Data Processing Agreement

This Data Processing Agreement (this "DPA") forms part of the Terms of Service (the "Agreement") between VERIDIEN (SP08022026), a sole proprietorship registered in the Republic of Maldives ("Veridien"), and the business that has accepted the Agreement ("Customer"). Veridien and Customer are each a "Party" and together the "Parties". This DPA takes effect on the date Customer accepts the Agreement (the "Effective Date"). Capitalised terms not defined in this DPA have the meanings given in the Agreement.

1. Scope and roles

1.1 Application

This DPA applies to Veridien's processing of Personal Data contained in Customer Data on behalf of Customer in connection with the Service ("Customer Personal Data"). In a hotel, that is above all the data of guests: their identity and contact details, reservations, folios, messages and stay history.

"Data Protection Laws" means the privacy and data protection laws that apply to that processing, including, where applicable, the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and the data protection laws of the Republic of Maldives. "Personal Data", "Controller", "Processor", "process", "sell" and "share" have the meanings given by the applicable Data Protection Laws. "Sub-processor" means a third party engaged by Veridien to process Customer Personal Data on Veridien's behalf.

1.2 Roles and instructions

As between the Parties, Customer is the Controller of Customer Personal Data, or a Processor acting on a Controller's behalf, and Veridien is the Processor or Sub-processor.

Veridien will process Customer Personal Data only on Customer's documented instructions. Those instructions are the Agreement, this DPA, any order form, and the settings, permissions and automations Customer configures in the Service (for example, which channels are connected, which staff may see which data, and whether the AI features are turned on), unless applicable law requires other processing.

Where the law allows, Veridien will tell Customer before carrying out processing that the law requires. Veridien will also tell Customer if it reasonably believes an instruction would breach Data Protection Laws.

1.3 Customer responsibilities

Customer is responsible for the lawfulness of Customer Personal Data and of its instructions, including giving guests the notices they are owed and obtaining any consent or other permission the law requires. Customer decides what guest data it records in the Service and how long it needs it.

Customer will not enter categories of data that the Agreement prohibits, such as payment card numbers or health data beyond what a hotel lawfully needs to record, unless the Parties have agreed in writing to the additional safeguards that data requires.

1.4 Data Veridien processes as a Controller

This DPA does not apply to Personal Data that Veridien processes as an independent Controller for its own purposes: the account details of the people who sign up and work in the Service, billing records, support conversations, website visits, and the security and technical logs Veridien generates while running the Service. The Privacy Policy describes that processing.

2. Processing, security and assistance

2.1 Use and confidentiality

Veridien will ensure that anyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and has access only to the extent needed to provide, secure, maintain and support the Service.

Veridien will not sell or share Customer Personal Data, will not use it for advertising, and will not use it to train or improve any machine learning model. Veridien does not permit its AI providers to use Customer Personal Data to train their models on Veridien's behalf.

Nothing in this DPA prevents Veridien from producing aggregated statistics that do not identify Customer, any individual or any property (for example, how many properties use a feature), provided those statistics are not Personal Data under the applicable Data Protection Laws.

2.2 Security measures

Taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, Veridien will maintain the technical and organisational measures described in Schedule 2. Those measures may change over time, provided the overall level of protection is not materially reduced during the term of the Agreement.

2.3 Security incidents

Veridien will notify Customer without undue delay, and where feasible within seventy-two (72) hours, after becoming aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data (a "Security Incident").

The notice will include the information reasonably available to Veridien about the nature and likely consequences of the Security Incident, the data and individuals affected, and the measures taken or proposed. Information may be provided in stages as it becomes available. Veridien will take reasonable steps to contain and remedy the Security Incident. A notice is not an admission of fault or liability.

2.4 Assistance and requests from individuals

Taking into account the nature of the processing and the information available to it, Veridien will give Customer reasonable assistance, where Customer cannot reasonably meet the obligation itself through the Service, with requests from individuals to exercise their privacy rights, with security and breach notification obligations, with data protection impact assessments, and with consultations with a supervisory authority.

Most requests can be met inside the Service: a guest record can be viewed, corrected, exported, anonymised or deleted from the guest profile by staff with the right permission.

If Veridien receives a request directly from an individual about Customer Personal Data, Veridien will pass it to Customer and will not respond except on Customer's documented instructions or where the law requires it.

2.5 Return and deletion

When the Agreement ends, Customer has the export period set out in the Agreement (thirty (30) days) to export Customer Personal Data through the export tools and the API. After that period Veridien will delete Customer Personal Data from its active systems, except for records that the law requires it to keep for the periods in Schedule 3.

Customer Personal Data in database backups is overwritten by the backup rotation within thirty (30) days after deletion from the active systems. Residual copies in logs and security records are kept only for the periods in Schedule 3, remain protected by this DPA and are not used for any other purpose until they are deleted.

Customer Personal Data held by a Sub-processor is deleted under that Sub-processor's retention terms. On written request, Veridien will confirm in writing that deletion from its active systems has been completed and will identify any categories of residual copies still held under this section.

