Clear Instructions. Defined Responsibilities. GDPR-Aligned Processing.

Parties and Application of This DPA

This Data Processing Agreement (“DPA”) is entered into between:

This DPA applies only where HotelConnect24 processes personal data on behalf of the Controller within the meaning of applicable data-protection law.

This DPA does not automatically apply to processing for which HotelConnect24 independently determines the purposes and means. Such processing is governed by applicable law and the HotelConnect24 Privacy Policy.

Definitions

Terms such as “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings given to them under the GDPR where the GDPR applies.

For this DPA:

• “Controller Data” means Personal Data processed by HotelConnect24 on behalf of the Controller under this DPA.
• “Services” means the HotelConnect24 services covered by the relevant Partner agreement.
• “Subprocessor” means another processor engaged by HotelConnect24 to process Controller Data on behalf of the Controller.
• “Applicable Data Protection Law” means the data-protection law applicable to the processing covered by this DPA.
• “GDPR” means Regulation (EU) 2016/679 where applicable.
• “Instructions” means documented instructions issued by the Controller concerning Controller Data.

Scope and Roles of the Parties

For processing covered by this DPA:

• the Partner acts as Controller; and
• Bigmedia24 Dynamics Ltd. acts as Processor.

The Controller determines the purposes of processing and is responsible for ensuring that its instructions are lawful.

The Processor processes Controller Data to provide the HotelConnect24 Services described in the underlying agreement and Annex II.

Where the parties are independent controllers for a particular processing activity, that activity is outside the processor scope of this DPA.

Examples of potentially separate Controller processing

Depending on the circumstances, HotelConnect24 may act independently in relation to certain:

• corporate-account administration;
• security and abuse prevention;
• legal compliance;
• business billing and accounting;
• fraud investigations;
• service-level communications; or
• other purposes independently determined by HotelConnect24.

The exact role is determined by the real processing activity rather than merely by the name of the system through which data passes.

Documented Controller Instructions

HotelConnect24 will process Controller Data only on documented instructions from the Controller, including with respect to transfers of Personal Data, unless processing is required by applicable Union or Member State law.

Documented Instructions include:

• this DPA;
• the relevant HotelConnect24 Partner agreement;
• configuration selected through authorised Partner accounts;
• valid API or integration configuration;
• documented support instructions;
• documented booking or reservation workflows; and
• other written or electronically recorded instructions agreed by the parties.

If applicable law requires HotelConnect24 to process Controller Data without the Controller's instruction, HotelConnect24 will inform the Controller of that legal requirement before processing unless the law prohibits such information on important grounds of public interest.

Processor Obligations

HotelConnect24 will:

• process Controller Data only in accordance with documented Instructions, except where law requires otherwise;
• ensure appropriate confidentiality obligations apply to authorised personnel;
• implement appropriate technical and organisational security measures;
• apply the Subprocessor requirements set out in this DPA;
• assist the Controller with Data Subject requests where required by the nature of the processing;
• assist with relevant GDPR compliance obligations as described below;
• notify the Controller of relevant Personal Data Breaches without undue delay after becoming aware of them;
• return or delete Controller Data after the end of the Services in accordance with this DPA; and
• make available information reasonably necessary to demonstrate compliance with the Processor obligations under this DPA.

HotelConnect24 remains directly subject to obligations that applicable data-protection law imposes on processors independently of this DPA.

Confidentiality

HotelConnect24 will ensure that persons authorised to process Controller Data are subject to an appropriate duty of confidentiality or relevant statutory confidentiality obligation.

Access to Controller Data should be limited to persons who require access for authorised operational, technical, support, security or compliance purposes.

Authorised personnel must not use Controller Data for unrelated personal or unauthorised purposes.

Security of Processing

HotelConnect24 will implement and maintain technical and organisational measures appropriate to the risk associated with processing under this DPA.

The measures should take into account, as applicable:

• the nature, scope, context and purposes of processing;
• the state of the art;
• implementation costs; and
• risks to the rights and freedoms of Data Subjects.

The principal HotelConnect24 measures are described in Annex III.

Security measures may evolve as technology, architecture, risk and the Services develop, provided that changes do not materially reduce the overall level of protection required by applicable law.

Subprocessors

The Controller provides general written authorisation for HotelConnect24 to engage Subprocessors required to provide the Services, subject to the safeguards in this DPA.

HotelConnect24 will ensure that each relevant Subprocessor is bound by written data-protection obligations that provide at least the level of protection required for the relevant processing under Article 28 GDPR.

The Subprocessor must process Controller Data only to provide the subcontracted service within the scope authorised by HotelConnect24.

Where a Subprocessor fails to fulfil its applicable data-protection obligations, HotelConnect24 remains responsible to the Controller for the performance of the Subprocessor's obligations to the extent required by applicable law.

