1. Roles
- Controller — the customer organisation that creates a workspace and uploads guest and employee data.
- Processor — RoomKey24 LLC, processing that data only on the Controller's documented instructions, which are: (a) the Terms of Service, (b) the in-product settings the Controller configures, and (c) any additional written instructions from the Controller.
2. Subject matter, duration, nature and purpose
- Subject matter: personal data submitted to the Service by Controller users (admins, managers, employees).
- Duration: for as long as the Controller's subscription is active, plus the data-retention window in §11.
- Nature: hosting, storage, backup, encryption, transmission to selected sub-processors (Supabase, Stripe, AI gateway, Google OAuth) to deliver the modules ordered by the Controller.
- Purpose: running hotel operations — property management, team scheduling, finance, mailroom OCR, training, facility maintenance, revenue management.
3. Types of personal data per module
- PMS: guest names, contact, booking dates, special requests, payment status.
- Teams: employee identity, contact, contract data; sensitive PII (tax ID, national ID) encrypted column-level via pgcrypto.
- Mailroom: HR documents (payslips, tax notices) ingested via email.
- Finance: invoice and bank-transaction data.
- Academy: training progress and certificates.
- Facility: vendor contacts and maintenance records.
- RMS: rate/availability data and channel-manager API credentials, encrypted at rest.
4. Categories of data subjects
- Hotel guests (PMS, Mailroom).
- Hotel employees and contractors (Teams, Academy, Facility).
- Vendors and suppliers (Facility, Finance).
- Authorised users of the Controller (admins, managers).
5. Processor obligations
- Process personal data only on the Controller's documented instructions.
- Ensure personnel authorised to process data are bound by confidentiality.
- Implement and maintain the security measures in §6.
- Assist the Controller in responding to data-subject requests (access, erasure, portability) via in-product export and deletion tools.
- Assist with the Controller's obligations under Arts. 32–36 GDPR (security, breach notification, DPIA, prior consultation).
- Delete or return personal data at the end of the engagement, subject to §11.
- Make available all information necessary to demonstrate compliance and allow audits — see §10.
6. Security measures (Art. 32)
- TLS 1.2+ in transit; AES-256 at rest for storage and backups.
- Column-level PGP symmetric encryption (pgcrypto, server-only key) for: employee tax IDs and employee national IDs.
- AES-256-GCM encryption (WebCrypto, server-only key) for: channel-manager API keys, API secrets and webhook URLs.
- PostgreSQL row-level security on every multi-tenant table; tested via automated suite.
- Service-role keys never exposed to the browser; all privileged operations run via authenticated server functions.
- Role-based permissions inside customer workspaces (owner, admin, manager, staff).
- Audit log of sensitive-PII reveals (tax_id / national_id) with required reason.
- Vulnerability scans on dependencies; security linter on the database schema.
- Restricted internal access on least-privilege basis; production access is MFA-gated.
7. Sub-processors
The Controller authorises the following sub-processors:
- Supabase — managed Postgres, authentication, file storage. Region: EU.
- Stripe, Inc. — payment processing, invoicing, subscription state. Region: US.
- Google LLC (Gemini 2.5 Flash / Flash-Lite) — OCR, classification, suggestion. Region: US.
- OpenAI, L.L.C. (GPT-5.6) — RMS revenue-advisor chat only. Region: US.
- Google LLC — Google OAuth (only if the user chooses Sign in with Google). Region: US.
- Cloudflare, Inc. — edge hosting and DDoS protection. Region: global with EU PoPs.
We will give the Controller at least 30 days' notice before adding or replacing a sub-processor. The Controller may object on reasonable data-protection grounds; if we cannot accommodate the objection, the Controller may terminate the affected service with pro-rata refund.
8. International transfers
For transfers of personal data from the EEA/UK/Switzerland to the United States (Stripe, Google, OpenAI, Cloudflare), we rely on the EU Standard Contractual Clauses (Implementing Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework adequacy. UK transfers use the UK International Data Transfer Addendum.
9. Personal-data breaches
We will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal-data breach affecting the Controller's data, including: nature of the breach, categories and approximate number of data subjects, likely consequences, and measures taken or proposed.
10. Audits
We will make available SOC-type reports and policy documentation on request. Where this is not sufficient under applicable law, the Controller may, no more than once per year and with 30 days' notice, conduct an audit by an independent auditor under reasonable confidentiality terms, at the Controller's expense (unless the audit reveals material non-compliance).
11. Deletion and return on termination
On termination of the subscription, the Controller has 30 days read-only access for export. After 30 days, personal data is queued for deletion and permanently deleted within a further 60 days. Backups containing the data roll off within 35 days. We may retain specific records (e.g. invoices) where required by law.
12. Liability and order of precedence
Each party's liability under this DPA is subject to the limitations in the Terms of Service. In case of conflict on data-protection matters, this DPA prevails over the Terms.
Acceptance record
When an authorised user creates a workspace, they tick a box accepting this DPA on behalf of the Controller. The acceptance event (user, organisation, timestamp, IP, DPA version) is recorded in our dpa_acceptances table as the audit trail.