Data Processing Agreement

1. Parties and roles

The host is the controller. {COMPANY_NAME}, {ADDRESS}, is the processor. This agreement applies for as long as we process guest data for you.

2. Subject, nature and purpose

We process guest data only to provide VilaTab: storing booking dates imported from your calendar links, direct reservations and extensions you record, showing information and offers on the guest tablet, and counting offer scans.

3. Types of data and data subjects

Data subjects: your guests and, if they use the admin, your staff. Types of data: stay dates, booking platform and reference, extension dates, price and payment method, names only where you enter them, and the tablet’s random id. You do not enter special categories of personal data (Art. 9 GDPR).

4. Our obligations as processor

• We process the data only on your documented instructions, which are these terms and the settings you make in VilaTab, unless the law requires otherwise; we tell you if we think an instruction breaks the law.
• Everyone who can access the data is bound to confidentiality.
• We take appropriate technical and organisational measures (Art. 32): encryption in transit, strict separation of each host’s data, restricted access, hashed passwords, backups.
• We help you answer your guests’ requests and meet your duties under Articles 32–36 GDPR.
• We tell you about a personal data breach without undue delay, and within 48 hours of becoming aware of it.
• At the end of the service we delete the guest data within 90 days, unless the law requires us to keep it; you can export your data before.
• We give you the information needed to show compliance and allow audits once a year, announced 30 days ahead and at your cost.

5. Sub-processors

You authorise us to use the sub-processors listed in the Privacy Policy (Supabase, Vercel, Google, DeepL, Resend, and Stripe). We bind them to the same obligations. We announce new sub-processors 30 days in advance; you may object for good reason, and if we cannot resolve it, cancel.

6. Your obligations as controller

You make sure you may process your guests’ data and that your guests are informed, for example in your house information or booking confirmation.

7. Transfers and liability

Transfers outside the European Economic Area take place only with an adequacy decision or standard contractual clauses. Liability follows the Terms of Service. If this agreement and the terms contradict each other on data protection, this agreement prevails.