Data Processing Agreement

Parties and Recitals

Data Controller ("Client"): the hotel entity or hospitality group that subscribes to Propeter’s services and determines the purposes and means of processing hotel guest personal data. Entity details are provided in Annex 4.

Data Processor ("Propeter"): Propeter, provider of the Propeter revenue management and pricing system for hospitality. Contact: legal@propeter.com.

• A. The Controller provides hotel accommodation and related hospitality services and uses the Propeter platform to manage revenue, pricing, distribution, guest experience and related functions.
• B. In delivering the Services, the Controller instructs Propeter to process personal data of hotel guests and other data subjects on its behalf.
• C. The parties wish to ensure that processing is lawful and secure under all Applicable Data Protection Laws, including the EU GDPR, UK GDPR, Australian Privacy Act 1988 and India’s Digital Personal Data Protection Act 2023.
• D. This DPA sets out each party’s rights and obligations for that processing and supplements the Terms of Service.

1. Definitions

• "Applicable Data Protection Laws": all laws relating to the processing of Personal Data, including the EU GDPR (2016/679), the UK GDPR and Data Protection Act 2018, the Privacy Act 1988 (Cth) and Australian Privacy Principles, India’s Digital Personal Data Protection Act 2023, and the CCPA/CPRA where applicable.
• "Controller" / "Client": the hotel entity that determines the purposes and means of processing guest Personal Data, identified in Annex 4.
• "Processor" / "Propeter": Propeter, which processes Personal Data on behalf of the Controller as described in this DPA.
• "Personal Data": any information relating to an identified or identifiable natural person ("data subject").
• "Processing": any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure or destruction.
• "Sub-processor": any third-party processor engaged by Propeter to process Personal Data on behalf of the Controller, listed in Annex 1.
• "Personal Data Breach": a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed by Propeter.
• "Standard Contractual Clauses" / "SCCs": the clauses adopted by the European Commission in Decision 2021/914/EU of 4 June 2021.
• "Technical and Organisational Measures" / "TOMs": the security measures in Annex 2.
• "Services": the Propeter revenue management and pricing platform and related services defined in the Terms of Service.

2. Scope and Duration

2.1 Scope. This DPA governs Propeter’s processing of Personal Data when providing the Services under the Terms of Service.

2.2 Relationship to Terms of Service. This DPA supplements the Terms of Service and prevails over them on matters of Personal Data processing. For EU/UK data subjects, GDPR prevails over this DPA in case of conflict.

2.3 Duration. This DPA lasts for the duration of the Services agreement and ends with it, except for obligations that expressly survive termination (Section 4.9 on return and deletion, and Section 4.2 on confidentiality).

3. Details of Processing (GDPR Art. 28(3))

3.1 Nature of processing

Collection, storage, organisation, retrieval, use, disclosure to sub-processors, erasure and destruction of Personal Data through the Propeter platform, including automated processing for revenue optimisation using aggregated and anonymised patterns. No individual guest profiling is performed for Propeter’s own model training.

3.2 Purposes

• Booking management (reservations, amendments, cancellations, check-in/out, guest history)
• Guest loyalty programme administration (points, tiers, rewards, achievements)
• Mobile guest app functionality (requests, orders, concierge messaging)
• Guest email and SMS communications as instructed by the Controller
• Payment processing coordination with the PCI DSS certified sub-processor Windcave/Qvalent
• Marketing campaign delivery as explicitly instructed by the Controller
• Revenue management and rate optimisation using aggregated market data

3.3 Types of personal data

3.4 Data subjects

• Hotel guests who book and/or stay at the Controller’s property
• Prospective guests provided by the Controller for campaigns
• Hotel staff using the platform (governed by the Terms of Service and the Controller’s own obligations)

4. Processor Obligations

4.1 Instructions only. Propeter processes Personal Data only on the Controller’s documented instructions unless required by law, and will tell the Controller if it believes an instruction infringes Applicable Data Protection Laws.

4.2 Confidentiality. Everyone authorised to process Personal Data is bound by confidentiality, and access is limited to staff who need it to provide the Services.

