Data processing agreement

If this translation differs from the Dutch text, the Dutch text prevails. The Dutch version is the one you accept when you sign up.

Annex to the agreement between Noren (demoversie, geen echt bedrijf) ("we") and the accommodation ("you").

Provided by Noren (demoversie, geen echt bedrijf), Voorbeeldstraat 1, 1000 AA, Amsterdam, Dutch Chamber of Commerce (KvK) 00000000, VAT NL000000000B00.

This annex governs what happens to the personal data that we process on your behalf. You are the controller: they are your guests and your arrangements with them. We are the processor: we do what you instruct and nothing beyond that.

1. What it is about

Element	Agreement
Subject matter	Running the reservation system through which your accommodation takes bookings, communicates and makes its statutory reports
Duration	For as long as the agreement runs, plus the retention periods in article 7
Nature of the processing	Storing, organising, consulting, passing on to the parties in article 5, and erasing
Purpose	Handling reservations, informing guests, enabling payments, carrying out the reporting obligation for providers of accommodation, and, if you switch it on, sending mail on your behalf to guests who consented to it

2. Which data

Of guests: name, email address, phone number, arrival and departure date, room, number of people, amount and payment status, comments the guest leaves, and the language in which the guest wishes to be addressed.

Of guests who check in online (Spanish accommodations only): date of birth, place of birth, nationality, type and number of the identity document, expiry date, and possibly a photo of that document. This data is required by law under Real Decreto 933/2021 and is submitted to the reporting system of the Spanish Ministry of the Interior.

If you switch on mail on your behalf: whether a guest gave consent, when, and where the guest did so (the booking module or the check-in form), plus the moment the guest unsubscribed again. That last item is not paperwork for its own sake: without that record, you cannot show that consent was given.

Of you and your staff: name, email address, role, and what was done in the system.

We never ask for special categories of personal data within the meaning of article 9 GDPR. So please do not put them in the comments field either.

3. What we do and do not do

• We process exclusively on your instructions. This agreement plus the use of the system is that instruction.
• We never use your guests' data for ourselves: no marketing of our own, no resale, no profiles across accommodations.
• Mail on your behalf. If you switch on the sending of messages, we send them on your behalf and only to guests who consented to it. You are and remain the controller for this: you decide who receives what, and you are accountable for the consent. We provide the technology, record when and where a guest said yes, and make sure that unsubscribing works with one click and keeps working. We never send anything on our own behalf to your guests.
• Everyone on our side who has access is bound by confidentiality.
• Looking into your account to provide support is only possible with a recorded reason, and this is registered in a log that you can request.

4. Security

What is in place now, in plain words:

• Everything is encrypted in transit (TLS 1.2 or 1.3) and storage is encrypted at rest.
• Guests' document numbers are encrypted separately with a key that is not stored in the database (AES-256-GCM).
• Photos of identity documents are stored encrypted and deleted as soon as the statutory report has been accepted.
• Each accommodation is separated from every other accommodation in the database by row level security, and this is tested automatically with every change.
• Access to production is limited to the administrator, with two-factor authentication.
• A backup to European storage every day, and the restore test runs as a test (pnpm verify:backup). An untested backup does not count.
• We keep track of who did what and when. A record of who looked at something is kept for one year; what changed in an agreement or a setting is kept longer; see article 7.

5. Who else has access (sub-processors)

You consent to these parties. The first two are running now; the others are planned and will only take part once the component they are needed for goes live. If a party is added, or a planned party starts taking part, we will notify you at least thirty days in advance, and you may object.

Party	For what	Where	Status
Vercel Inc.	Hosting of the website and the system	Frankfurt (Germany)	in use
Supabase Inc.	Database	Frankfurt (Germany)	in use
Hetzner Online GmbH	Servers and database, replacing Vercel and Supabase	Germany	planned
Cloudflare, Inc.	Storage of document photos and backups	EU region	planned
Amazon Web Services (SES)	Sending email to guests	Ireland	planned
Mollie B.V.	Guest payments	Netherlands	planned
Beds24	Connection with Booking.com and Airbnb	Germany	planned

The data is stored within the European Economic Area. Vercel Inc. and Supabase Inc. are American companies; they store the data in Frankfurt, and Vercel delivers the pages through a worldwide network of servers. To the extent that either of them processes data outside the EEA in doing so, this takes place on the basis of the standard contractual clauses of the European Commission. Any other transfer outside the EEA will only take place on that same basis and only after we have notified you.

What you connect yourself. If you connect your own WhatsApp Business account in the system, we exchange messages on your instruction with Meta Platforms Ireland Ltd. (Dublin, Ireland), which provides the WhatsApp Business Cloud API: the guest's phone number and the messages between you and the guest. This only happens for accommodations that switch on that connection themselves, and only while it is switched on. For that processing you enter into your own agreement with Meta, and Meta's terms apply to it; Meta may process data outside the EEA in doing so. Meta is therefore not our sub-processor. If you switch the connection off, we pass nothing on any more; the messages already in the system remain covered by this agreement.

6. If something goes wrong

If we discover a data breach, we will notify you within 24 hours, with what we know: what happened, which data is involved, how many people, and what we are doing about it. You decide whether a report goes to the supervisory authority: they are your guests. We help with the information you need for that.

7. Retention and deletion

Data	Period	Why
Reservations and invoices	7 years	Statutory tax retention
Guest registration (document numbers)	3 years	Real Decreto 933/2021
Photos of documents	until the report has been accepted	Keeping them longer is not allowed
Log of who looked at what	1 year	After a year that record is worth nothing
Log of what changed in an agreement or setting	duration of the agreement + 7 years	Otherwise an agreement from three years ago can no longer be checked
Consent to mailings, and its withdrawal	until you withdraw it, and then 3 years as proof	Without that proof, you cannot show that consent was given
Everything else	until the end of the agreement	not applicable

At the end of the agreement, you will receive a complete export in a readable format within thirty days. After that we delete everything, except what we are required by law to keep; what remains is listed in the table above.

8. Guests' rights

If a guest asks you for access, rectification or erasure, we will provide you with the data within five working days and carry out the erasure, except where the law requires us to keep it. If a guest asks us directly, we will refer the guest to you and let you know.

9. Audit

You may check once a year whether we comply with this agreement. We answer questions in writing and, on request, show how something works. If you want an external audit, that is allowed at your own expense, provided it is announced in advance and other customers are not affected by it.

---

This text was drafted for this product and has not yet been reviewed by a lawyer. The other documents are listed in the overview.