Data Processing Agreement

1. Parties, scope and precedence

This Data Processing Agreement ("DPA") is entered into between the accommodation provider using the Service (the "Property", acting as data controller, "Controller") and the BookingPilot project (legal entity registration in progress, Albania), trading as BookingPilot (acting as data processor, "Processor"). It forms part of the Terms of Service, applies automatically from the date on which your account is created and governs our processing of personal data on your behalf for the duration of that account.

Pre-launch status: the Processor's legal entity is in formation and this document is published in advance so its terms are visible before sign-up; it takes effect for each account upon the opening of the Service, and the registered entity details will be substituted into this page once incorporation completes.

This DPA constitutes the Controller's complete and final documented instructions for processing, supplemented by the configurations and actions the Controller takes within the Service. If any conflict arises between this DPA and the Terms of Service concerning the processing of personal data, this DPA prevails.

2. Processing details

The subject matter, duration, nature, purposes and data categories of the processing are set out in Annex A. In summary, we process personal data solely to provide the hospitality operations features configured by the Controller, namely reservation and calendar management, guest records, communications and automation, housekeeping operations, rate and channel synchronisation, reporting and staff administration, together with security monitoring, retention enforcement and backup.

3. Our obligations as processor (Article 28 GDPR)

We undertake the following: (a) to process personal data only on your documented instructions, including as given through the features of the Service, unless required otherwise by applicable law, in which case we will inform you before processing unless legally prohibited; (b) to ensure that personnel authorised to process personal data are bound by confidentiality obligations; (c) to implement and maintain the technical and organisational measures described in Annex B and on our Security and Data Practices page (/security); (d) to engage only the categories of sub-processors described in Annex C, under the authorisation and change-notice mechanism set out in clause 4; (e) to assist you, through built-in tooling (guest export and erasure in the Guests area) and through reasonable requests addressed to privacy@bookingpilot.al, in responding to data-subject requests and in meeting your security, breach-notification and impact-assessment obligations; (f) to notify you of personal data breaches without undue delay in accordance with clause 6; (g) at the end of the service, to delete or return personal data as described in clause 8, unless storage is required by law; and (h) to make available the information reasonably necessary to demonstrate compliance in accordance with clause 7.

4. Sub-processors and international transfers

We engage a limited number of third-party service providers in the operation of the Service. Each such provider is bound by a data processing agreement or equivalent contractual safeguards, and each receives only the minimum data necessary for the performance of its designated function.

The categories of provider so engaged are the following: (a) database hosting, authentication, file storage and realtime messaging, with processing performed in the European Union (Ireland) and access to all Service data at rest, under a data processing agreement incorporating Standard Contractual Clauses and with the primary processing site located within the European Union; (b) transactional and guest-facing email delivery, with processing in the United States, receiving recipient address, message content and delivery telemetry, under a data processing agreement supported by certification under the EU-US Data Privacy Framework and Standard Contractual Clauses; (c) artificial intelligence inference for the staff assistant and the public support chat, with processing in the United States, receiving prompts and responses submitted through those features, under a data processing agreement incorporating Standard Contractual Clauses, configured for zero data retention and without training on customer data; (d) channel-management synchronisation of availability, rates and bookings with online travel agencies, with processing in the United Kingdom, receiving guest and reservation data for the channels selected by the Controller, under a data protection addendum and on the basis of the United Kingdom adequacy decision; (e) push-notification delivery effected through the service operated by the recipient's browser vendor, which may be located outside the European Economic Area, receiving the push endpoint, cryptographic keys and notification payload, under the browser vendor's own terms, the endpoint being generated by the user's device; and (f) optional third-party sign-in (OAuth), with processing in a location dependent on the provider, transmitting the authentication request and returning basic account attributes such as email address, under the provider's own terms and only at the user's initiative; and (g) content delivery, static-site hosting, automated-traffic screening and IP geolocation for session security, with processing on a global edge network including the United States, receiving visitor IP addresses and browser request data on every page load, of which solely a coarse city-level location derived from the IP address is retained in session records, under a data processing addendum incorporating Standard Contractual Clauses.

