Data Processing Addendum

Summary

This summary helps you find your way around. It is not part of the addendum and does not replace the full text below.

• Your hotel decides why and how its guests' and staff's personal data is used. You are the controller. Stayantra processes that data for you, only on your instructions. We are your processor.
• We keep the data confidential, protect it with the security measures in Annex 2, and help you answer your guests' and staff's requests.
• We use sub-processors, listed at /legal/subprocessors. We give you 30 days' notice of a new one, and you can object.
• We tell you about a personal data breach within 48 hours of becoming aware of it.
• Data is transferred outside the UK and the EU. The EU Standard Contractual Clauses and the UK Addendum to them are built into this addendum.
• We do not use your guests' personal data to train AI models beyond providing the service to your hotel.
• When your agreement ends, your hotel is frozen read-only for 90 days: you can export all of it and reactivate to restore it intact. After that we delete it, except records the law requires us to keep.
• Verifying your business before you go live (KYC) is not processing for you: Stayantra is the controller of it, and keeps it for 5 years after you leave (section 2.4). The same is true of a guest's ID vault on their own profile (section 2.5).

1. About this addendum

1.1 This Data Processing Addendum (the DPA) forms part of the Hotel Subscription and Partner Agreement (the Agreement) between the hotel (you, the Hotel) and the Stayantra company you contract with under the Agreement (Stayantra, we or us): [Pending: Nepal Stayantra company legal name] for hotels located in Nepal, and [Pending: UK company legal name] for every other hotel. The Hotel's acceptance of the Agreement is also acceptance of this DPA.

1.2 This DPA is written to meet Article 28(3) of the EU General Data Protection Regulation (GDPR) and of the UK GDPR, section 8 of India's Digital Personal Data Protection Act 2023 (DPDP Act), and Nepal's Individual Privacy Act 2075 (2018) (the Privacy Act). We apply it to every hotel, wherever it is located.

1.3 Words defined in the Agreement have the same meaning here. Data Protection Law means every data protection and privacy law that applies to the processing, including those named above, the UK Data Protection Act 2018 and Nepal's Electronic Commerce Act 2081 (2025). Personal data, controller, processor, data subject, processing and personal data breach have the meanings given in the GDPR. Under the DPDP Act, a controller is a Data Fiduciary, a processor is a Data Processor, and a data subject is a Data Principal.

1.4 Hotel Personal Data means the personal data we process on your behalf in providing the Services, as described in Annex 1.

2. Roles

2.1 You are the controller. For Hotel Personal Data, you are the controller (Data Fiduciary) and we are your processor (Data Processor). Where you are yourself a processor acting for another controller, for example a management company acting for a property owner, you confirm that your controller has authorised you to appoint us, and we act as your sub-processor.

2.2 Where we are a controller. This DPA does not cover personal data for which the Stayantra companies are controllers, including Marketplace and Stayantra Go accounts, Stayantra Rewards, referrals, reviews, website and marketing data, data about your owners and Users that we need to run our relationship with you (such as billing, account security and support), and payment data we handle as your limited payment-collection agent to the extent the law makes us responsible for it. Our Privacy Policy covers that data.

2.3 Aggregated data. We may create aggregated or de-identified data from Hotel Personal Data that no longer identifies anyone, and use it to operate, secure and improve the Services. Once data can no longer identify anyone, it is not personal data. We will not try to re-identify it, and we do not sell it.

2.4 Business verification (KYC). Before your hotel can go live on Stayantra (be listed, take online bookings, connect to online travel agencies, take online payments or receive payouts), we verify your business. For that verification Stayantra is a controller, not your processor, and this DPA does not apply to it; the Privacy Policy section 4.4 does.

• What: your legal and trading names, registration, PAN or VAT number, registered address, operating licence and its expiry, the name and role of your owner or authorised signatory, and copies of your business registration, tax registration, operating licence, the signatory's identity document, any authorisation letter and a premises photo. A capture by our installation team also records its time and approximate location.
• Why: to keep fake or fraudulent hotels away from guests, to meet our obligations for the payments and payouts we handle for you, and to keep a record that your hotel was checked.
• Who sees it: your owner and co-owners, and the Stayantra staff who review it; your managers and other staff do not. Documents are stored privately and opened only through links that expire after a few minutes, and every view by Stayantra is logged. A capture by our installation team is always checked by a different Stayantra person.
• How long: while you use Stayantra and for 5 years after you leave, then deleted. Section 12 (deletion at the end) does not apply to these records.
• Erasure: because we must be able to show that your hotel was verified, we keep these records for that period even if your owner or signatory asks us to erase their personal data.

