closed.
  • If you do not accept it, you may close your Account before it applies (clause 15.2), and you will not pay the new price.

5.8 Change in VAT. If the rate of VAT changes, we may adjust our prices from the date of the change so that our price before VAT stays the same. We will tell you as soon as we reasonably can.

5.9 Card fees on deposits. Stripe charges you its own card fees under your agreement with Stripe. They are not Westly’s Fees.

6. Invoices and payment

6.1 Monthly in arrears. After the end of each calendar month we issue you a VAT invoice for that month. It covers:

  • the subscription;
  • new client fees;
  • texts beyond your allowance;
  • deposit fees;
  • any credits.

6.2 The invoice. Each invoice has a unique number, our details and VAT number, your billing name and address, each line, and the VAT. You can see each invoice in Westly under Billing, with:

  • a breakdown of every new client fee;
  • every text, day by day.

We email the Account owner when an invoice is ready.

6.3 Credit. If an invoice’s credits are more than its charges, the invoice is £0.00 and the rest is carried forward to your next invoice. We do not pay out credit in cash, unless your Account closes with credit remaining, in which case we refund it to you.

6.4 How to pay. Each invoice, and the email that comes with it, says how to pay:

  • (a) by bank transfer to Digital Kingston Limited, Starling Bank, sort code 60-83-71, account 66265618, quoting your invoice number; or
  • (b) by card, through our Stripe payment link shown on the invoice, entering your invoice number. You pay Stripe directly. We never see your card.

We do not take Direct Debit or keep your card on file.

6.5 When payment is due. Each invoice is due within 14 days of its date. A payment is applied to the invoice whose number it quotes. A payment that quotes no number is applied to your oldest unpaid invoice.

6.6 Late payment. If you pay late, we may claim interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998.

6.7 Disputing an invoice. If you think an invoice is wrong, tell us at support@westly.uk within 30 days of its date, saying which line and why. You must pay the parts you do not dispute on time. We will check the records behind the line and tell you what we find. If we got it wrong, we will correct it by a credit. If you do not dispute an invoice within 30 days, it is treated as accepted. This does not apply to an obvious error, or to one caused by our fault.

6.8 Chargebacks. If a card payment for an invoice is reversed, the invoice is unpaid again.

6.9 No set-off. You must pay invoices in full, without deducting anything we owe you, except a credit shown on the invoice itself.

6.10 Suspension for non-payment. If an invoice is still unpaid 30 days after it was due, we may suspend your Account, after giving you at least 7 days’ further notice by email. While it is suspended:

  • (a) your public page and online booking are offline;
  • (b) you and your team can still sign in, see your diary and download your data;
  • (c) nothing is deleted and no appointment is cancelled. We do not contact your Customers. You remain responsible for the bookings already in your diary;
  • (d) we do not charge the subscription for a month if your Account is suspended when that month’s invoice is prepared.

We will lift the suspension within one working day of receiving everything that is overdue.

7. Card deposits

Not yet available; terms for them will be added before they are offered.

8. Texts and emails to your Customers

8.1 We send on your behalf. Westly sends emails, and where texts are switched on for your Account, texts, to your Customers about their bookings. Texts:

  • come from the sender name “Westly”;
  • name your salon;
  • go to UK mobile numbers only;
  • cannot be replied to.

8.2 Service messages. These are:

  • booking confirmations;
  • reminders;
  • cancellations;
  • changes of time;
  • one review request after a visit, at most once a month for each Customer.

We send them unless the Customer has turned reminders off. You can choose not to notify the Customer when you make, move or cancel a booking yourself. No Service message contains marketing.

8.3 Marketing messages are yours. You are the sender of your Marketing messages. Under PECR, the law that governs marketing texts and emails, you are the person who instigates them. Westly only provides the technical means of sending. Westly sends a Marketing message only to Customers marked as agreeing to marketing from your salon, and every one includes a way to stop. You are responsible for:

  • (a) having the Customer’s consent, or the “soft opt-in”, before you mark them as agreeing;
  • (b) recording consent accurately, including consent you import;
  • (c) what your Marketing messages say.

