Data processing agreement

Parties and subject

This agreement is made between the property (controller) and [Provider name, VAT number, address, contact email] (processor), under GDPR art. 28, and lasts as long as the account.

Subject: keeping and processing guests’ details for the property’s requests and bookings and sending the related emails. Data: name, email, phone, dates, number of guests, messages, payments the property records. Data subjects: guests and the property’s staff.

Processor’s obligations

We process the data only on the property’s instructions, as given by using the service. Everyone with access is bound to confidentiality. We take appropriate security measures (encrypted connection, passwords, each property sees only its own data, backups).

We use these sub-processors: Hetzner Online GmbH (hosting, Germany), Brevo (email, France), Cloudflare (network). We will tell the property before adding another, so it can object.

We help the property answer guests’ requests about their rights and meet its duties on security and impact assessments. We tell the property without undue delay about any data breach.

At the end of the agreement, as the property chooses, we delete or return the data (file export) and delete copies, unless the law requires keeping them. We give the property the information it needs to check that we keep to this agreement.