Data Processing Addendum

1. Roles of the parties

The Customer is the controller of the personal data it and its Authorised Users put into or generate within the Platform. HostHQ is the processor of that personal data and processes it only on the Customer’s documented instructions, which are given by the Customer’s use of the Platform’s features and settings and by this addendum. If we believe an instruction breaches data protection law, we will tell the Customer.

2. Scope and details of processing

Subject-matter and duration

We process personal data for the duration of the Customer’s subscription and then for the six-year retention period described in section 10 (Return and deletion on termination). The subject-matter is the provision of the property-management Platform.

Nature and purpose

Hosting, storing, organising, syncing, displaying and otherwise processing personal data so the Customer can manage its properties — including syncing bookings from a connected channel manager, capturing costs, and producing owner statements and guest invoices.

Categories of data subject

• the Customer’s property owners and landlords;
• guests and booking contacts;
• the Customer’s own staff and Authorised Users; and
• other individuals whose details the Customer chooses to record (for example suppliers or cleaners).

Types of personal data

• contact details (name, email, phone, address);
• booking and stay details;
• financial and payout details relating to owners and properties;
• correspondence and notes the Customer records; and
• account and login details for Authorised Users.

The Platform is not designed to process special-category data. The Customer should not enter special-category data except where a field is clearly intended for it and the Customer has a lawful basis to do so.

3. Our obligations as processor

We will:

• process personal data only on the Customer’s documented instructions, including as to international transfers, unless required to do otherwise by law (in which case we will tell the Customer unless the law prohibits it);
• ensure that people authorised to process the personal data are bound by confidentiality;
• implement the security measures described in this addendum;
• respect the conditions for engaging sub-processors set out below;
• assist the Customer, taking account of the nature of processing, to respond to data-subject requests;
• assist the Customer with its obligations on security, breach notification, data protection impact assessments and prior consultation; and
• delete or return the personal data at the end of the services, as set out below.

4. Security measures

Taking account of the state of the art, the costs of implementation and the risks to individuals, we implement appropriate technical and organisational measures, including:

• encryption of personal data in transit, and at rest where our infrastructure providers offer it;
• tenant isolation and row-level security so one Customer’s workspace cannot access another’s data;
• role-based access controls and least-privilege administrative access;
• authentication controls for Authorised Users;
• logging and monitoring to detect and investigate unauthorised access;
• regular backups of the underlying database; and
• measures to restore availability and access to personal data after an incident.

5. Sub-processors

The Customer gives general authorisation for us to engage the sub-processors listed below to process personal data in providing the Platform. Each is bound by a written contract imposing data-protection obligations equivalent to those in this addendum, and we remain responsible for their performance.

• Supabase — Managed Postgres database, authentication and file storage that hold the platform’s core data. European Union / United Kingdom region (as configured).
• Vercel — Application hosting and content delivery for the platform’s web front end and serverless functions. Global edge network; primary region configured for the EU/UK.
• Stripe — Subscription billing and card payment processing for HostHQ’s own charges to the customer. European Union / United Kingdom, with group entities elsewhere.
• Amazon Web Services (AWS SES) — Delivery of transactional and notification email sent by the platform. European Union / United Kingdom region (as configured).
• The customer’s configured channel manager / PMS — Two-way synchronisation of the customer’s own property, booking and guest data with the property-management system that customer has connected (for example Uplisting). Determined by that provider; named in the customer’s integration settings.
• PriceLabs (optional add-on) — Market-rate benchmarking for customers who enable the PriceLabs integration. United States, with data-transfer safeguards in place.

Changes to sub-processors

We will give the Customer reasonable prior notice (by email and/or in-product) before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within the notice period; if we cannot address the objection, the Customer may terminate the affected part of the service. Where the Customer connects its own channel manager or PMS, that provider is a sub-processor the Customer selects.

6. Assisting with data-subject requests

The Platform gives the Customer tools to access, correct, export and delete personal data in its workspace so it can respond to data-subject requests itself. If we receive a request directly from one of the Customer’s data subjects, we will not respond except on the Customer’s instructions, and will forward it to the Customer without undue delay.

7. Personal data breaches

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s personal data, and will provide the information the Customer reasonably needs to meet its own breach-notification obligations to the ICO and to affected individuals. We will take reasonable steps to contain and remediate the breach.

8. Audit and information

We will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. Audits will be on reasonable prior notice, no more than once a year except where required by a supervisory authority or following a breach, during business hours, and subject to confidentiality so as not to compromise other customers’ security. Where available, we may satisfy an audit request by providing third-party certifications or reports.

9. International transfers

We and our sub-processors primarily process personal data in the UK/EEA. Where personal data is transferred outside the UK/EEA, we ensure an appropriate transfer mechanism is in place — such as the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum — and any additional measures needed to protect the data. The Customer authorises these transfers to the extent needed to provide the Platform.

10. Return and deletion on termination

On the end of the services the Customer may export its Customer Data. We then retain the Customer’s data in a read-only state for six years from termination, as the Customer’s documented instruction (given by accepting this addendum), so that the Customer and its owners can continue to meet their own legal record-keeping obligations and we can meet ours. During that period the Customer retains free read-only access to its financial records through the Platform (see the Terms of Service). After six years we delete the personal data and procure deletion by sub-processors, except where law requires longer retention. On the Customer’s written instruction we will delete Customer Data earlier, except data we are legally required to retain.

11. Liability and precedence

The liability provisions of the Terms of Service apply to this addendum. If there is a conflict between this addendum and the rest of the agreement on the processing of personal data, this addendum prevails. All other terms of the agreement continue to apply.

12. Contact

Data-protection questions about this addendum can be sent to [CONTACT EMAIL].