Known Subprocessor categories are described in Annex IV and on the Subprocessors page.

Changes to Subprocessors

Where HotelConnect24 relies on the Controller's general authorisation, HotelConnect24 will inform the Controller of intended additions or replacements of relevant Subprocessors so that the Controller has an opportunity to object on reasonable data-protection grounds.

Notice may be provided through an agreed electronic communication, Partner account, Subprocessor notification mechanism or another documented channel appropriate to the relationship.

If the Controller objects to a new Subprocessor on legitimate data-protection grounds, the parties should discuss the concern in good faith.

Where a reasonable alternative cannot be provided without materially altering the Services, either party may exercise applicable contractual rights concerning the affected Service.

Data Subject Rights

Taking into account the nature of the processing, HotelConnect24 will assist the Controller by appropriate technical and organisational measures, insofar as reasonably possible, with responding to requests for exercise of Data Subject rights.

Such rights can include, where applicable:

• access;
• rectification;
• erasure;
• restriction;
• data portability;
• objection; and
• rights relating to certain automated decision-making.

If HotelConnect24 receives a Data Subject request relating specifically to Controller Data processed solely on behalf of the Controller, HotelConnect24 may direct the request to the Controller unless HotelConnect24 is legally required to respond itself.

The Controller remains responsible for determining how a request should be handled where the Controller is responsible for the relevant processing.

Assistance with Controller Compliance

Taking into account the nature of processing and the information available to HotelConnect24, HotelConnect24 will provide reasonable assistance to the Controller in relation to applicable obligations concerning:

• security of processing;
• Personal Data Breach assessment and notification;
• Data Protection Impact Assessments; and
• prior consultation with a Supervisory Authority.

The Controller remains responsible for determining whether a particular legal obligation applies to its processing.

Personal Data Breaches

HotelConnect24 will notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Data processed under this DPA.

To the extent information is reasonably available, the notification or subsequent updates will provide information appropriate to assist the Controller with its applicable breach obligations, which may include:

• the nature of the incident;
• categories of affected data;
• categories of affected Data Subjects;
• likely consequences where known;
• measures taken or proposed to address the incident; and
• relevant contact or coordination information.

Where all information is not available at the same time, HotelConnect24 may provide it in phases without undue further delay.

Data Protection Impact Assessments and Prior Consultation

Where the Controller reasonably requires information about HotelConnect24 processing covered by this DPA in order to complete a legally required Data Protection Impact Assessment, HotelConnect24 will provide reasonable assistance taking into account the nature of processing and information available to it.

Where Article 36 GDPR or comparable law requires prior consultation with a Supervisory Authority, HotelConnect24 will provide reasonable assistance relating to its Processor activities.

HotelConnect24 is not responsible for preparing the Controller's entire DPIA or determining the Controller's legal basis for processing.

International Data Transfers

HotelConnect24 will process Controller Data in accordance with the Controller's documented Instructions concerning transfers to third countries or international organisations, subject to applicable law.

Where processing under this DPA involves a transfer restricted by Chapter V GDPR or comparable law, the parties will ensure that an appropriate transfer mechanism is available where required.

Such mechanisms can include, where legally appropriate:

• an adequacy decision;
• applicable Standard Contractual Clauses;
• Binding Corporate Rules;
• another legally recognised transfer safeguard; or
• a lawful derogation in the limited circumstances where one applies.

Return and Deletion of Controller Data

After termination or expiry of the Services involving Controller Data, HotelConnect24 will, at the Controller's choice where required by Article 28 GDPR:

• delete the relevant Controller Data; or
• return the relevant Controller Data and delete remaining copies,

unless applicable Union or Member State law requires continued storage.

The method of return will depend on the applicable Service, available export functionality and the type of Controller Data involved.

Backups

Controller Data contained in protected backup systems may remain until the relevant backup is deleted or overwritten in accordance with applicable backup cycles, provided that such data remains protected and is not restored for ordinary operational use except where required for recovery, security or legal purposes.

Information, Audits and Inspections

HotelConnect24 will make available to the Controller information reasonably necessary to demonstrate compliance with the Processor obligations set out in Article 28 GDPR and this DPA.

HotelConnect24 will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller where required by applicable law.

Unless an urgent security, regulatory or legal reason requires otherwise, audits should:

• be requested with reasonable advance notice;
• be limited to information relevant to Controller Data and this DPA;
• protect HotelConnect24 confidential information and other customers' data;
• avoid unnecessary disruption to HotelConnect24 services;
• comply with reasonable security requirements; and
• take account of available documentation or independent assurance before requiring duplicative inspection.

Nothing in this section restricts the lawful powers of a competent Supervisory Authority.