2.5 Guest ID vault. A guest may choose to save their ID document to their own Stayantra profile for faster check-in, and later share it with your hotel by choosing "Use my saved ID" at check-in. While it sits on the guest's own profile, that document is not Hotel Personal Data: Stayantra is the controller of it, not your processor, and this DPA does not apply to it; the Privacy Policy section 4.1 does. Once the guest shares it with your hotel at check-in, the copy your hotel receives becomes Hotel Personal Data like any other guest ID scan, and this DPA and section 12 apply to it as normal.

3. Details of the processing

3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3.2 The processing lasts for the term of the Agreement and until we have deleted or returned the Hotel Personal Data under section 12.

4. Our obligations as processor

4.1 Your documented instructions. We process Hotel Personal Data only on your documented instructions, including about transfers to other countries, unless the law we are subject to requires otherwise. In that case, we will tell you before processing, unless that law forbids it. Your instructions are: the Agreement and this DPA; the settings, features and actions you and your Users choose in the Services; and any other reasonable written instruction you give us that is consistent with the Agreement.

4.2 Unlawful instructions. We will tell you at once if, in our opinion, an instruction breaks Data Protection Law. We may refuse to follow that instruction until you confirm or change it.

4.3 Confidentiality. We make sure that everyone we authorise to process Hotel Personal Data has committed to confidentiality or is under a legal duty of confidentiality, and has access only to the extent needed for their work.

4.4 Security. We implement the technical and organisational measures required by Article 32 of the GDPR, as described in Annex 2, taking into account the state of the art, the costs, the nature and purposes of processing, and the risks to people. We may update the measures, but will not reduce the overall level of protection.

4.5 Helping with data subject requests. Taking into account the nature of the processing, we help you by appropriate technical and organisational measures to respond to requests from your guests and staff to exercise their rights, including access, correction, deletion, restriction, portability and objection, and the rights under the DPDP Act and the Privacy Act. Many of these can be done directly in the Services. If we receive a request directly that relates to Hotel Personal Data, we will pass it to you without undue delay and not answer it ourselves except to confirm that it has been passed on, unless you instruct us otherwise.

4.6 Helping with your compliance. Taking into account the nature of the processing and the information available to us, we help you with your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities (Articles 32 to 36 of the GDPR). We will give you reasonable information about the Services for any impact assessment you carry out.

4.7 Records. We keep records of our processing activities for you as Article 30(2) of the GDPR requires.

5. Sub-processors

5.1 General authorisation. You give us general authorisation to use sub-processors. The current list, with what each does and where it processes data, is at /legal/subprocessors. It includes Nexalaris Tech Pvt. Ltd. in Nepal, the company that developed Stayantra, which provides development, AI operations and support and may access Hotel Personal Data only as needed for that work, under a written agreement and a duty of confidentiality.

5.2 Notice of changes. We will give you at least 30 days' notice before we add or replace a sub-processor, by updating the list and notifying the owner by email or in the dashboard.

5.3 Your right to object. You may object in writing to a new sub-processor within those 30 days on reasonable grounds relating to data protection. We will then discuss it with you in good faith and try to offer a reasonable alternative. If we cannot resolve it, you may end the affected Services by notice before the change takes effect, and we will refund any prepaid fees for the period after that date.

5.4 Emergency replacements. If we must replace a sub-processor urgently for security or continuity reasons, we may do so with shorter notice. We will notify you as soon as possible, and you keep your right to object under section 5.3.

5.5 Flow-down. We impose on each sub-processor, by written contract, data protection obligations that give at least the same level of protection as this DPA, including sufficient guarantees on security. We remain responsible to you for our sub-processors' performance.