4.3 Security. Propeter maintains the TOMs in Annex 2 and reviews them regularly. No security system can guarantee absolute protection.

4.4 Sub-processing. (a) Propeter engages only the sub-processors in Annex 1, which the Controller generally authorises. (b) Propeter gives at least 30 days’ written notice of new or materially changed sub-processors. (c) The Controller may object within 14 days on reasonable data protection grounds; if unresolved, the Controller may terminate the affected Services with 30 days’ notice as its sole remedy. (d) Propeter imposes equivalent obligations on sub-processors by written contract and remains responsible for them. (e) The current list is published at propeter.com/legal/sub-processors.

4.5 Data subject rights. Propeter provides reasonable technical assistance for access, rectification, erasure, restriction, portability and objection requests, and forwards any request it receives directly to the Controller.

4.6 Compliance assistance. Propeter reasonably assists with GDPR Articles 32–36 (security, breach notification, DPIAs and prior consultation).

4.7 Breach notification. Propeter notifies the Controller without undue delay and within 72 hours of becoming aware of a Personal Data Breach, including, as far as known: the nature of the breach and the categories and approximate numbers affected; Propeter’s contact point; likely consequences; and measures taken or proposed.

4.8 DPIAs. Propeter assists with the Controller’s DPIAs and maintains its own for high-risk processing.

4.9 Return and deletion. Within 30 days of termination the Controller may elect (a) return of all Personal Data in CSV or JSON, or (b) secure deletion, including backups, within 90 days. Data Propeter must retain by law is held in isolation without active processing.

4.10 Audits. Propeter makes available information needed to demonstrate compliance and allows audits on 30 days’ notice, during business hours, no more than once in 12 months unless there has been a confirmed breach, at the Controller’s cost unless material non-compliance is found. Propeter may satisfy audit requests with its SOC 2 Type II report or ISO 27001 certificate where the Controller considers them adequate.

5. Controller Obligations

5.1 Lawful basis. The Controller warrants a valid lawful basis for the processing and for its instructions to Propeter.

5.2 Collection and notice. The Controller warrants that Personal Data was collected lawfully, with required notices given and consents obtained.

5.3 Accuracy. The Controller is responsible for the accuracy, quality and legality of Personal Data it provides.

5.4 Data subject requests. The Controller responds to requests and forwards any it cannot fulfil with the platform’s self-service tools to Propeter within 5 business days.

5.5 DPIAs. The Controller decides whether a DPIA is required and conducts it, with Propeter’s assistance under Section 4.8.

5.6 Changes. The Controller promptly tells Propeter about changes that affect processing or compliance.

6. International Data Transfers

6.1 EU/UK to India. Transfers to Propeter in India use the SCCs, Module 2 (Controller to Processor), with the selections in Annex 3. Copies are available from legal@propeter.com.

6.2 UK. The ICO-approved UK IDTA applies to UK transfers; executed copies are available on request.

6.3 Sub-processor transfers. Transfers outside the EEA use the mechanisms in Annex 1. US transfers are covered by SCCs, with the EU–US DPF as an additional mechanism where the sub-processor participates.

6.4 Australia. Cross-border disclosures of Australian residents’ data comply with APP 8.1 or an APP 8.2 exception.

6.5 Transfer Impact Assessment. Propeter has assessed EU/UK transfers to India, including the DPDP Act 2023 and its safeguards. A summary is available on request.

6.6 Cooperation. The Controller will execute supplementary transfer documentation reasonably required to stay compliant.

7. GDPR-Specific Provisions

7.1 This DPA is intended to satisfy GDPR Article 28(3); Article 28 prevails over any inconsistency.

7.2 Propeter’s data protection contact is legal@propeter.com. The Controller provides its DPO details in Annex 4.

7.3 The lead supervisory authority is that of the EU Member State of the Controller’s main establishment. Propeter cooperates with supervisory authority inquiries.

7.4 Each party maintains its own Article 30 records of processing.

7.5 If an instruction would infringe data protection law, Propeter informs the Controller and may suspend the affected processing until lawful instructions are given.

