Data Processing Agreement

1. Roles of the parties

You are the controller of the personal data you process through the Service: the data of your guests and customers, their bookings and orders, your events and marketing campaigns, the messages and calls handled by the Service’s assistants, reviews, sales records, and the records of your staff, including their employment details, schedules and timesheets. KozyHost S.L. processes that data on your behalf, as processor, under this Agreement.

KozyHost S.L. is an independent controller of the user account data it manages for the people who use the Service on your behalf (their login identity, credentials and account settings) and, where you have a subscription, of your billing data, which it processes under its Privacy Policy. That data is not covered by this Agreement.

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given to them in the GDPR.

2. Subject matter and duration

The subject matter of the processing is the provision of the Service to you under the Service Contract. The processing lasts for as long as the Service Contract is in force and, after it ends, until the data has been returned or deleted under section 11. Annex I describes the processing in detail.

3. Nature and purpose of the processing

KozyHost S.L. processes the personal data only to provide the Service to you and to keep it secure and working, including the support you request. The processing consists of hosting, storing, organising, displaying and transmitting the data, and of carrying out the operations that you or your users trigger in the Service, such as managing bookings, answering calls and messages through the Service’s assistants, sending your messages and campaigns, and recording sales. KozyHost S.L. does not use the personal data for its own purposes.

4. Your instructions

KozyHost S.L. processes the personal data only on your documented instructions, including with regard to transfers to third countries. Your use of the Service and its features, including by your users, and the settings you choose, together with this Agreement, are your instructions. Any additional instruction must be given in writing and be compatible with the Service.

KozyHost S.L. will inform you immediately if, in its opinion, an instruction infringes the GDPR or other Union or Spanish data protection provisions.

If Union or Spanish law requires KozyHost S.L. to process the data otherwise, it will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5. Confidentiality

KozyHost S.L. ensures that the persons it authorises to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access the data only to the extent their tasks require. This duty of confidentiality continues after this Agreement ends.

6. Security of processing

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks for the rights and freedoms of the data subjects, KozyHost S.L. applies the technical and organisational measures described in Annex II to ensure a level of security appropriate to the risk, as required by Article 32 GDPR.

KozyHost S.L. may update those measures as technology and risks evolve, provided that the overall level of security is not reduced.

You are responsible for the security of your own use of the Service, including your users’ credentials, the permissions you grant and the third-party integrations you connect.

7. Sub-processors

You give KozyHost S.L. a general written authorisation to engage sub-processors. The sub-processors engaged on the date of this Agreement are listed in Annex III.

KozyHost S.L. will inform you of any intended addition or replacement of a sub-processor at least 30 days in advance, by email or in the back office, so that you can object to the change within that period. If you object, the parties will seek a solution in good faith; failing agreement, you may terminate the Service Contract before the change takes effect.

KozyHost S.L. imposes on each sub-processor, by contract, the same data protection obligations as those set out in this Agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures. KozyHost S.L. remains fully liable to you for the performance of each sub-processor’s obligations.

8. Data subjects’ rights

Taking into account the nature of the processing, KozyHost S.L. assists you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights of access, rectification, erasure, restriction of processing, data portability and objection, and their right not to be subject to automated individual decisions.

If KozyHost S.L. receives such a request directly from a data subject, it will forward it to you without undue delay and will not respond to it unless you instruct it to.

9. Assistance with your other obligations

Taking into account the nature of the processing and the information available to it, KozyHost S.L. assists you in ensuring compliance with your obligations under Articles 32 to 36 GDPR: the security of processing, the notification of personal data breaches to the supervisory authority and their communication to data subjects, data protection impact assessments and the prior consultation of the supervisory authority.

10. Personal data breaches

KozyHost S.L. will notify you of any personal data breach affecting the data it processes on your behalf without undue delay and, in any event, within 72 hours of becoming aware of it. The notification will include, as far as it is available at the time:

• A description of the nature of the breach, including, where possible, the categories and approximate number of data subjects and of personal data records concerned
• The name and contact details of the person at KozyHost S.L. from whom more information can be obtained
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including, where appropriate, measures to mitigate its possible adverse effects

Where not all of this information can be provided at the same time, KozyHost S.L. will provide it in phases without further undue delay. KozyHost S.L. will also take the measures available to it to contain the breach and mitigate its effects, and will document it.