5.6 Services you connect. Services that you choose to connect to your Account, such as your own WhatsApp Business account, your Facebook or Instagram pages, OTAs through the channel manager, or an outside AI assistant that you or your staff connect, are not our sub-processors. They process data under their own terms with you.

6. Personal data breaches

6.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Hotel Personal Data.

6.2 Our notice will include, as far as available: the nature of the breach, including the categories and approximate number of people and records concerned; the name and contact details of our contact point; the likely consequences; and the measures taken or proposed to address it and reduce its effects. Where we cannot give all of this at once, we will give it in phases without further undue delay.

6.3 We will take reasonable steps to contain and investigate the breach and reduce its effects, and cooperate with you so that you can meet any duty to notify supervisory authorities (within 72 hours under the GDPR and UK GDPR), the Data Protection Board of India, or affected people.

6.4 Our notice is not an admission of fault or liability.

7. International transfers

7.1 Where data goes. Our main database and storage are hosted in Australia, our application hosting runs in Australia and Singapore, and some sub-processors, including AI providers, process data in the United States and other countries outside China, as the sub-processor list shows. Personal data also moves between the Stayantra companies in the UK and Nepal.

7.2 EU Standard Contractual Clauses. Where Data Protection Law of the EU or the European Economic Area applies and personal data is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 (the SCCs) are incorporated into this DPA by reference, and each party is treated as having signed them:

• Module 2 (controller to processor) applies where you are a controller;
• Module 3 (processor to processor) applies where you are a processor;
• you are the data exporter and we are the data importer;
• Clause 7 (docking clause) applies, so other parties may accede;
• under Clause 9, option 2 (general written authorisation) applies, with the notice period in section 5.2;
• the optional wording in Clause 11 does not apply;
• under Clauses 17 and 18, the SCCs are governed by the law of Ireland and disputes go to the courts of Ireland;
• Annex I is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by the sub-processor list; and
• the competent supervisory authority is the one determined under Clause 13.

7.3 UK transfers. Where the UK GDPR applies, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (the UK Addendum) is incorporated by reference. Its tables are completed by the details in section 7.2 and the Annexes of this DPA, and either party may end it as its section 19 allows.

7.4 Swiss and other transfers. Where other laws require a transfer mechanism, the SCCs apply with the changes those laws require.

7.5 Onward transfers. Where we transfer Hotel Personal Data to a sub-processor in a country without an adequacy decision, we use the SCCs (Module 3), the UK Addendum or another lawful transfer mechanism.

7.6 Transfer impact. We have assessed the laws of the countries our sub-processors operate in, and we apply the supplementary measures in Annex 2, including encryption in transit and at rest. We will share a summary of our transfer impact assessment on request, to help you with your own.

7.7 Government requests. If an authority asks us for Hotel Personal Data, we will tell you unless the law forbids it, and we will challenge requests that are unlawful. We disclose data only under valid legal process.

7.8 Precedence. If the SCCs or UK Addendum conflict with this DPA, they prevail.

8. Your responsibilities

You are responsible, as controller, for:

1. having a lawful basis for all Hotel Personal Data you put into or process through the Services, and for each instruction you give us;
2. giving your guests and staff the privacy notices the law requires, including notice of the processing Stayantra does for you, of the AI features you use, and of guest web profiling if you use it;
3. collecting and recording the consents the law requires, including guests' opt-in to WhatsApp messages and consent to email or SMS marketing, and honouring withdrawals;
4. collecting explicit consent where you record health or other special category information, such as dietary needs, allergies or accessibility needs;
5. keeping Hotel Personal Data accurate and up to date;
6. collecting identity documents only as the law requires or allows for check-in and guest registration, and using them for no other purpose;
7. not uploading or importing personal data that you are not entitled to use, including in files you import into the Services; and
8. responding to your guests' and staff's requests to exercise their rights.

9. AI processing

9.1 No training on your data beyond your service. We do not use Hotel Personal Data to train or improve AI models except to provide the Services to your hotel. We do not use it to train models for other hotels or for general use.

9.2 AI providers. To run AI features, we send the data needed for each task, which can include personal data (such as chat text, booking context and, for document reading, images of identity documents), to AI model providers through our AI routing provider. The providers are named in the sub-processor list. We use paid API access. With every request, we instruct our AI routing provider to use only hosting providers that it lists as zero data retention, which do not store the data and do not use it to train models, and never to use a hosting provider based in China. Two exceptions are set out in the sub-processor list: voice transcription, where the routing provider does not accept these instructions and we rely on a model whose only hosting providers are on its zero data retention list, and the public web search used for guest web profiling.

9.3 Guest web profiling. The Services let your staff run an AI web search about an arriving guest to find public professional information for personalising their stay. This feature runs only when your staff start it. As controller, you are responsible for deciding whether it is lawful and proportionate, for your lawful basis, for telling guests about it, and for stopping it for a guest who objects. We will help you honour objections. Profiles are kept for 2 years and then deleted.

9.4 Automated decisions. The Services do not make decisions about guests or staff that produce legal or similarly significant effects without a person. For example, staff performance ratings from guest feedback can recommend a performance review or bonus eligibility, but a manager always decides. You must not use AI outputs to make such decisions without meaningful human review.

10. Audits

10.1 Documentation first. On request, we will make available all information reasonably necessary to show that we meet our obligations under Article 28 of the GDPR and this DPA, including this DPA's Annexes, our security policies and summaries of third-party assessments where we have them. You agree to rely on this information first.

10.2 On-site audits. If the information is not enough to show compliance, or if a supervisory authority requires it, you may audit us, yourself or through an independent auditor bound by confidentiality, at your own cost, no more than once a year, with at least 30 days' written notice, during business hours, and in a way that does not disrupt our operations or compromise other customers' data or our security.

10.3 Exceptions. The once-a-year limit and the 30-day notice do not apply after a personal data breach affecting Hotel Personal Data, or where a supervisory authority requires an audit.

11. Liability

11.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limits in the Agreement, except that the cap for breach of this DPA and other data protection claims is separate: it is twice the general cap in the Agreement (which is the greater of the fees paid and payable in the 12 months before the claim and USD 1,000), so never less than USD 2,000.

11.2 Nothing in this DPA limits either party's liability to data subjects under Article 82 of the GDPR or equivalent laws, or any liability that cannot be limited by law.

12. Deletion or return at the end

12.1 When the Agreement ends, your hotel is frozen and kept read-only for a 90-day grace period. During those 90 days you can export all Hotel Personal Data yourself, at any time, in a commonly used format, and reactivating your hotel restores it and all its data intact. If you do not reactivate, we delete Hotel Personal Data from our live systems at the end of the 90 days, except what section 12.2 keeps.

12.2 We may keep Hotel Personal Data that the law requires us to keep — financial and tax records, guest register records, and staff attendance and leave records — for the period the law requires, currently up to 7 years; staff attendance and leave records are kept with staff identifiers pseudonymised. We keep it confidential and process it only for that purpose.

12.3 Backups are kept for a limited period and deleted on a rolling basis, currently within 35 days.

12.4 On request, we will confirm deletion in writing.

13. General

13.1 This DPA lasts as long as we process Hotel Personal Data.

13.2 If this DPA conflicts with the Agreement on a data protection matter, this DPA prevails, except that the SCCs and UK Addendum prevail over both.

13.3 This DPA is governed by the law that governs the Agreement, except where the SCCs or UK Addendum require otherwise.

13.4 We may update this DPA under the change process in the Agreement. We will not reduce the protection it gives Hotel Personal Data except where the law requires.

13.5 Questions about this DPA: email info@stayantra.com. To report a security concern: email info@stayantra.com.

Annex 1: Details of processing

A. Parties

B. Subject matter and purpose

Providing the Stayantra hotel operating system and related services to the Hotel, including: reservations and bookings from all channels, check-in and guest registration, room and housekeeping operations, folios, billing, invoicing and payments, guest communication, reviews and complaints, events, food and beverage, inventory and procurement, staff management and payroll, the per-hotel website and direct booking, channel manager connection, marketing, reporting, AI features, support, security, and backup.

C. Nature of processing

Collection, recording, storage, retrieval, consultation, organisation, structuring, adaptation, analysis by AI models (including document reading, voice transcription, summarising, classifying and generating text), transmission to channels and providers the Hotel uses, messaging and email delivery, push notifications, backup, erasure and anonymisation.