8. Australia-Specific Provisions

8.1 Propeter processes Australian residents’ data in line with the Australian Privacy Principles, including APP 11 (security), APP 12 (access) and APP 13 (correction).

8.2 Overseas disclosures follow APP 8 as described in Section 6.4 and Annex 1.

8.3 For eligible data breaches under the Notifiable Data Breaches scheme, Propeter notifies the Controller within 72 hours so the Controller can notify the OAIC.

8.4 Complaints go to the Controller first, may be escalated to legal@propeter.com, and may be referred to the OAIC (oaic.gov.au).

9. Liability

9.1 Propeter is liable for damage caused by processing that breaches this DPA or data protection law where it acted outside or against the Controller’s lawful instructions.

9.2 The Controller is liable for damage resulting from its instructions or its own non-compliance.

9.3 Where both parties are liable under GDPR Article 82, each bears liability in proportion to its responsibility, with rights of contribution.

9.4 Propeter’s aggregate liability under this DPA (other than for fraud, wilful misconduct or death/personal injury) is limited as set out in the Terms of Service and capped at the fees paid by the Controller in the 12 months before the claim, except where data protection law does not permit such a limit.

10. Term and Termination

10.1 This DPA starts when the Controller accepts the Terms of Service (or signs a separate DPA) and lasts for the Services agreement.

10.2 It ends automatically with the Terms of Service; Section 4.9 survives for 90 days and Section 4.2 for 3 years.

10.3 Termination provisions in the Terms of Service apply equally to this DPA.

11. Governing Law and Jurisdiction

11.1 This DPA is governed by the laws of India, without regard to conflict-of-law rules.

11.2 The SCCs in Annex 3 are governed by Irish law, with disputes under them heard by the courts of Ireland.

11.3 Other disputes follow the dispute resolution provisions of the Terms of Service, except where data protection law requires a specific authority or court.

Annex 1: Approved Sub-Processors

The current list, with purposes, data, locations and transfer mechanisms, is maintained at propeter.com/legal/sub-processors. Propeter gives 30 days’ notice of changes.

Annex 2: Technical and Organisational Measures

Encryption

• AES-256 encryption for Personal Data at rest
• TLS 1.3 minimum in transit
• Field-level encryption for sensitive elements (passport numbers, financial identifiers)
• Encrypted database backups

Access controls

• Mandatory MFA for staff with production access
• Role-based access control on a least-privilege basis
• Just-in-time access for privileged operations
• Quarterly access reviews
• Immediate revocation when staff leave

Network security

• Web application firewall on external endpoints
• DDoS mitigation
• VPN for internal system access
• Segmented production, staging and development networks
• Intrusion detection and prevention

Application security

• OWASP Top 10 practices in the development lifecycle
• Annual third-party penetration testing
• Automated dependency vulnerability scanning
• Secure code review for releases

Monitoring and logging

• 24/7 automated security monitoring and alerting
• Data-access audit logs retained for at least 12 months
• Anomaly detection for unusual access patterns

Personnel security

• Background checks for staff with Personal Data access
• Annual privacy and security training
• Confidentiality agreements with all staff
• Incident response training

Physical security and hosting

• Processing runs on AWS cloud infrastructure, which holds SOC 2 Type II, ISO 27001 and PCI DSS certifications
• No Propeter physical access to data-centre hardware
• Multi-zone redundancy

Business continuity

• Daily encrypted backups with 30-day retention
• Recovery Point Objective (RPO): 24 hours
• Recovery Time Objective (RTO): 4 hours
• Annual disaster recovery testing
• Documented incident response plan

Annex 3: Standard Contractual Clauses — Selections

Annex 4: Controller Details

Completed by the Controller when this DPA is executed or during onboarding. To execute a signed copy, contact legal@propeter.com.

This DPA is provided as a standard template prepared in good faith against GDPR Article 28, the Australian Privacy Act 1988 and India’s DPDP Act 2023. Controllers should take independent legal advice that it meets their obligations. It is not legal advice.