8.4 Content. You must not use Westly messages for anything unlawful, misleading or offensive, or that is not about your salon.

8.5 Delivery. Networks and email providers can delay or block messages. A number the network reports as dead is not texted again. Do not rely on a Westly message as the only way an important message reaches a Customer.

8.6 Limits. Westly limits texts in any 24 hours, to protect Customers and your bill:

  • 8 to any one mobile number. Cancellation and change-of-time texts are exempt, so a Customer never misses one;
  • 300 from any one salon;
  • 2,000 across Westly.

A text over a limit is not sent and not charged. We may change these limits to protect the Service.

9. Your obligations

9.1 You must:

  • (a) give accurate business, billing and contact details, and keep them up to date;
  • (b) keep logins secret and use the roles sensibly;
  • (c) follow the law that applies to your business, including:
    • data protection;
    • marketing (PECR);
    • consumer and equality law;
    • the law on the treatments you provide;
  • (d) give your Customers a privacy notice that says you use Westly;
  • (e) upload only content you have the right to use;
  • (f) keep your own copy of any record the law requires you to keep, such as your takings for tax (clause 11.4).

9.2 You must not:

  • (a) use Westly to send spam or unlawful messages;
  • (b) try to get into another salon’s data, test our security without our written permission, or overload the Service;
  • (c) copy, resell or reverse-engineer the Service, or scrape it with automated tools;
  • (d) upload malware, or content that is unlawful, defamatory, hateful or sexually explicit;
  • (e) make fake bookings, or record a Customer’s source falsely to avoid the new client fee;
  • (f) put health or other special category data into Westly beyond what you need to treat a Customer safely, such as an allergy, a patch-test result or a consultation note (Schedule 1, paragraph 5.4).

9.3 If you breach this clause, we may switch off a feature or suspend your Account. We will tell you why and give you 7 days to put it right first, unless the breach is serious or urgent or cannot be put right.

9.4 Security and legal suspension. We may suspend all or part of the Service for your Account at once if we reasonably need to:

  • protect the Service, other salons or Customers;
  • comply with the law, a court or a regulator.

We will tell you why and restore the Service as soon as the reason has gone.

10. Data protection

10.1 For Customer Data, you are the controller and Westly is your processor. Schedule 1 sets out how we process it.

10.2 Westly is a controller in its own right for:

  • (a) your business’s own account, billing and contact information;
  • (b) the Westly accounts Customers create themselves: their login, their details shared across salons, their favourites and their own visit photos;
  • (c) Westly’s directory and discovery pages, and the record of which Customers Westly introduced to you (clause 5.4);
  • (d) security logs, fraud and abuse prevention, and our own legal and tax records.

Our privacy notice at westly.uk/privacy explains how we use that information.

10.3 We will not sell Customer Data, use it to market other salons to your Customers, or give it to another salon.

11. Availability, support, backups and quality

11.1 Availability. We work to keep Westly available and to fix faults promptly, but we do not promise any uptime figure or response time. We may take Westly offline for maintenance. Where we can, we will do it outside normal salon hours and give notice.

11.2 Support. Support is by email at support@westly.uk and through the contact form. We aim to reply within one working day. That is an aim, not a promise.

11.3 Backups. We back up the whole Westly database every night and keep encrypted copies off-site (Schedule 1, Annex 2). A backup protects against the loss of the whole system. It is not a way to restore a single record you deleted. In a disaster, up to about 24 hours of data could be lost.

11.4 Keep your own records. You should download your data regularly (Salon → Your data), and keep your own copy of any record the law requires you to keep.

11.5 Changes to the Service. We may change, add or remove features. If we remove a feature you pay for, or make a change that substantially reduces the Service, we will give you at least 30 days’ notice. You may then close your Account, and you will not pay for the period after the change.