D. Categories of data subjects

• Guests, including co-travellers, co-payers on split payments, and people named on a booking
• People who enquire, request group or event quotes, or book tables
• Visitors to the Hotel's per-hotel website
• The Hotel's owners, co-owners, managers and staff
• Contacts at the Hotel's corporate clients, brokers, agencies and suppliers

E. Categories of personal data

• Identity and contact: name, email, phone, address, nationality, language
• Bookings and payments: dates, rooms, number of guests, rates, amounts, special requests, payment status, invoice buyer name, tax number (PAN) and address, refund destination wallet or bank details (masked on erasure). Full card numbers are entered on payment providers' pages and never reach Stayantra
• Check-in and identity documents: images of passports, citizenship cards, national IDs or visas, and the fields read from them (such as document number, date of birth, nationality, visa details), and guest register entries
• Communications: in-stay chat, messages sent through the Hotel's WhatsApp Business account, emails, complaint text and photos, AI chat content and voice messages (audio is transcribed and not stored)
• Preferences and profile: stated preferences and memories from AI chat, and, where the Hotel collects them with explicit consent, dietary needs, allergies and accessibility needs, which can be special category (health) data
• Guest web profiles: public professional information about a guest, where the Hotel's staff run this feature
• Reviews and feedback linked to a stay
• Staff data: name, contact details, role, shifts, tasks, task photo evidence, payroll records (where the Hotel uses payroll), and performance ratings from guest feedback
• Business contacts: names, contact details and tax numbers of corporate clients, brokers and suppliers
• Technical data: device and push tokens, log-in records, IP addresses and audit logs

F. Special category data

Health-related information (dietary needs, allergies, accessibility needs) only where the Hotel collects it with the guest's explicit consent. The Hotel should not record other special category data unless the law allows it. Additional safeguards: the measures in Annex 2, access limited by staff role, and deletion on withdrawal of consent.

G. Frequency

Continuous, for the term of the Agreement.

H. Retention

The Hotel may set shorter periods where the Services allow, and may delete data itself, subject to records the law requires it to keep.

I. Transfers to sub-processors

As listed at /legal/subprocessors, with the subject matter, nature and duration described there.

Annex 2: Technical and organisational security measures

We do not claim any security certification. Our measures include:

1. Encryption in transit: all connections to the Services use TLS.
2. Encryption at rest: databases, storage and backups are encrypted at rest by our hosting providers.
3. Additional encryption of credentials: tokens and credentials for integrations you connect, such as Meta access tokens, are further encrypted with AES-256-GCM.
4. Passwords and keys: user passwords are hashed with bcrypt. Refresh tokens and API keys are stored only as hashes.
5. Tenant isolation: row-level security in the database isolates each hotel's data, so a query made for one hotel cannot read another hotel's rows. Hotel traffic runs as a database role that cannot bypass these rules.
6. Access control: role-based permissions inside each hotel; access by our staff on a least-privilege, need-to-know basis; two-factor authentication for Stayantra administrators.
7. Audit logging: every AI action is recorded in an append-only audit ledger that cannot be edited or deleted. Security-relevant events are logged.
8. AI safeguards: Co-Pilot approval before AI actions, guardrails on Auto-Pilot, a per-hotel kill switch, and prompts that treat text inside documents and messages as data, not instructions.
9. Payment data: card details are entered on the payment provider's own pages. Stayantra never sees or stores full card numbers.
10. Monitoring: error monitoring with personal data scrubbed before it is sent; rate limiting to protect against abuse.
11. Resilience: managed hosting with automated backups kept on a rolling basis, and restore procedures.
12. Secure development: code review, automated tests (including tests of tenant isolation), and dependency updates.
13. Data minimisation: short retention for operational data (see Annex 1), masking of refund bank details on erasure, and rounding of precise location data used for nearby search.
14. Incident response: a documented process to contain, investigate and notify breaches within the times in section 6.
15. Vulnerability reporting: a responsible disclosure policy at /legal/security.
16. Staff: confidentiality commitments and access removed when no longer needed.

Annex 3: Sub-processors

The current list of sub-processors, with what each does and where it processes data, is at /legal/subprocessors. It forms part of this DPA.