As controller, you decide whether the breach must be notified to the supervisory authority and communicated to the data subjects; KozyHost S.L. will cooperate with you so that you can do so.

11. Return and deletion of the data

When the Service Contract ends, you have 30 days to export your personal data from the Service, or to ask KozyHost S.L. to return it to you or to deliver it to a new processor you designate. If the law requires you to keep any of that data, such as your sales and invoicing records, you should export it within that period.

Once that period has passed, KozyHost S.L. deletes the personal data processed on your behalf and any existing copies, unless Union or Spanish law requires it to be kept; in that case, the data is kept blocked, only for as long as the law requires and only for that purpose.

Data remaining in the encrypted backups of KozyHost S.L. is erased as those backups expire, in line with the retention periods in its Privacy Policy (30 days for daily backups and 12 months for monthly backups), and is used only to restore the Service.

12. Information and audits

KozyHost S.L. makes available to you, on request, the information necessary to demonstrate compliance with Article 28 GDPR and with this Agreement. It also allows for and contributes to audits, including inspections, conducted by you or by an auditor you mandate, on these conditions:

• You give KozyHost S.L. reasonable prior notice in writing
• Audits take place at most once a year
• The audit is carried out at your cost
• The auditor is bound by a duty of confidentiality, and the audit gives no access to other customers’ data

13. International transfers

The personal data is stored on KozyHost S.L.’s own servers, on its own network in Spain. Some of the sub-processors listed in Annex III process part of it outside the European Economic Area, mainly in the United States. KozyHost S.L. transfers personal data to a sub-processor outside the European Economic Area only on the basis of an adequacy decision of the European Commission (Article 45 GDPR), such as the EU–US Data Privacy Framework for a sub-processor certified under it, or, where no adequacy decision applies, of the standard contractual clauses adopted by the European Commission (Article 46 GDPR).

When you instruct the Service to send data to a platform or provider that you use under your own account or contract, such as your Facebook page, the payment gateway you contract for your own sales or an AI provider you use with your own key, that data is sent on your instructions and under your own relationship with that platform or provider.

14. Your responsibilities as controller

You are responsible for the lawfulness of the processing you instruct: in particular, for having a legal basis for it, for informing the data subjects (for example, in your own privacy notice) and, where required, for obtaining their consent, such as for marketing communications.

15. Liability

The liability of KozyHost S.L. under this Agreement is subject to the limitations set out in section 15 of the Terms of Service, to the extent permitted by law. Nothing in this section limits the rights of data subjects under the GDPR.

16. Term, precedence and governing law

This Agreement takes effect when you accept it and remains in force for as long as the Service Contract lasts. The obligations that by their nature must continue after it ends, such as the return and deletion of the data and confidentiality, remain in force until they have been fulfilled.

In the event of a conflict on a data protection matter, this Agreement prevails over the Terms of Service, the Subscription Terms and any other document of the Service Contract.

This Agreement is governed by Spanish law, and any dispute is subject to the courts of San Roque (Cádiz, Spain), as provided in the Terms of Service and the Subscription Terms. For any question about this Agreement, write to [email protected].

Annex I — Details of the processing

Categories of data subjects: your guests and customers, including the people who book with you, order from you, buy tickets for your events, call you, write to you or review your business; the people who receive your marketing communications; your staff; the people filmed by your cameras, where you use the video surveillance module; and any other person whose data you choose to record in the Service, such as your suppliers’ contact persons. Types of personal data, depending on the features you use:

