Data Processing Agreement

Controller: the hotel or accommodation business that subscribes to GuestSync ("Owner"). Processor: Ioannis Krokos, sole trader trading as Webee, operator of GuestSync ("GuestSync"). AFM 143425411, ΔΟΥ Μυκόνου, ΓΕΜΗ 138512438000 (EUID ELGEMI.138512438000), Mykonos, Greece. Contact: support@guestsync.app. This DPA is part of the GuestSync Terms of Service and applies for as long as GuestSync processes personal data for the Owner. It meets Article 28 of the GDPR (Regulation (EU) 2016/679). The Owner accepts this DPA in the GuestSync admin panel or at checkout. GuestSync keeps a record of the version, the date and the account that accepted.

Purpose: running the GuestSync platform: the admin panel, the guest portal, subscriptions and billing. Data subjects: the Owner's staff users, anonymous guest portal visitors, and the contact persons the Owner shows on the portal. Staff data: email, full name, company name, phone, language and timezone, consent flags, login data, Stripe customer ID, and the IP address and user agent in the data processing log. Guest visitor data: no names, emails or booking data. Only anonymous view analytics: session ID, device type, browser, device fingerprint, user agent, and a salted hash of the IP address (not reversible, the salt rotates daily). Property data: contact details (phone, email, social links), address and map coordinates, WiFi name and password, check in and check out information, events and recommendations. Special categories: none. The Owner must not upload special category data. Duration: for the subscription term, then deletion as in section 8.

• Process personal data only on the Owner's documented instructions (this DPA and the use of the platform). • Make sure anyone with access is bound by confidentiality. • Apply the security measures in Annex B. • Help the Owner answer data subject requests (access, correction, deletion and the other GDPR rights). • Help the Owner with DPIAs and consultations with the supervisory authority where needed. • Make available the information needed to show compliance, and allow audits once a year on 30 days' notice: first written measures and sub-processor evidence; if that is not enough, an audit by the Owner or a confidential independent auditor, at the Owner's cost, during business hours. • Tell the Owner without undue delay, and within 48 hours at the latest, after becoming aware of a personal data breach affecting its data.

• The Owner gives general authorisation for the sub-processors listed in Annex A and at guestsync.app/subprocessors. • GuestSync notifies the Owner by email, and updates the public sub-processor list, before adding or replacing a sub-processor. The Owner may object on reasonable data protection grounds within 14 days. If the parties cannot agree, the Owner may end the subscription without penalty, with a pro rata refund. • GuestSync binds each sub-processor to data protection terms no less protective than this DPA and remains responsible for them.

• Data is hosted in the EU/EEA where possible. • Where a sub-processor is outside the EEA or is a non-EEA company, transfers rely on adequacy decisions (including the EU-US Data Privacy Framework) or EU Standard Contractual Clauses with supplementary measures, as listed in Annex A.

• The Owner is responsible for having a lawful basis for the data it puts into GuestSync and for informing its guests; its privacy notice should mention GuestSync as a service provider. • The Owner keeps its staff login details safe and removes users who no longer need access.

Liability under this DPA follows the limits in the GuestSync Terms of Service. Data subjects' rights under Article 82 GDPR are not limited. Greek law applies. The courts of Syros have jurisdiction.

• On termination, the Owner can export its data for 30 days. • After that, GuestSync deletes the Owner's personal data from live systems within 30 days and from backups within the backup window, unless law requires longer retention. • Monitoring data at Grafana Labs is kept for 14 days and then deleted automatically.

• Tenant isolation with row level security, tested with cross-tenant access attempts. • Encryption in transit (HTTPS/TLS) and at rest (provider managed). • Server-side validation on every write; generic error messages in production. • Secret keys kept server-side only and rotated if exposed. • Rate limits and daily caps on paid APIs, with alerts. • CAPTCHA on public forms; CORS allowlist plus SameSite cookies and anti-CSRF protection. • Monitoring and alerting with burn-rate alerts; logs and traces carry no guest personal data (visitor IP addresses, user agents and query strings are stripped before export). • Access to production limited to the GuestSync operator, with strong authentication. • Security review before each release.