Data Processing Agreement

1. Parties and roles

The Customer (the business that runs the workspace) is the controller. Stay n Host, owned and operated by Abdul Rehman Zafar, Germany (see the imprint), is the processor. This agreement is part of the Customer Terms and is accepted with them.

2. Subject, duration, nature and purpose

• Subject: hosting and operating the Stay n Host service for the Customer.
• Duration: the term of the Customer Terms, plus the export and deletion period they set out.
• Nature: storage, organisation, retrieval, transmission (for example messages the Customer sends), and deletion.
• Purpose: providing the property-management features the Customer uses, and nothing else.

3. Data and data subjects

• Data subjects: the Customer's guests, property owners, investors, staff and other users, and people who contact the Customer.
• Categories: identification and contact details, booking and stay details, identity documents the Customer chooses to collect, payment records (never card numbers), messages, and usage logs.
• The Customer decides which data is collected. Stay n Host does not ask for special categories of data, and the Customer should not store them unless the law permits it.

4. Our obligations as processor

• We process personal data only on the Customer's documented instructions, which are the Customer Terms and the Customer's use of the service, unless the law requires otherwise, in which case we tell the Customer first where we may.
• Everyone we authorise to process the data is bound to confidentiality.
• We apply the technical and organisational measures described in section 7.
• We help the Customer answer data-subject requests, and with security, breach notification, data-protection impact assessments and consultations with authorities, as far as the nature of the processing allows.
• We tell the Customer without undue delay after becoming aware of a personal-data breach affecting its workspace.
• When the agreement ends we return the data by export and then delete it, as the Customer Terms describe, unless the law requires us to keep it.
• We make available the information needed to demonstrate compliance and allow for audits, including inspections, by the Customer or an auditor it appoints, on reasonable notice and at the Customer's cost, no more than once a year unless there has been a breach.

5. Sub-processors

The Customer authorises the sub-processors named in the privacy policy. As of the date above they are:

• Amazon Web Services (United States): hosting, database, file storage and backups.
• Amazon Web Services Bedrock (United States): the AI features (reply drafts, the AI assistant and its autopilot, translation of the Customer's booking-site content, Ask AI), when the Customer uses them. Door codes and Wi-Fi passwords are removed before text is sent.
• Meta Platforms: WhatsApp messaging on the Customer's own connected number, and verification codes sent by WhatsApp.
• Twilio and SendPK: one-time SMS codes that prove a user's mobile number.
• Google: Sign in with Google, and maps.
• Microsoft: Sign in with Microsoft.
• Channex: the channel manager for Airbnb, Booking.com, Expedia, Agoda, Vrbo and Google Vacation Rentals, when the Customer connects them.
• TTLock and Nuki: per-stay door codes on the Customer's smart locks, when the Customer connects an account.
• A transactional email provider, for sign-in emails, notifications and statements.

We bind each of them to data-protection obligations equivalent to these. We will give notice before adding or replacing a sub-processor, and the Customer may object on reasonable grounds; if we cannot address the objection, the Customer may end the affected service.

6. International transfers

Where data leaves the European Economic Area, we transfer it only under an adequacy decision or the European Commission's Standard Contractual Clauses, with any supplementary measures the transfer requires.

7. Security measures

• Each workspace's data is separated from every other workspace's at the database level (row-level security on every table), not only in application code.
• Encryption in transit (TLS) and at rest; credentials for connected services are stored sealed.
• Role-based access inside each workspace, with per-property scoping set by the Customer.
• An audit trail of every state change, with the person or automation that made it.
• Access by Stay n Host support staff only through a time-limited, recorded grant.
• Backups, monitoring, and a documented incident process.

8. Contact

Data-protection questions: info@staynhost.com, subject line PRIVACY.