11.6 Our promise about quality. We will provide the Service with reasonable care and skill. Apart from that promise, and those in Schedule 1, the Service is provided as it is. We exclude every other term, condition or warranty, whether implied by law or otherwise, as far as the law allows. In particular, we do not promise that the Service will be uninterrupted or free of errors, or that it will meet requirements you have not told us about in writing.

11.7 If something goes wrong. If the Service does not meet the promise in clause 11.6, tell us. Your first remedy is for us to fix it within a reasonable time. Your rights under clause 14 are not affected.

12. Intellectual property

12.1 Westly, its software, design and brand belong to us or our licensors. While your Account is open, we give you a non-exclusive, non-transferable right to use the Service for your business.

12.2 Your content stays yours. You own your Customer Data and the text and photos you upload. You give us the right to host, copy, display and process them, but only as needed to provide the Service. That includes:

  • showing your salon page publicly;
  • letting search engines index it once you publish it.

12.3 Feedback. If you suggest improvements, we may use them freely.

12.4 Our name. You may use our name and logo to tell Customers they can book with you on Westly.

13. Confidentiality

13.1 Each of us will keep the other’s confidential information confidential, and use it only for this contract. That includes your Customer Data, and our non-public prices, plans and security information.

13.2 This does not apply to information that:

  • is public, other than through a breach of this clause;
  • the other already had;
  • the law or a regulator requires to be disclosed. In that case, tell the other first where the law allows.

13.3 This clause continues after the contract ends.

14. Liability

14.1 What nobody limits. Nothing in these terms limits or excludes either party’s liability for:

  • death or personal injury caused by negligence;
  • fraud or fraudulent misrepresentation;
  • anything else the law does not allow to be limited.

14.2 Losses neither of us is liable for. Neither of us is liable to the other for:

  • (a) loss of profit, revenue, business, goodwill or anticipated savings;
  • (b) indirect or consequential loss.

This applies however the loss arises, including in negligence.

14.3 Things we are not liable for. We are not liable for loss caused by:

  • (a) a booking missed, or a Customer not turning up, because a message was delayed or did not arrive;
  • (b) your breach of these terms, or the acts of your team;
  • (c) information you or your team entered;
  • (d) your Stripe account, your bank or your Customers;
  • (e) an Event outside our control (clause 17.3).

14.4 Our general cap. Our total liability to you for all claims together is limited to the higher of:

  • the Fees you paid us in the 12 months before the event that gave rise to the claim; and
  • £500.

This cap is subject to clauses 14.1 and 14.5.

14.5 Data protection and confidentiality cap. For claims about personal data or confidentiality, including under Schedule 1, our total liability is limited instead to the higher of:

  • three times the Fees you paid us in the 12 months before the event; and
  • £5,000.

14.6 Our indemnity to you. We will cover you against a claim by a third party that your use of the Service, as these terms allow, infringes that party’s intellectual property rights. If such a claim is made, we may change the Service so that it does not infringe, or end the affected part and refund any Fees paid in advance for it.

14.7 Your indemnity to us. You will cover us against claims by your Customers, or fines and claims by regulators, that arise from:

  • (a) your Marketing messages, or consent you recorded wrongly;
  • (b) your deposits or cancellation policy;
  • (c) content you uploaded;
  • (d) an instruction you gave us about Customer Data that broke Data Protection Law.

14.8 How indemnity claims work. The party claiming under clause 14.6 or 14.7 must:

  • tell the other promptly;
  • let them handle the claim;
  • not admit or settle it without their agreement;
  • give reasonable help, at their cost.

14.9 Your liability. Your liability to us is limited in the same way as ours in clause 14.4. That limit does not apply to:

14.10 Why these limits are fair. Our prices are low and fixed. You keep control of your own Customers, policies and records. You can download your data at any time, and you can leave on one month’s notice. These limits are reflected in our prices.

15. Term and ending the contract

15.1 Rolling monthly. This contract starts when you accept these terms, and runs month to month until either of us ends it.