Controller Responsibilities

The Controller is responsible for:

• ensuring it has a lawful basis for Controller Data provided to HotelConnect24;
• providing required privacy information to Data Subjects;
• ensuring its Instructions comply with applicable law;
• determining appropriate retention requirements for its purposes;
• responding to Data Subject requests for which it is responsible;
• maintaining accurate hotel and Guest-processing configuration;
• using appropriate account and access controls;
• not instructing HotelConnect24 to process Personal Data unlawfully; and
• ensuring that any special-category data supplied is necessary and lawfully processed.

The Controller must not use HotelConnect24 to collect or process Personal Data for a purpose that violates applicable data-protection law.

Instructions that May Infringe Data-Protection Law

If HotelConnect24 considers that an Instruction infringes the GDPR, other Union data-protection law or applicable Member State data-protection law, HotelConnect24 will inform the Controller without undue delay, unless applicable law prohibits such notification.

HotelConnect24 may suspend the affected processing where reasonably necessary to avoid carrying out an instruction that appears unlawful while the parties clarify the issue.

Such notification does not constitute legal advice to the Controller.

Records, Regulatory Cooperation and Compliance

Each party will maintain records and documentation required of it by applicable data-protection law.

HotelConnect24 will cooperate with competent Supervisory Authorities as required by applicable law in relation to Processor activities.

The Controller remains responsible for records of processing activities required for its own Controller operations.

Liability

Liability relating to this DPA is subject to applicable law and, where legally permitted, the liability provisions of the underlying Hotel Partner agreement.

Nothing in this DPA excludes liability that applicable data-protection law does not permit the parties to exclude or limit.

Each party remains responsible for its own compliance with obligations directly imposed on it by applicable data-protection law.

Duration

This DPA applies for as long as HotelConnect24 processes Controller Data on behalf of the Controller under the relevant Services.

Provisions that by their nature continue after termination — including confidentiality, deletion, return, audit relating to the processing period and applicable liability provisions — remain effective to the extent required.

Order of Precedence

If there is a conflict between this DPA and the general Hotel Partner Terms regarding processing covered by Article 28 GDPR, this DPA prevails to the extent of that conflict.

A binding set of data-protection Standard Contractual Clauses or other mandatory statutory clauses prevails where applicable and to the extent required by law.

Nothing in a commercial agreement should be interpreted to reduce protections required by applicable data-protection law.

Changes to This DPA

HotelConnect24 may update this published DPA to reflect changes in law, Services, security measures, Subprocessors or processing architecture.

A material change affecting an existing binding DPA will be handled in accordance with the applicable Partner agreement and any legal requirements concerning amendment of the processing agreement.

A website publication alone will not retrospectively reduce mandatory Article 28 protections applicable to existing processing.

Governing Law and Contact

Unless another binding agreement states otherwise, this DPA is governed by the laws of Ireland, subject to mandatory applicable data-protection law.

Annex I — Parties

Annex II — Description of Processing

Relevant Service Activities

• reservation receipt and management;
• room, rate and availability workflows where Personal Data is involved;
• direct-booking functionality;
• distribution of relevant reservation information;
• guest communication workflows where configured;
• reservation synchronisation with supported systems;
• technical support involving Controller Data;
• API and webhook processing;
• security and operational processing necessary to provide the instructed Service; and
• deletion, export or return of Controller Data.

Categories of Data Subjects

• Guests;
• prospective Guests where relevant booking data is submitted;
• persons included within a reservation;
• Hotel Partner personnel where their Personal Data forms part of Processor activity;
• authorised hotel users; and
• other individuals whose Personal Data is lawfully supplied by the Controller for the Services.

Categories of Personal Data

• name;
• contact details;
• booking reference;
• stay dates;
• Property and room information;
• occupancy information;
• rate and reservation information;
• reservation status;
• Guest preferences and requests;
• communication data;
• technical identifiers;
• integration identifiers;
• support information;
• payment-related references or status where relevant, excluding unnecessary card authentication secrets; and
• other Personal Data submitted through authorised service configuration.

Special Categories of Personal Data

HotelConnect24 Services are not generally intended to require special-category Personal Data.

However, limited special-category information may occasionally be provided by or for a Guest where necessary for a legitimate stay-related request, for example certain accessibility, dietary or health-related information.

The Controller is responsible for ensuring that such processing is lawful and limited to what is reasonably necessary.

Annex III — Technical and Organisational Measures

HotelConnect24 applies technical and organisational measures designed to provide a level of security appropriate to the risk associated with the processing.

Additional information is available on the Security and Trust Center pages.

Annex IV — Subprocessors

The exact Subprocessors relevant to a Controller can depend on the HotelConnect24 Services, architecture and communication functions used.

Known providers currently relevant to the HotelConnect24 environment include:

A provider is a Subprocessor only to the extent that it actually processes Controller Data on behalf of HotelConnect24 as Processor. A technology or distribution partner is not automatically a Subprocessor merely because it connects with HotelConnect24.

The current public provider information is available at: HotelConnect24 Subprocessors.