The identity of each provider comprised within the categories described above, together with a copy of the safeguards applicable to it, is made available to Controllers upon request addressed to privacy@bookingpilot.al and accompanies the Data Processing Agreement. We notify Controllers at the email address registered on the account before engaging or replacing any provider, and the Controller may object on reasonable data-protection grounds; where we cannot reasonably accommodate a justified objection, the Controller may terminate the account. Each sub-processor is bound by data-protection obligations no less protective than those set out in this DPA, and we remain fully liable to you for each sub-processor's performance of those obligations. Where a sub-processor is established outside the EEA or the United Kingdom, the engagement relies on an adequacy decision or on Standard Contractual Clauses incorporated into that provider's terms; our infrastructure provider's primary processing site is located in the European Union (Ireland region).

Where the Controller is established in the European Economic Area, the United Kingdom or Switzerland, the transfer of personal data from the Controller to the Processor, established in a third country, is governed by the standard contractual clauses for the transfer of personal data to third countries (Module Two: controller to processor) set out in Commission Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference with the Controller as data exporter and the Processor as data importer. Annexes A to C supply the information required by the annexes to those clauses; the clauses are governed by the law of the Republic of Ireland, the courts of Ireland have jurisdiction over disputes arising under them, and the competent supervisory authority is that of the Controller's place of establishment. In respect of processing subject to the United Kingdom GDPR, the UK's International Data Transfer Addendum to the EU standard contractual clauses applies accordingly.

5. Your responsibilities as controller

You are responsible for the lawfulness of the personal data you enter, for providing your guests and staff with the privacy notices required by your law, for honouring data-subject requests (export and erasure tooling being provided within the Guests area) and for the accuracy of the data. Where a data subject exercises a right directly against us, we will refer the request to you unless the law requires otherwise.

Staff monitoring notice: the Service records security-related session information concerning your personnel, namely last-activity times, device identity, revoked sessions and an approximate city/region-level location and timezone derived from IP address, and makes it visible within the staff member's own account security view. The Service additionally maintains an operational activity log, visible to the property owner, recording staff access changes, configuration changes and security-related events within the property. You are responsible for informing your staff of this monitoring and for establishing the legal basis required by your local employment rules before granting access.

Special categories: the Service is not designed to process special categories of personal data within the meaning of Article 9 GDPR. Such data must not be entered into free-text fields; should you nevertheless elect to do so, you remain responsible for establishing a lawful basis for it.

6. Breach notification

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, targeting twenty-four hours, with the information reasonably available concerning the nature, scope, likely consequences and mitigation of the breach, so that you can meet your own seventy-two-hour authority-notification deadline. Incidents are logged internally even where notification thresholds are not met.

7. Audits and evidence

This DPA, the published Security and Data Practices page and the sub-processor disclosure in Annex C constitute our primary compliance evidence; our infrastructure provider additionally maintains SOC 2 Type II certification. We will respond to reasonable written questionnaires. On-site audits are available on request at reasonable cost, no more than once per year absent a demonstrated incident or a specific regulatory requirement.