15.2 You can leave at any time. The Account owner closes the Account by archiving the business in Westly. You can also email us at support@westly.uk to ask us to close it.

  • We stop charging from the month in which your Account is closed.
  • You pay every invoice for months that ended before you closed.
  • There is no cancellation fee.
  • Closing is permanent, so download your data first (clause 15.5).

15.3 We can end the contract:

  • (a) on 30 days’ notice, for any reason;
  • (b) at once, by notice, if you seriously breach these terms and do not put it right within 14 days of our asking, or if the breach cannot be put right;
  • (c) at once, by notice, if an invoice is unpaid 60 days after its due date;
  • (d) at once, by notice, if you become insolvent, enter any arrangement with your creditors, or stop trading.

15.4 When the contract ends:

  • (a) your public page and online booking go offline;
  • (b) we send no more messages for you;
  • (c) any unpaid invoices are due at once;
  • (d) any credit you have is refunded to you;
  • (e) your Stripe account stays yours. Refunds of deposits already taken are between you and Stripe.

15.5 Getting your data.

  • Before you leave, the Account owner can download your Customers and appointments as spreadsheet files (Salon → Your data).
  • For 30 days after closure, you can ask us at support@westly.uk for a copy of the rest of your Customer Data. We will provide it in a common format within 30 days of your request.

15.6 After you leave. Within 90 days after closure, we delete or anonymise your Customer Data in the live system, except:

  • (a) records the law requires us to keep, such as our invoices to you, which we keep for 6 years;
  • (b) copies in encrypted backups, which are deleted as backups expire (Schedule 1, paragraph 14.3);
  • (c) a Customer’s own Westly account, which belongs to them (clause 10.2(b)).

15.7 What continues after the end. These clauses continue after the contract ends:

16. Changes to these terms

16.1 We may change these terms. For a change that is to your disadvantage, we will email the Account owner at least 30 days before it takes effect. If you do not agree, you may close your Account before the change takes effect, and you will not be bound by it.

16.2 We may make a change at once if:

  • the law or a regulator requires it;
  • it adds a new optional feature;
  • it does not disadvantage you.

16.3 Where a change is significant, we will ask you to accept the new version in Westly. Otherwise, you accept a change by continuing to use Westly after it takes effect. We keep each version of these terms, with its date.

17. General

17.1 Notices. We send notices to the Account owner’s email address. You send notices to support@westly.uk. An email counts as received on the next working day after it is sent, unless the sender is told it was not delivered.

17.2 Transfer. We may transfer this contract to a company that takes over Westly, and we will tell you. You may transfer it only with our written agreement.

17.3 Events outside our control. We are not in breach of this contract, and not liable, for a delay or failure caused by an event outside our reasonable control. Examples include:

  • a failure of the internet, power, a hosting provider, a mobile network, Postmark, Twilio or Stripe;
  • a cyber attack we could not reasonably have prevented;
  • fire, flood or pandemic;
  • an act of government.

We will tell you and do what we reasonably can to limit the effect. If the event stops the Service for more than 30 days in a row, either of us may end the contract by notice.

17.4 Subcontractors. We may use subcontractors to provide the Service. For personal data, Schedule 1 governs.

17.5 Whole agreement. The documents listed in clause 1.5 are the whole agreement between us. Neither of us relies on anything said or written that is not in them. This does not limit liability for fraud.

17.6 No waiver. If either of us does not enforce a right straight away, it can still enforce it later.

17.7 Severance. If a court finds part of these terms invalid, the rest continues. The invalid part applies with the smallest change needed to make it valid.

17.8 Third parties. No one else has rights under this contract under the Contracts (Rights of Third Parties) Act 1999.

17.9 Relationship. Nothing in this contract makes either of us the other’s partner, agent or employee.

17.10 Law and courts. This contract is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

Schedule 1: Data Processing Agreement

This Schedule is part of the terms and meets Article 28 of the UK GDPR. Words defined in the UK GDPR have the same meaning here, such as controller, processor, personal data, processing, personal data breach and data subject.

