Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Loti Members LLC, operator of Hostlio Pro (“Processor”, “we”), and the customer that has accepted them (“Controller”, “you”). It applies to personal data of your guests and staff that we process on your behalf when providing Hostlio Pro (“Customer Personal Data”). It takes effect when you accept the Terms of Service. A countersigned copy is available on request from hello@hostliopro.com.

1. Definitions

“Data Protection Law” means all laws that apply to the processing of Customer Personal Data, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), Brazil’s LGPD and the California Consumer Privacy Act as amended (“CCPA”). “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR. “Subprocessor” means a third party we engage to process Customer Personal Data.

2. Roles and instructions

You are the controller and we are the processor (and, under the CCPA, your service provider). We process Customer Personal Data only on your documented instructions, which are these Terms, this DPA and your use and configuration of Hostlio Pro, unless the law requires otherwise; in that case we will inform you first unless the law prohibits it. We will tell you if we believe an instruction infringes Data Protection Law. You are responsible for the lawfulness of the processing, including informing guests and having a legal basis.

3. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality obligations.

4. Security

We implement the technical and organisational measures in Annex 2 and keep them appropriate to the risk. We may update them as long as the overall level of protection does not decrease.

5. Subprocessors

You give general authorisation for us to use subprocessors. The current list is in Annex 3 and on our Security and data page. We will notify you by email or in the dashboard at least 30 days before adding or replacing a subprocessor; you may object on reasonable data-protection grounds, and if we cannot resolve the objection you may terminate the affected service and receive a pro-rata refund of prepaid fees for it. We impose data-protection obligations on each subprocessor that are no less protective than this DPA and remain responsible for their performance.

6. Data subject requests

Taking into account the nature of the processing, we help you respond to requests from data subjects (access, correction, deletion, restriction, portability, objection), mainly through the features of the dashboard. If we receive a request directly, we will pass it to you without undue delay and will not respond ourselves unless you instruct us to.

7. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the data and data subjects concerned, likely consequences and the measures taken, as far as that information is available.

8. Assistance

We give reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the information available to us.

9. Deletion and return

You can export your data while your account is active. After the account ends we delete Customer Personal Data within 30 days, except where the law requires us to keep it. Guest message content is anonymised after the retention period you configure (default 60 days).

10. Audits

We make available the information reasonably necessary to demonstrate compliance with this DPA, including our subprocessors’ security reports where they allow it. If that is not sufficient, you may carry out an audit once a year, with 30 days’ notice, during business hours, at your cost and under confidentiality.

11. International transfers

Where Customer Personal Data is transferred from the EEA, Switzerland, the UK or Türkiye to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2, controller to processor) are incorporated by reference, with the UK International Data Transfer Addendum and the standard contracts published under KVKK Article 9 where applicable. For the Clauses: Clause 7 (docking) applies; Clause 9 option 2 (general authorisation) applies with the notice period in section 5; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; Annexes I and II are Annex 1 and Annex 2 of this DPA.

12. CCPA

We will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the service, or combine it with personal data we receive from others, except as the CCPA permits.

13. Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow this. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; the Standard Contractual Clauses prevail over both.

Annex 1 — Details of processing

• Subject matter and duration: providing Hostlio Pro for the term of your subscription and until deletion under section 9
• Nature and purpose: hosting and storage; syncing availability, rates and reservations with sales channels; sending and receiving guest messages on WhatsApp and OTA inboxes; drafting replies with AI; online check-in; support
• Data subjects: your guests and their companions; your staff and users of the dashboard
• Categories of data: names, contact details (phone, email), reservation details (dates, room, price, channel), message content, preferences and requests; for online check-in, identity document details and images, date of birth, nationality and digital signatures
• Special categories: none intended. Identity documents and signatures are handled as sensitive data. Please do not ask guests to send health or other special-category data through Hostlio Pro
• Frequency: continuous

Annex 2 — Technical and organisational measures

• Encryption in transit (TLS 1.2+) and at rest for databases and file storage
• Logical separation of each customer’s data and row-level access rules; staff access by role
• Authentication for all dashboard users; passwords stored as salted hashes by our authentication provider
• Least-privilege access for our personnel; production access limited to those who need it
• Payment card data handled only by Stripe (PCI DSS Level 1); no card data on our systems
• Managed infrastructure with automated backups and provider-level physical security (SOC 2 Type 2 audited database provider)
• Logging of security-relevant events and monitoring for abuse; fraud controls at signup
• Configurable retention and anonymisation of guest message content
• Vendor review and written data-protection terms with each subprocessor
• Incident response process with customer notification as set out in section 7

Annex 3 — Subprocessors

Planned: Twilio Inc. (WhatsApp numbers and messaging billing) and Twilio SendGrid (transactional email). They will be added with notice under section 5 before they process Customer Personal Data.

Signatures

Accepted electronically by the Controller when accepting the Terms of Service. For a countersigned copy, email hello@hostliopro.com with your company name, address and the name of your signatory.