Data Processing Addendum

1. Parties and purpose

This Data Processing Addendum ("DPA") is concluded between the Customer, acting as controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 ("GDPR"), and Sabeemod d.o.o., acting as processor within the meaning of Article 4(8) GDPR. It is entered into in respect of the processing of personal data that Sabeemod carries out on behalf of the Customer through the modules, extensions and connectors that the Customer has activated in its Sabeemod workspace. Its purpose is to satisfy the mandatory obligations set out in Article 28 GDPR and, where relevant, in the equivalent provisions of national data-protection laws that apply to the Customer.

2. Subject matter of the processing

The subject matter of the processing is the operational data of the Customer's hospitality business, extracted from its SabeeApp account through the official SabeeApp API, together with any output produced by the modules from that operational data. The scope of the extraction, the frequency, the categories of data, the retention periods and the recipients are configured by the Customer inside its workspace and are documented per module in the module documentation page.

3. Duration

The duration of the processing is the duration of the Terms of Service. When the Terms of Service are terminated, personal data processed on behalf of the Customer is deleted or returned to the Customer within thirty (30) days, according to the Customer's written instruction. In the absence of a written instruction within that period, deletion is the default and is executed on day 31 after termination. A written certificate of deletion is issued on request within a further ten (10) business days.

4. Nature and purpose of the processing

The nature of the processing is automated. The purpose of the processing is to deliver the module functionality that the Customer has selected: for example, the Revenue Signals module produces daily pace and pickup dashboards; the Channel Guard extension continuously audits rate parity across the OTAs already connected in the Customer's SabeeApp channel manager; the Guest Wallet module maintains prepaid balances against SabeeApp guest profiles. Sabeemod does not process personal data for any purpose other than the one instructed by the Customer through the activation of a module.

5. Categories of data subjects

The categories of data subjects concerned by the processing are typically the following: guests of the Customer property (past, present and future), staff of the Customer property whose credentials are used inside the SabeeApp workspace, business partners of the Customer whose contact details are stored inside the SabeeApp workspace, and any other individual whose personal data is present in the Customer's SabeeApp environment because the Customer has entered it there.

6. Categories of personal data

The categories of personal data processed are limited to what is present in the Customer's SabeeApp environment and to what the module in question actually needs. Typically: identity data (full name, date of birth), contact data (postal address, email address, phone number), reservation data (arrival date, departure date, room type, rate plan, source, folio content, notes), financial data (invoice line items, payment method type, prepaid balance, refund history), preference data (dietary requirements, room preferences, past complaints or compliments), and, only for the Identity Verification module, identification-document data (passport or national ID number, document photo).

7. Sub-processors

The Customer authorises Sabeemod to engage the sub-processors listed in the published sub-processor register. The current register lists the cloud hosting provider (European region), the transactional email provider (European Economic Area), the payment institution (European Economic Area, SEPA-authorised), the customer relationship management system (European Economic Area), and the incident-management platform (European Economic Area). Sabeemod flows down substantially equivalent obligations to each sub-processor and remains fully liable to the Customer for their performance.

8. Notice of sub-processor changes

Sabeemod gives the Customer at least thirty (30) days' notice of any addition or replacement of a sub-processor. During that thirty-day period, the Customer may object on reasonable data-protection grounds. If the objection cannot be resolved amicably, the Customer may terminate the module subscriptions that would be affected by the change, without penalty, effective on the date the new sub-processor is engaged.

9. Instructions

Sabeemod processes personal data only on documented instructions from the Customer, including for transfers of personal data to a third country, unless required to do so by European Union or Montenegrin law to which Sabeemod is subject. In such a case, