Data Processing Agreement

1. Scope and parties

This Data Processing Agreement (“DPA”) is between the Customer (the “Controller”) and [Company legal name], [Address] (the “Processor”, “we”). It forms part of the Terms of Service and applies whenever we process personal data on the Customer’s behalf while providing the Service.

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in the applicable data protection law: [Applicable data protection law — e.g. the EU GDPR, UK GDPR, or national law].

2. Roles

The Customer is the controller of the personal data it and its Users enter into the Service, including data about its guests, its staff, property owners and vendors. We process that data as processor, only on the Customer’s behalf.

We are an independent controller for the data we need to run our own business — Users’ account and login details, billing contacts and invoices, and security logs — as described in our Privacy Policy.

The Customer is responsible for having a lawful basis for the processing, for informing data subjects (for example in its own guest privacy notice) and for the lawfulness of its instructions.

3. Details of the processing

• Subject matter: hosting and operating a property-management system for the Customer.
• Duration: the term of the subscription plus the 90-day export window after it ends, followed by deletion (section 10).
• Nature and purpose: storing, organising, displaying and transmitting data to manage properties, reservations, guests, housekeeping, maintenance, procurement and finance; synchronising with booking channels and accounting software the Customer connects; sending emails the Customer triggers.
• Data subjects: the Customer’s guests and their companions, the Customer’s Users and staff, property owners, vendors and other business contacts.
• Categories of data: names and contact details; stay and booking details; nationality, date of birth and identity document details and images where the Customer records them; folio, invoice and payment records (no full payment card numbers); notes, messages, photos and other files the Customer uploads; Users’ activity in the audit log.
• Special categories of data: none intended. The Customer should not enter such data unless it has a lawful basis and it is necessary.

4. Our obligations

We will:

• process the personal data only on the Customer’s documented instructions — the Terms, this DPA and the Customer’s use and configuration of the Service — unless the law requires otherwise, in which case we will inform the Customer first where allowed;
• tell the Customer if we believe an instruction infringes data protection law;
• ensure that everyone authorised to process the data is bound by confidentiality;
• implement the security measures in section 6;
• help the Customer, taking into account the nature of the processing, to respond to data subjects exercising their rights — the Service lets the Customer find, correct, export and delete guest data itself;
• help the Customer with security, breach notification, data protection impact assessments and consultation with supervisory authorities, as far as these concern our processing.

5. Sub-processors

The Customer gives general authorisation for us to use sub-processors. We impose data protection obligations on each sub-processor that are no less protective than this DPA and remain responsible for their performance. Our current sub-processors are:

• Hosting and databases — [Hosting provider], [Region]: runs the Service and stores its databases and backups.
• File storage — [Object storage provider], [Region]: stores uploaded files such as photos, documents and data exports.
• Email delivery — [Email delivery provider], [Region]: sends invitations, notifications and invoices.
• Channel manager — Channex ([Channex legal entity], [Region]): exchanges availability, rates and bookings with online travel agencies, only for Customers who enable the channel manager add-on.
• Accounting integration — Xero ([Xero legal entity], [Region]): receives invoices, payments and bills, only for Customers who connect their Xero organisation.
• [Other sub-processors, e.g. error monitoring or customer support tools.]

We will give the Customer at least [30] days’ notice of a new or replacement sub-processor by email or in the Service. The Customer may object on reasonable data protection grounds; if we cannot address the objection, the Customer may cancel the affected part of the Service before the change.

6. Security measures

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest, with especially sensitive fields such as bank details and integration credentials additionally encrypted by the application;
• strict separation of each customer’s data, enforced on every request;
• role-based permissions, and two-factor authentication for Users and for our staff’s access to the platform;
• an audit log of changes in each company, available to the Customer’s admins;
• access by our staff to a Customer’s workspace only for support, read-only, time-limited, with a stated reason that is recorded in the Customer’s audit log; guests’ identity documents are never shown to our staff;
• regular backups, monitoring and logging, and prompt patching of vulnerabilities;
• confidentiality obligations and security training for our personnel;
• [Further measures, certifications or audit reports, if any.]

We may update these measures as long as the overall level of protection is not reduced.

7. Personal data breaches

We will notify the Customer without undue delay, and in any case within [48] hours, after becoming aware of a personal data breach affecting the Customer’s personal data. The notice will describe, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and take reasonable steps to contain the breach and mitigate its effects.

Notifying supervisory authorities and data subjects is the Customer’s responsibility as controller; we will cooperate.

8. International transfers

We process personal data in [Primary hosting region]. Where personal data is transferred to a country without an adequate level of protection, we will rely on [Transfer mechanism — e.g. the European Commission’s Standard Contractual Clauses] and any supplementary measures required.

9. Information and audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA. Where that information is not sufficient, the Customer may, at its own cost, audit our compliance once a year with at least [30] days’ notice, during business hours and subject to confidentiality, in a way that does not affect other customers’ data or security. [Existing third-party audit reports may be provided instead.]

10. Return and deletion

During the subscription the Customer can export and delete its data at any time.

When the subscription ends, the Customer can export all of its data for 90 days. After that period we delete the Customer’s personal data from the Service, and from backups within [Backup retention period], unless the law requires us to keep it.

11. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, as far as the law permits. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.