Data processing agreement.

1. What, why and for how long

Subject and purpose: running Hostomat for you: connecting your channels, keeping your calendars, bookings, messages, reviews, tasks and owner statements, sending what you or your settings send, running your direct booking websites and the payments on them, and the AI features you use. Nature: storing, organising, reading, transmitting and deleting. Duration: while your account exists, and until your data is deleted after it closes (section 7).

2. Whose data, and what

People: your guests and people who ask about your homes; your teammates, cleaners and owners where you add them; and anyone named in your listings or messages.

Data: names, email addresses, phone numbers, country and language, who's coming and when, booking amounts, messages, reviews, and on your websites form entries, conversations and payment records (never card numbers). Don't send us special categories of data, such as health or identity documents, through Hostomat.

3. What we do

(a) Only on your instructions. We handle your data only as these terms, your settings and what you do in Hostomat instruct, including where it is transferred, unless a law requires otherwise, in which case we tell you first unless that law forbids it. We tell you if we think an instruction breaks data protection law.

(b) Confidentiality. Everyone who can reach your data for us is bound to keep it confidential.

(c) Security. We keep measures that fit the risk, as Article 32 asks: encryption in transit; every row tied to one account, with the database itself enforcing who may read it; channel and payment tokens kept on our servers only; incoming webhooks verified before use; access for our own people only as their work needs; and backups by our database provider.

(d) Sub-processors. You authorise the providers on our sub-processors page. We give you 14 days' notice by email before adding or replacing one, and you may object (the page says how). Each is bound by written terms that protect your data as this agreement does, and we remain responsible to you for them.

(e) People's rights. We help you answer requests from people to see, correct, export or delete their data, and pass on to you any such request that reaches us.

(f) Breaches and other help. We tell you without undue delay, and within 72 hours, after confirming a breach of your data, with what we know, and keep you told. We help you with security, breach notices, impact assessments and consulting a regulator, as far as they concern what we do.

(g) At the end. When your account closes we send you a copy of your data if you ask within 30 days, and delete your data within 90 days, unless a law requires us to keep part of it.

(h) Showing we comply. We give you the information you reasonably need to show this agreement is kept, and answer a written audit questionnaire once a year, on 30 days' notice, at your cost and in confidence. An inspection in person happens only where a regulator requires it.

4. Channels' own rules

Where Airbnb's or Booking.com's terms set stricter rules for their guests' data, such as using it only to run the stay and never for unsolicited marketing, those rules win over this agreement, and we both follow them. Booking.com's terms treat a connectivity provider as a processor acting for the property, which is how we act.

5. Transfers

Your data is stored in the United States, and Channex holds what it carries in the European Union. For data from the European Economic Area, the European Commission's standard contractual clauses (Decision 2021/914), Module Two (controller to processor) and Module Three (processor to processor), are part of this agreement: Clause 7 does not apply; under Clause 9 the general authorisation and notice in section 3(d) apply; the optional wording of Clause 11 does not apply; Clauses 17 and 18 choose the law and courts of Ireland; Annex I is sections 1 and 2 with you as data exporter and us as importer; Annex II is section 3(c); Annex III is the sub-processors page. For data from the United Kingdom, the UK's International Data Transfer Addendum to those clauses applies, its tables filled in by this agreement. For Switzerland, the same clauses apply, with the Swiss data protection authority as the supervisory authority.

6. Our own use

We don't use your data for our own purposes, sell it, or use it to train AI models. We may use measures of how Hostomat runs that identify no one.

7. Deletion, liability and order

Your data is deleted as section 3(g) says. Each party's liability under this agreement falls within the limits of the terms of service, as far as the law allows. If this agreement and the terms disagree on data protection, this agreement wins; if the standard contractual clauses disagree with either, the clauses win.

Contact

For anything about this agreement, email hello@hostomat.io.