Data Processing Agreement

The Controller entrusts the Processor with the processing of the personal data necessary to provide the Services described in the Contract. This Agreement supplements and, in case of conflict, prevails over the GTC.

The Agreement has the same duration as the Contract and remains in effect until the data are returned or erased under Art. 10.

The Processor processes personal data exclusively to:

1. a)manage, through the artificial intelligence assistant, conversations with guests and prospective guests on the activated channels (web widget, WhatsApp, email and, if activated, telephone), including translation, summaries and escalation to the Controller’s staff;
2. b)generate quotes and check availability through the connection to the Controller’s booking engine and PMS;
3. c)synchronise bookings from the PMS or channel manager and provide the inbox, back office, conversation history and dashboards;
4. d)run the automations configured by the Controller (pre-stay, stay, post-stay) and, where requested by the Controller, guest analysis and segmentation;
5. e)provide technical support, maintenance, security and the quality checks provided for in Art. 9.3 of the GTC.

Processing is carried out by electronic means, including through artificial intelligence models made available by the sub-processors listed in Annex 1.

Data subjects: guests, prospective guests and users who contact the Controller through the channels of the Services; persons named in bookings, including companions and minors limited to their number and age; the Controller’s staff using the back office.

Data: identification and contact data (name, telephone, email, language, nationality); booking and stay data (dates, rooms, rates, quotes, number and age of guests, requests); content of conversations (messages, voice messages and their transcripts, call recordings where activated); technical identifiers (WhatsApp identifier, browser identifier, IP address); preferences and attributes inferred from conversations; data transmitted by the Controller’s PMS or channel manager.

The Services are not intended for processing special categories of personal data (Art. 9 GDPR) or identity document data. The Processor limits the data acquired from the PMS to those necessary to provide the Services and does not use health data for segmentation or promotional purposes. Where such data are spontaneously provided by guests in conversations, they are processed solely to handle the related request.

The Processor processes personal data only on documented instructions from the Controller, consisting of the Contract, this Agreement and the settings configured by the Controller in the back office, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case the Processor informs the Controller before processing, unless the law prohibits it.

The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

The Processor keeps the Controller’s data logically separate from data processed on behalf of other customers and does not combine them.

The Processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, have received instructions under Art. 29 GDPR and access the data only to the extent necessary for support, maintenance, security and quality control of the Services.

The Processor implements appropriate technical and organisational measures under Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the risks, including: (a) encryption of data in transit; (b) encryption of credentials for access to third-party systems; (c) role-based access control and individual credentials; (d) logging of access and relevant events; (e) periodic backups; (f) storage of the main data on servers located in the European Union; (g) incident management procedures; (h) periodic review and update of the measures.

The Processor assists the Controller in ensuring compliance with Arts. 32-36 GDPR, including data protection impact assessments and prior consultation, taking into account the nature of processing and the information available to it.

The Controller grants general written authorisation to engage the sub-processors listed in Annex 1.

The Processor notifies the Controller in writing, including by email, of any intended addition or replacement of sub-processors at least 15 (fifteen) days in advance. The Controller may object on reasonable and documented data protection grounds within 10 (ten) days of the notice. In case of objection the Parties seek a solution in good faith; failing that, the Controller may withdraw from the affected Services without penalty, including the penalty under Art. 6.3 of the GTC, with a refund of the unused portion of the fee.

The Processor imposes on sub-processors, by contract, data protection obligations substantially equivalent to those in this Agreement and remains liable to the Controller for the performance of their obligations (Art. 28(4) GDPR).

Where the WhatsApp channel is activated on a WhatsApp Business account in the Controller’s name, Meta processes the data under the direct contractual relationship between the Controller and Meta; the Processor accesses it as a technology provider authorised by the Controller.

Transfers of personal data outside the European Economic Area take place only to the sub-processors listed in Annex 1 and on the basis of the safeguards under Chapter V GDPR: an adequacy decision, including the EU-U.S. Data Privacy Framework for certified recipients, or standard contractual clauses adopted by the European Commission.

The Processor informs the Controller without undue delay, and in any case within 5 (five) working days, of requests received directly from data subjects and does not respond to them without the Controller’s instructions. At the Controller’s request, it carries out within 15 (fifteen) days the operations needed to handle requests for access, rectification, erasure, restriction and portability.

The Processor notifies the Controller of any personal data breach without undue delay and in any case within 48 (forty-eight) hours of becoming aware of it, providing, to the extent available, the information referred to in Art. 33(3) GDPR, and cooperates with the Controller for the obligations under Arts. 33 and 34 GDPR.

Data are retained for the duration of the Contract. The Controller may at any time request the early erasure of individual conversations or of the data of individual guests.

Technical logs, which may contain conversation data, are retained for no more than 120 (one hundred and twenty) days. Call recordings, where the telephone channel is activated, are retained for the period set by the Controller and in any case for no more than 90 (ninety) days.

Upon termination of the Contract the Processor, at the Controller’s choice, returns the data as provided by Art. 6.3 of the GTC and erases them within 30 (thirty) days; backup copies are erased within 90 (ninety) days of termination, unless Union or Member State law requires their retention. On request, the Processor confirms the erasure in writing.

The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or by an auditor mandated by it and bound by confidentiality.

Except in case of a personal data breach or a request from a supervisory authority, audits are agreed with at least 30 (thirty) days’ notice, no more than once a year, during business hours, in a manner that does not compromise the security of other customers’ data, and at the Controller’s expense.

The Processor keeps the record of processing activities under Art. 30(2) GDPR.

The Controller guarantees the lawfulness of the processing entrusted, including the existence of an appropriate legal basis, the information provided to data subjects and, where necessary, the collection of consent, as well as the lawfulness of the instructions given.

The liability of the Parties towards data subjects is governed by Art. 82 GDPR.