Data processing agreement

This agreement forms part of the Service Agreement between Maciej Adamski Sp. z o.o. (the processor, "AURI") and the hotel (the controller). It covers the personal data AURI processes to run the hotel's instance.

Scope

AURI processes personal data only to deliver the service, and only on the hotel's written instructions. We do not use it for marketing, for training AI models, for building products for others, or share it with third parties beyond the sub-processors below.

The hotel decides why the data is processed and is responsible for the legal basis.

Your own instance

Each hotel gets its own instance: a separate Google Cloud project, application and database. Data from one hotel is never stored with another hotel's data.

Data we process

• Guests: name, email, phone, preferred language, room number where relevant, date of birth where the hotel collects it.
• Bookings: treatments chosen, times, rooms and therapists, booking history, staff notes.
• Payments: amount, status and the payment provider's reference. Card numbers are typed into Stripe's form and never reach AURI.
• Consent: what the guest agreed to, when, and which version of the privacy notice.

AURI is not built to hold health data. Staff notes must not contain allergies, diagnoses or other health information. Health data is outside this agreement.

Why we process it

• To run the booking system as the hotel configures it.
• To send booking emails and text messages, such as confirmations and cancellations, as the hotel sets them up.
• To show the hotel its own bookings and records.
• To help the hotel answer guests' requests to see, export or delete their data.

Security measures

• A separate database and Google Cloud project for each hotel.
• Encryption at rest (Google Cloud default) and in transit (TLS). Selected guest fields are also encrypted inside the application with AES-256-GCM.
• Passwords stored as bcrypt hashes. Sessions held on the server and ended after a set time.
• API access with keys that carry their own permissions.
• An audit log of staff actions on guest records.
• Daily database backups with point-in-time recovery.

The security page describes these in more detail.

Sub-processors

AURI uses these services to deliver the service. Each works under its own data processing terms.

• Google Cloud: hosting, database and storage. All data in the instance. In the region agreed with the hotel.
• Stripe: online card payments, where the hotel uses them. Amount, booking reference and payment status. EU and US.
• Resend: booking emails. The guest's email address and booking details, including the name. US.
• Twilio or SMSAPI: text messages, where the hotel turns them on. Guest phone number and booking details. Twilio in the US and EU, SMSAPI in the EU.

We tell the hotel at least 30 days before we add or change a sub-processor. The hotel can object within those 30 days. We then either keep the old one or let the hotel end the affected service without penalty.

Transfers outside the EU

Where data leaves the EU or EEA, we rely on the EU Standard Contractual Clauses with the sub-processor. The hotel can ask for copies at [email protected].

The hotel's instance runs in the Google Cloud region agreed before setup.

Breaches

If we learn of a personal data breach affecting the hotel's data, we tell the hotel without undue delay and within 24 hours of detecting it. We say what happened, which data and roughly how many people it affects, the likely consequences, and what we are doing about it.

The hotel, as controller, reports to the supervisory authority within 72 hours where GDPR requires it. We help with the technical detail.

Audits

The hotel can audit our compliance with this agreement once a year, on 30 days' notice, at its own cost and under confidentiality. We may answer with third-party audit reports once we have them. We have none today.

When the contract ends

We return or delete the hotel's personal data within 30 days of the end of the contract, as the hotel chooses.