8. Retention, return and deletion on termination

We retain personal data only for such periods as are necessary for the purposes described in this notice, after which the data is erased or anonymised. The following retention periods apply, enforced by scheduled automated jobs rather than by manual policy: card security codes (CVC) are erased no later than fourteen days after capture or on the day following checkout, whichever occurs first; full card details are erased ninety days after checkout, the last four digits being retained for reconciliation and dispute purposes; card-reveal verification codes are retained for no more than twenty-four hours, each code additionally expiring after five minutes and being usable once only, with a successful verification authorising card reveals for thirty minutes; the card-access audit trail recording every card reveal, erasure and export is retained for one year, the minimum period required for payment-card security auditing; guest conversation messages are retained for two years, and the Property may delete a conversation at any time, in which case its messages and attachments are erased immediately; erasure of a guest also erases that guest's conversation messages outright, including staff replies within the same threads; automation queue rows for ninety days; activity-log (audit) rows for one hundred and twenty days; staff session records for thirty days of inactivity or seven days following revocation, whichever occurs first; AI assistant conversations for ninety days; the email suppression list recording opt-outs and delivery failures, retained for as long as is necessary to honour the opt-out or to protect delivery integrity, on the basis of legitimate interest; consent records for the duration of the account as immutable accountability evidence; support tickets and attachments, the staff directory and channel-synchronisation data until such time as the Property deletes them or the account is closed; conversations held through the public support chat are retained only for as long as necessary to handle the enquiry and any follow-up, and are erased upon request or when the conversation is deleted; push subscriptions until the permission is withdrawn or the account is closed, stale subscriptions being additionally purged after ninety days; data-subject request records for one year following resolution; marketing campaign delivery records for one year; sign-up verification codes for one day; and guest profiles, reservations and payment records until such time as the Property deletes them or the account is closed. Diagnostic and application logs are retained only for the short operational periods determined by the hosting provider and are not used for profiling or disclosed for secondary purposes. Upon closure of an account a thirty-day deletion window applies, following which the property record and all associated data, including stored files, are deleted, save where a longer period is required by law or by the rotation schedule of encrypted backups.

9. Governing law and contact

This DPA is governed by the laws of Albania, and the competent courts of Tirana, Albania have exclusive jurisdiction, without prejudice to the mandatory rights of data subjects under applicable data-protection law or of a Controller established in the EEA or the United Kingdom to rely on the protections of its own jurisdiction. Notwithstanding the choice of law in this clause, where the GDPR or the United Kingdom GDPR applies directly to the processing it applies irrespective of the law governing this DPA. Data-protection notices and requests under this DPA may be addressed to privacy@bookingpilot.al. Legal matters may be addressed to legal@bookingpilot.al.

Annex A. Processing details

For the purposes of clause 2 of this DPA: (a) the subject matter of the processing is the processing necessary to provide the Service as configured by the Controller; (b) the duration is the term of the account, together with the thirty-day post-closure deletion window; (c) the nature and purpose comprise the storage, organisation, transmission and display of data as instructed through the features of the Service, including the receipt of data submitted directly by guests through reservation-specific pre-check-in links, together with security monitoring, retention enforcement and backup; (d) the data subjects are the Controller's guests and prospective guests, and the Controller's staff and personnel whose data the Controller enters; (e) the categories of data are identity and contact details, stay and reservation details, special requests and free-text notes, communications, payment metadata and, where elected, encrypted card details, staff account, role and shift data, and technical session metadata including approximate location derived from IP address; and (f) special categories are not intended to be processed, as set out in clause 5.

Annex B. Technical and organisational measures

The technical and organisational measures applied to personal data processed through the Service comprise the following: (a) tenant isolation, by means of row-level security enforced on every database table, such that each Property's records are reachable only by its active members and internal tables carry no public grants; (b) encryption at rest, stored card details and guest identity-document numbers being encrypted with keys held in an isolated vault, decryption occurring only inside the database and plaintext reaching staff solely through the card-reveal flow described at (d); (c) encryption in transit, by means of TLS on all connections; (d) card-reveal controls, full card data being masked by default and reveal requiring a one-time verification code emailed to the requesting staff member, each successful verification authorising reveals for thirty minutes and every request, grant, denial and purge being written to an internal audit log; (e) access control, staff access being scoped by role and membership (owner, admin, front desk, housekeeping), with a session inventory permitting per-device revocation and passwords held only as salted hashes; (f) automated retention and deletion, scheduled jobs enforcing the published retention schedule without manual intervention; (g) secrets management, credentials and keys being held in managed secret stores and never in code or client bundles; (h) change management, data-layer changes being versioned and reviewed; and (i) incident response, a documented runbook defining classification, containment, assessment and notification procedures.

Annex C. Sub-processor categories and notification

A named register of the providers comprised within these categories is maintained by us and is provided to Controllers upon request addressed to privacy@bookingpilot.al. New or replacement providers are notified at least fourteen days in advance by means of the email address registered on the account; you may object within that period, and where we cannot reasonably accommodate a justified objection you may terminate the account.