Data Processing Agreement

Last updated: 12 July 2026

What this is: the standard data processing agreement (DPA) between GuestBridge and each hotel customer, as required by Article 28 of the GDPR. It forms part of the service agreement with every hotel. Hotels that need a signed copy can print this page or request a countersigned document at [email protected].

1. Parties

This agreement is made between:

• The Controller: the hotel customer identified in the order or onboarding confirmation, hotel name and registered address ("the Hotel").
• The Processor: GuestBridge, an early stage service operated by its founder ("the Provider"). Full legal provider details will be published once business registration is complete, and this agreement will be updated to name the registered entity.

2. Subject matter and scope

The Provider operates an AI guest concierge for the Hotel: a guest-facing chat, a staff dashboard for handling guest requests, and optional integrations such as property management system connections and email notifications (together, "the Service"). In providing the Service, the Provider processes personal data of the Hotel's guests on the Hotel's behalf. The details of that processing are set out in Annex 1.

This agreement covers guest personal data processed through the Service. For hotel staff accounts and billing contacts, the Provider acts as an independent controller, as described in the Privacy Policy, and those data are not covered by this agreement.

3. Roles and instructions

The Hotel is the data controller and the Provider is its data processor for guest data. The Provider processes guest data only on the Hotel's documented instructions, including with regard to transfers outside the EEA, unless required to do otherwise by EU or member state law. In that case the Provider informs the Hotel of the legal requirement before processing, unless the law prohibits it. The Hotel's use of the Service and its configuration choices in the dashboard constitute its instructions. The Provider informs the Hotel without delay if, in its opinion, an instruction infringes the GDPR.

The Hotel warrants that it has a lawful basis for the guest data it processes through the Service and that its instructions comply with data protection law.

4. Confidentiality

The Provider ensures that every person authorised to process guest data is bound by a contractual or statutory duty of confidentiality.

5. Security

Taking into account the state of the art and the nature of the data, the Provider implements and maintains appropriate technical and organisational measures to protect guest data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access, as required by Article 32 of the GDPR. The current measures are described in Annex 2. The Provider may update them over time, provided the overall level of protection does not decrease.

6. Subprocessors

The Hotel gives general authorisation for the Provider to use the subprocessors listed in Annex 3. The Provider imposes data protection obligations on each subprocessor that are no less protective than those in this agreement, and remains fully liable to the Hotel for their performance.

The Provider gives the Hotel at least 30 days notice before adding or replacing a subprocessor, by email or through the dashboard. If the Hotel has reasonable data protection grounds to object, the parties will discuss the concern in good faith; if it cannot be resolved, the Hotel may terminate the Service as set out in the Terms of Service.

7. International transfers

Guest data is processed within the European Economic Area wherever the Service architecture allows. Where a subprocessor processes personal data outside the EEA, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the Commission's Standard Contractual Clauses, as noted in Annex 3.

8. Assistance to the Hotel

• Data subject rights: taking into account the nature of the processing, the Provider assists the Hotel with appropriate technical and organisational measures in responding to requests from guests to exercise their GDPR rights, including access, rectification, and erasure. Requests received directly from guests are forwarded to the Hotel without undue delay.
• Security, breach, and impact assessments: the Provider assists the Hotel in meeting its obligations under Articles 32 to 36 of the GDPR, taking into account the information available to the Provider.

9. Personal data breach

The Provider notifies the Hotel without undue delay after becoming aware of a personal data breach affecting guest data. The notification describes, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. The Provider documents breaches and cooperates with the Hotel's own notification duties.

10. Deletion and return of data

During the term of the Service, the Hotel can delete guest data through the dashboard or by instruction to the Provider. After the end of the Service, the Hotel may request an export of its data within 30 days; after that period the Provider deletes guest data from production systems, unless EU or member state law requires further storage. Database backups expire automatically on their rolling schedule.

11. Audits and information

The Provider makes available to the Hotel the information necessary to demonstrate compliance with Article 28 of the GDPR, starting with this agreement, its annexes, and the Privacy Policy. The Provider allows for and contributes to audits, including inspections, conducted by the Hotel or an auditor it mandates, provided they are announced with reasonable notice, take place during business hours at most once per year unless a breach gives cause, do not endanger the security or confidentiality of other hotels' data, and the Hotel bears its own costs. Written responses to reasonable information requests satisfy this obligation where they resolve the question.

12. Liability, term, and law

The liability provisions of the Terms of Service apply to this agreement. This agreement takes effect with the service agreement and remains in force for as long as the Provider processes guest data for the Hotel. This agreement is governed by the laws of Hungary. If this agreement conflicts with the Terms of Service on a data protection matter, this agreement prevails.

Annex 1: Details of processing

Subject matter and duration

Operation of the AI guest concierge Service for the Hotel, for the duration of the service agreement.

Nature and purpose

Receiving guest chat messages, generating concierge replies with the help of an AI model, creating and routing staff tickets from guest requests, notifying hotel staff, collecting optional guest satisfaction ratings, and showing the Hotel aggregated service analytics.

Categories of data subjects

Guests and prospective guests of the Hotel who use the concierge chat.

Categories of personal data

• Chat messages, and any personal data a guest chooses to include in them, typically a name and room number, occasionally contact details.
• Requests and tickets created from the messages, their status history, and optional star ratings.
• A random session identifier, language choice, and technical data such as IP address used for security controls.

The Service does not ask guests for special categories of data. If a guest volunteers such information in a message, for example a dietary or accessibility note in a request, it is processed with the same safeguards as all other message content. Where the Hotel connects a property management system, the Provider reads hotel facts such as room types and stay dates and never retrieves guest names or contact details from that system.

Annex 2: Technical and organisational measures

• Encryption in transit: all traffic is served over HTTPS with HTTP Strict Transport Security.
• Tenant isolation: every record is bound to the hotel it belongs to. Isolation is enforced in the application and additionally by PostgreSQL row level security, so database queries for one hotel cannot return another hotel's rows.
• Access control: staff access is role based and account bound. Passwords are stored as salted hashes and are never stored in plain text. Sessions use secure, HttpOnly cookies. Repeated failed logins lock the account temporarily.
• Credential protection: property management system credentials are stored encrypted with AES-256-GCM and are never returned by the API.
• Data minimisation: guests need no account, and no guest identities are read from connected hotel systems.
• Abuse protection: rate limiting, login lockouts, and monthly usage caps protect the platform and its data.
• AI processing: guest messages are sent to the AI provider through its API, which contractually does not use API data to train models.
• Backups and recovery: the production database is backed up automatically on a rolling schedule, and backups expire automatically.
• Change safety: an automated regression suite, including tenant isolation tests, runs on every code change before it reaches production.

Annex 3: Authorised subprocessors

Signatures

This agreement applies automatically as part of the service agreement. Signatures are only needed if the Hotel requires a signed copy for its records.