“Data Protection Law” means:

  • the UK GDPR;
  • the Data Protection Act 2018;
  • the Privacy and Electronic Communications Regulations 2003;
  • any law that amends or replaces them, including the Data (Use and Access) Act 2025.

1. Roles

1.1 The salon is the controller and Westly is the processor of Customer Data (clause 10.1). This Schedule does not apply to data Westly controls itself (clause 10.2).

2. Subject matter and duration

2.1 Subject matter: providing the Service under the terms.

2.2 Duration: for as long as the contract runs, and afterwards until the data is returned or deleted under paragraph 14.

3. Nature and purpose

3.1 Nature: hosting, storing, organising, displaying, sending, backing up, exporting and deleting Customer Data through the Service.

3.2 Purposes:

  • (a) running the salon’s diary, Customer records, online booking and till;
  • (b) sending Service messages, and the salon’s Marketing messages, by email and text;
  • (c) taking card deposits through the salon’s own Stripe account;
  • (d) working out the salon’s monthly invoice (counts of texts and new Customers);
  • (e) support, security, backup and restore;
  • (f) anything else the salon instructs in writing that the Service supports.

4. Instructions

4.1 Westly processes Customer Data only on the salon’s documented instructions, including on transfers outside the UK (paragraph 9). These are the salon’s documented instructions:

  • these terms;
  • the salon’s settings;
  • what the salon and its team do in the Service.

If the law requires us to process Customer Data in another way, we will tell the salon first, unless the law forbids that.

4.2 We will tell the salon promptly if we think an instruction breaks Data Protection Law.

4.3 The salon confirms that it:

  • has a lawful basis for the processing;
  • gives its Customers the privacy information they need, including that it uses Westly;
  • has the consent needed for Marketing messages.

5. Categories of data and data subjects

5.1 Data subjects:

  • (a) the salon’s Customers and prospective Customers;
  • (b) the salon’s team members;
  • (c) people who contact the salon through its page.

5.2 Customer data:

  • name, email, phone numbers, and postal address if entered;
  • appointment history (services, times, staff, location, status, price, deposit);
  • notes and tags the salon writes;
  • patch-test and consultation records;
  • consent and communication preferences, with when and by whom they were recorded;
  • birthday (day and month only), if given;
  • payments recorded at the till;
  • deposits (the Stripe reference, amount and status; never card numbers);
  • records of texts and emails sent (time, kind, masked number, delivery status);
  • how the Customer first came to the salon;
  • photos a Customer adds to their own visit.

5.3 Team data:

  • name, email and role;
  • working hours and services offered;
  • an audit trail of their actions in the Account.

5.4 Health data. Allergy notes, patch-test results, skin conditions and access needs are health data. The salon:

  • (a) must record only what it needs to treat the Customer safely;
  • (b) is responsible for having a condition under Article 9 of the UK GDPR, usually the Customer’s explicit consent;
  • (c) must not put health data in fields that are not meant for it, such as tags or the Customer’s name.

Westly protects this data with the measures in Annex 2.

5.5 Children. The Service is not aimed at children. Where a salon holds a record for a Customer under 16, the salon is responsible for involving a parent or guardian where the law or good practice requires.

6. Westly’s obligations (Article 28(3))

Westly will:

  • (a) instructions: process Customer Data only on the salon’s documented instructions (paragraph 4);
  • (b) confidentiality: make sure everyone authorised to process Customer Data is bound by confidentiality;
  • (c) security: take the measures required by Article 32 (paragraph 10 and Annex 2);
  • (d) sub-processors: use sub-processors only under paragraph 8, and stay fully responsible for them;
  • (e) data subject rights: help the salon to respond to requests from data subjects (paragraph 12);
  • (f) compliance help: help the salon meet its duties on security, breach notification, impact assessments and prior consultation with the ICO (Articles 32 to 36), taking into account what Westly knows (paragraphs 10, 11 and 13);
  • (g) end of contract: at the salon’s choice, return or delete Customer Data when the contract ends, and delete existing copies unless the law requires us to keep them (paragraph 14);
  • (h) information and audits: give the salon the information it reasonably needs to show compliance with Article 28, and allow and contribute to audits (paragraph 15).