2.6 Requests from public authorities

Unless the law prohibits it, Veridien will notify Customer of a legally binding request from a public authority for Customer Personal Data. Where lawful and reasonable, Veridien will challenge a request it reasonably believes to be unlawful or overbroad, and will disclose only the minimum data the law requires.

Veridien will not voluntarily disclose Customer Personal Data to a public authority except at Customer's direction or where the law requires it, and where appropriate will direct the authority to Customer.

3. Sub-processors

3.1 General authorisation

Customer authorises Veridien to engage the Sub-processors listed in Schedule 4 to process Customer Personal Data as needed to provide the Service.

Veridien will impose written data protection obligations on each Sub-processor that are no less protective in substance than those in this DPA, and remains responsible for each Sub-processor's performance to the same extent as for its own obligations.

3.2 Notice and objection

Veridien will keep the list in Schedule 4 current, showing each Sub-processor's name, function and processing location, and will give Customer at least thirty (30) days' notice by email before adding or replacing a Sub-processor.

Customer may object during that period on reasonable and documented data protection grounds. The Parties will work in good faith to resolve the objection. If no reasonable resolution is available, Customer may terminate the affected part of the Service before the new Sub-processor begins processing and receive a pro rata refund of any prepaid fees for the unused period.

If an urgent security, service continuity or legal circumstance reasonably requires Veridien to appoint or replace a Sub-processor without the full notice period, Veridien may do so and will notify Customer without undue delay, and in any event within ten (10) business days.

4. Compliance information and audits

Veridien will make available the information reasonably needed to demonstrate its compliance with this DPA. Veridien holds no privacy or security certification and has not been independently audited; the information it can provide is the written description of its measures in Schedule 2, the Sub-processor list, the retention schedule, and written answers to a reasonable security or privacy questionnaire.

If that information is not reasonably sufficient for Customer's obligations under Data Protection Laws, Customer may, no more than once in any twelve-month period, audit Veridien's compliance with this DPA itself or through an independent auditor bound by confidentiality, unless a further audit is reasonably required after a Security Incident or by law or a supervisory authority.

An audit takes place during normal business hours, on at least thirty (30) days' written notice unless the law or a supervisory authority requires less, at Customer's expense, and without unreasonable disruption to Veridien's operations. The Parties will agree the scope, timing and duration in advance, and Customer will first review the written information above. An auditor may not be a competitor of Veridien. Customer will give Veridien a copy of any final findings that concern this DPA. An audit may not require disclosure of source code, trade secrets or other customers' data, or compromise the security of the Service.

5. Regional terms

5.1 United States state privacy laws

Where a US state privacy law applies to Customer Personal Data, Customer discloses it to Veridien only for the limited and specified business purposes in Schedule 1, and Veridien acts as a service provider, contractor or processor for it. Veridien will process that Personal Data only for those purposes or as the law otherwise permits.

Veridien will not sell or share that Personal Data; will not retain, use or disclose it outside those purposes or outside the direct business relationship between the Parties; and will not combine it with Personal Data received from another source, except as the law permits. Veridien will provide the level of privacy protection the applicable law requires, will notify Customer if it can no longer meet those obligations, and will allow Customer to take reasonable steps to verify compliance and to stop and remedy any unauthorised use. Sections 2.4 and 4 apply to these obligations.

5.2 International transfers

The Service is hosted in Singapore. Where Customer Personal Data protected by the laws of the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an applicable adequacy decision, the transfer mechanism below is incorporated into this DPA. Where mandatory transfer terms conflict with this DPA or the Agreement, the transfer terms control.

European Economic Area. The European Commission's Standard Contractual Clauses of 4 June 2021 (the "EU SCCs") are incorporated by reference: Module Two where Customer is a Controller, Module Three where Customer is a Processor. Clause 7 (docking) applies. Under Clause 9, Option 2 (general written authorisation) applies with the notice period in section 3.2. The optional language in Clause 11 does not apply. Under Clause 17, Option 1 applies and the EU SCCs are governed by the law of Ireland. Under Clause 18, disputes are resolved by the courts of Ireland. Annex I.A is completed with the Party details in this DPA and the Agreement and the roles in section 1.2; Annex I.B with Schedule 1; Annex I.C with the supervisory authority determined under Clause 13; Annex II with Schedule 2; and Annex III with Schedule 4.

United Kingdom. The International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner, version B1.0 in force from 21 March 2022 (the "UK Addendum"), including its mandatory clauses, is incorporated by reference. Table 1 is completed with the Party and contact details in this DPA and the Agreement, and the start date is the Effective Date. Table 2 incorporates the EU SCC selections above. Table 3 is completed with Schedules 1, 2 and 4. In Table 4, either Party may end the UK Addendum as set out in its section 19.

Switzerland. The EU SCCs apply as adapted so that references to the GDPR, the European Union and Member States include the Swiss Federal Act on Data Protection and Switzerland; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; the EU SCCs are governed by Swiss law under Clause 17; disputes under Clause 18 are resolved before the courts of Switzerland; and individuals in Switzerland may enforce their rights there.