• Guests and customers: name, email address, phone number, preferences and notes, and the history of their bookings, orders and visits
• Bookings, orders and tickets: the details of bookings (date, time, number of guests, requests and status), of orders and of event tickets (buyer and ticket holder, the admission and session bought, invitations)
• Messages and calls: the messages the Service sends and receives for you by email, SMS and WhatsApp, and the calls and messages handled by its assistants (for calls, the caller’s voice while the call lasts), with the phone numbers and addresses involved and the records the Service keeps of them
• Reviews: reviews and ratings from the profiles you connect, with the author’s public name, and your replies
• Marketing: marketing consents, with their date and source, and the delivery, unsubscribe and link-click records of your campaigns
• Sales: the sales records, receipts and invoices generated through the Service, which may identify the customer
• Staff: the name, contact details, role and employment details of your staff members, their work schedules and their timesheets (clock-in and clock-out records)
• Camera images: where you use the video surveillance module, the live images from your cameras, which the Service relays while they are watched remotely and does not record
• Special categories of data: the Service is not designed to process them, but booking notes and messages may contain information volunteered by a guest, such as allergies, dietary needs or accessibility requirements, that reveals data concerning health; you decide whether to record it

Purposes: providing the Service to you, as described in section 3, and only on your instructions. Duration: for as long as the Service Contract is in force and, after it ends, until the data has been returned or deleted under section 11, including the backup and legal retention periods described there.

Annex II — Technical and organisational measures

KozyHost S.L. applies, as a minimum, the following measures:

• Encryption at rest, with AES-256-GCM, of credentials, such as OAuth tokens and API keys, and of the fields that hold personal contact details
• Full-disk encryption of the servers that host the Service and its data
• Backups encrypted with a key held by KozyHost S.L. before they reach its own backup storage
• Password hashing with Argon2id
• Encryption of data in transit with TLS 1.2 or 1.3
• Isolation of each business’s data from the data of the other businesses that use the Service
• Role-based access control
• Two-factor authentication for the personnel of KozyHost S.L. and for your administrators
• Logging of activity in the Service
• Regular internal security audits
• An information security management system aligned with ISO/IEC 27001 (not certified)

These measures are reviewed and may be updated under section 6, without reducing the overall level of security.

Annex III — Sub-processors

KozyHost S.L. hosts the Service and its data on its own servers, on its own network in Spain, sends emails from its own mail servers and runs some AI tasks on a model hosted on those servers; none of this involves a sub-processor. On the date of this Agreement, KozyHost S.L. uses the following sub-processors:

• Anthropic (AI provider): the text and documents of the assistant and content tasks assigned to its models; processing in the United States
• Apple (push notifications): delivery of the push notifications the Service sends to the staff and point-of-sale apps; processing in the United States
• Cerebras (AI provider): the text of the assistant and content tasks assigned to the models it hosts; processing in the United States
• Cloudflare (network edge): all web traffic to and from the Service passes through it, as it terminates the encrypted connections (TLS) and provides DNS, a firewall and the secure tunnels to the servers of KozyHost S.L.; processing on its global network, at the point nearest each user, with the tunnels terminating in Madrid
• Google (Gemini; Google Maps Platform, Places): the text and documents of the assistant and content tasks assigned to Gemini and, for address suggestions, what is typed in an address field, to propose the complete address, and nothing else; processing in the United States
• Meta (WhatsApp Business Platform): delivery of the WhatsApp messages the Service sends and receives for you, which reach it through Twilio; processing in the United States
• OpenAI (AI provider; contracting entity: OpenAI Ireland Ltd): the caller’s audio, which the telephone concierge streams to its realtime service for the duration of each call, audio sent for transcription, and the text and documents of the assistant and content tasks assigned to its models; processing in the United States
• Tavily (web search): the web searches the assistant makes when a task needs them, whose terms may include names; processing in the United States
• Twilio (telephony and messaging): the telephone line that connects callers to the concierge, and the delivery of SMS and WhatsApp Business messages, such as tickets and booking and order notices; processing in the United States
• Xirsys (video relay): relays the live images from your cameras while they are watched remotely in the video surveillance module, without recording them; region of processing to be confirmed

Platforms and providers that you use under your own account or contract are not sub-processors of KozyHost S.L., because they receive data on your instructions and under your own relationship with them: the platforms you connect to the Service, such as Google Business Profile, Facebook or Instagram; the payment gateway you contract directly for your own sales, such as Redsys, Stripe or Adyen; and any AI provider you use with your own key. The data protection terms that apply to each sub-processor are available on request at [email protected]. Where a sub-processor processes personal data outside the European Economic Area, section 13 applies.