7. Westly’s staff

7.1 Only Westly staff who need access for support, billing, security or operations can see Customer Data. Platform roles are separate from salon roles, and platform actions are recorded in an audit log.

8. Sub-processors

8.1 General authorisation. The salon gives Westly general written authorisation to use the sub-processors in Annex 1.

8.2 Notice of changes. We will email the Account owner at least 30 days before we add or replace a sub-processor, saying who it is, what it is for, and where it processes data.

8.3 Objection. The salon may object on reasonable data protection grounds within that notice period. We will discuss the objection in good faith. If we cannot resolve it, the salon may close its Account before the change takes effect, and pays no Fees after it closes.

8.4 Same obligations. Each sub-processor is bound by a written contract whose data protection obligations give at least the same protection as this Schedule. Westly stays fully liable to the salon for each sub-processor.

8.5 Emergency replacement. If a sub-processor fails or becomes unsafe, we may replace it at once, and will tell the salon as soon as we can.

9. International transfers

9.1 Westly’s servers and main database are in the United Kingdom. Some sub-processors are based in, or may access data from, the European Union or the United States (Annex 1).

9.2 We transfer Customer Data outside the UK only where it is protected under Chapter V of the UK GDPR:

  • (a) to a country with UK adequacy regulations, including the European Union and US organisations certified to the UK Extension to the EU-US Data Privacy Framework; or
  • (b) under the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as included in each sub-processor’s data processing agreement.

If one of these stops being available, we will use another of them, or stop the transfer.

10. Security

10.1 Westly takes the measures in Annex 2. We may change them, but not in a way that lowers the overall protection.

11. Personal data breaches

11.1 Telling the salon. We will tell the salon without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting its Customer Data. The salon then decides whether to tell the ICO, which it must do within 72 hours where the law requires.

11.2 What we will tell the salon. As far as we know at the time, adding detail as we learn it, we will say:

  • what happened;
  • the kinds of data and the approximate numbers of people and records affected;
  • the likely consequences;
  • what we have done and will do;
  • who to contact.

11.3 Containment. We will take reasonable steps to contain the breach and reduce harm. We will not tell the salon’s Customers or the ICO about the salon’s breach without the salon’s agreement, unless the law requires it.

11.4 Breaches affecting many salons. Where a breach affects many salons at once, we may also notify the ICO ourselves and coordinate the notices to salons. That does not replace any salon’s own duty.

12. Data subject rights

12.1 The Service lets the salon find, correct, archive and export a Customer’s records, and record or withdraw consent and marketing preferences.

12.2 If a Customer contacts Westly about a salon’s records, we will pass the request to the salon within 2 working days and will not answer it ourselves. The exception is a request about the Customer’s own Westly account (clause 10.2(b)).

12.3 Erasure. If the salon needs a Customer erased and cannot do it in the Service, the Account owner can ask us at support@westly.uk. We will carry it out within 14 days. Records the salon must keep by law, such as payments and receipts, are kept without the Customer’s name.

13. Impact assessments

13.1 We will give the salon reasonable information about the Service to help with a data protection impact assessment, or with prior consultation with the ICO.

14. Return and deletion at the end

14.1 Return. The Account owner can download the salon’s Customers and appointments at any time before closure. On request within 30 days after closure, we will provide the rest of the salon’s Customer Data in a common format (clause 15.5).

14.2 Deletion. Within 90 days after closure, we will delete or anonymise the salon’s Customer Data in the live system, except what the law requires us to keep (clause 15.6).

14.3 Backups. Backup copies are deleted as the backups expire. Until then they stay encrypted and are used only to restore the system. If the system is restored from a backup, we will delete again any data that should already have been deleted.