Veridien will not allow a Sub-processor to make an onward restricted transfer of Customer Personal Data except in compliance with Data Protection Laws and under a lawful transfer mechanism. If a transfer mechanism is replaced, invalidated or otherwise becomes unavailable, the Parties will cooperate in good faith to put in place another lawful mechanism that preserves substantially equivalent protection.

6. General

6.1 Term and precedence

This DPA remains in force for as long as Veridien processes Customer Personal Data.

Where there is a conflict about the processing or protection of Customer Personal Data, mandatory transfer terms control first, then this DPA, then the Agreement. Liability arising from this DPA is subject to the limitations and exclusions in the Agreement.

6.2 Entire agreement and changes

This DPA, including its Schedules and the transfer terms it incorporates, is the Parties' complete agreement about the processing of Customer Personal Data.

Veridien may update the Schedules by notice to Customer to reflect changes to the Service or its processing, provided the update does not materially reduce the protections in this DPA, materially widen Veridien's rights to use Customer Personal Data, or otherwise materially reduce Customer's rights. Sub-processor changes follow section 3.2. Any other change to this DPA requires the written agreement of both Parties. Electronic acceptance and signatures are permitted.

6.3 Contacts

Veridien's privacy contact for this DPA, including Security Incident and Sub-processor notices, is legal@veridien.app.

Customer's privacy contact is the owner of the Customer account unless Customer designates another contact in writing. Formal legal notices remain governed by the Agreement.

Schedule 1: Processing details

S1.1 Subject matter and duration

Veridien processes Customer Personal Data to provide the Service for the term of the Agreement and during the export period that follows it. Active copies are then deleted under section 2.5. Personal Data in backups is overwritten within thirty (30) days after that. Records the law requires Veridien to keep are retained for the periods in Schedule 3.

S1.2 Nature and purpose

Processing includes collecting, recording, storing, organising, retrieving, transmitting, displaying, backing up and deleting Customer Personal Data, continuously or as needed, to run the property management features Customer has enabled: front desk and reservations, guest profiles, folios and billing, housekeeping, the channel manager, Outlets, the guest portal, the loyalty programme, the shared inbox and the AI features. It also includes sending transactional email and messages to guests on Customer's behalf, and generating documents such as confirmations and invoices.

The AI features process the text a member of staff submits, together with the context that feature needs, only when the feature is used. Sub-processors process Customer Personal Data solely to the extent needed for their function in Schedule 4.

S1.3 Data subjects

Guests and prospective guests of Customer's properties, including companions travelling with them; Customer's staff and contractors; and other individuals whose Personal Data Customer enters into the Service, such as booking contacts, agents and suppliers.

S1.4 Categories of Personal Data

Identity and contact details (name, nationality, date of birth, gender, email address, phone number, postal address); identity document type and number where Customer records it; reservation details (dates, room, occupants, requests, rate, channel of origin); folio charges, payments, invoices and refunds; messages exchanged with guests by email, the guest portal and other connected channels; loyalty balances and preferences; housekeeping and maintenance notes; and the account and activity data of Customer's staff.

S1.5 Sensitive data

Special categories of Personal Data are not intended for processing. A hotel may lawfully record limited health or dietary information a guest volunteers (for example, an accessibility need or an allergy); Customer is responsible for having a lawful basis for it. Payment card numbers must not be entered into the Service.

S1.6 Processing locations

Veridien hosts and stores Customer Personal Data in Singapore. Sub-processors may process Customer Personal Data in the locations shown in Schedule 4, subject to section 5.2.

Schedule 2: Security measures

These are the measures Veridien actually operates. They are described plainly rather than by reference to a framework, because Veridien holds no certification and has not been independently audited.

• Encryption in transit. All traffic between Customer and the Service, and between the Service and its Sub-processors, is encrypted with TLS.
• Hosting. The application, the background worker, the database, the cache and the file storage run as managed services on Railway in Singapore. They communicate over a private network; only the web application accepts connections from the public internet. Encryption of storage at rest is provided by Railway's platform.
• Tenant isolation. Every property's rows are isolated in the database by row-level security, so a query for one property cannot read another property's data, and the application connects with a database role that cannot bypass those policies.
• Access control. Access inside a property is governed by roles and permissions that Customer controls. Two-factor authentication and passkeys are available to every account, and active sessions can be reviewed and ended from account settings.
• Audit trail. Changes to reservations, folios, guest records and settings are recorded with who made them and when.
• Operational access. Veridien's own access to production systems is limited to the person who operates the Service, uses individual credentials with multi-factor authentication, and is logged.
• Backups. The database is backed up by Railway's managed Postgres and kept for a short rolling period so the Service can be restored after a failure.
• Retention. Retention periods in Schedule 3 are enforced automatically by the Service.
• Secure development. Every change to the Service passes automated checks and a test suite before it is deployed, and dependencies are updated as vulnerabilities are published.
• Incident response. Security Incidents are investigated, contained and reported under section 2.3.
• Sub-processors. Each Sub-processor is engaged under its published data processing terms and reviewed before it is added to Schedule 4.

Schedule 3: Retention schedule

Retention is enforced automatically. Data past its period is permanently deleted or irreversibly anonymised.

Schedule 4: Sub-processors