14.4 We will confirm deletion in writing if the salon asks.

15. Audits

15.1 Questions. We will answer reasonable written questions about our compliance, and share summaries of our security reviews. This is the first step of any audit.

15.2 Audits. If the answers are not enough, the salon, or an independent auditor bound by confidentiality, may audit us:

  • on at least 30 days’ notice;
  • no more than once a year, unless there has been a breach or the ICO requires it;
  • during working hours;
  • at the salon’s cost.

16. Liability

16.1 Liability under this Schedule is subject to clause 14 of the terms, including the separate cap in clause 14.5.

Annex 1: Sub-processors

Sub-processorWhat forDataWhere
Katapult (Krystal Hosting Ltd)The server, database and filesAll Customer DataLondon, United Kingdom
Postmark (ActiveCampaign, LLC)Sending emailsName, email, booking details in the message, delivery eventsUSA
TwilioSending texts, delivery receipts, mobile verification codesMobile number, message text (salon name, time, service), delivery statusUSA
StripeCard deposits, only for salons that use them (Stripe is also the salon’s own provider)Customer name, email, deposit amount; card details go to Stripe onlyUK and USA
Bunny.net (BunnyWay d.o.o.)Storing and serving images; a second encrypted off-site copy of the databaseImages, which may show people; backups of all Customer Data, encrypted before uploadImages: London, UK. Backup copy: Frankfurt, Germany

Not sub-processors for Customer Data:

  • Xero, which holds only Westly’s own invoices to salons;
  • the support mailbox host, which holds only what a salon chooses to email us.

Annex 2: Security measures (what is in place on 13 October 2026)

Network and hosting

  • Only the ports for secure web traffic and administration are open. The database and cache are not reachable from the internet.
  • Administrator access is by key only, with automatic blocking of repeated failed attempts.
  • Operating-system security updates are applied.

In transit

  • HTTPS only, with HSTS. Old versions of TLS are refused. The certificate renews automatically.
  • Browser protections are in place: a content security policy, framing refused, and strict referrer and permissions policies.

Access

  • Each salon’s data is kept apart by checks on every request. Every business route is limited to the business, and needs a named permission.
  • Westly staff routes have their own guard and permissions, and staff actions are audited.
  • Sessions use secure, HTTP-only cookies. Refresh tokens rotate and are stored hashed. Signing out, or suspending a user, takes effect at once.
  • Repeated failed sign-ins are limited per IP address and per account.
  • Sign-in and password-reset flows do not reveal whether an account exists.

Application

  • Database queries are parameterised. Email templates escape every value.
  • Uploads are checked by their content. SVG files are refused, and photo metadata is removed.
  • Customer names and contact details are not written into system logs.
  • Third-party tokens are encrypted with AES-256-GCM.
  • Westly never stores card numbers or salons’ Stripe keys.

Backups and recovery

  • A nightly database backup is verified before it is kept.
  • A nightly off-site copy goes to Bunny, in Frankfurt. Each copy is:
    • encrypted with AES-256 before it leaves the server;
    • read back to prove it;
    • checksum-checked at the destination.
  • A weekly test restores a backup into a separate database.
  • Alerts go to Westly if a backup fails or is late. An independent uptime service watches the site and the booking system.

Schedule 2: Fees

The live tariff since 10 October 2026. All prices include VAT at 20%.

ItemPrice (VAT included)Notes
Subscription, sole trader (0 or 1 bookable team member)£7.50 a month
Subscription, team: first bookable member£4.50 a monthWhen there are 2 or more
Subscription, team: each other bookable member£5.00 a month
New client fee£4.00, once per new Customer Westly introducedClause 5.4
Texts included25 per bookable team member a month (minimum 25)Shared, no roll-over
Each text beyond the allowance6pOne segment each
Card deposit fee10% of each deposit paid and not refundedWhen deposits go live; clause 7
EmailsFree
Bookable team members1234510
Per month£7.50£9.50£14.50£19.50£24.50£49.50

Questions about these terms: support@westly.uk.

Back to the homepage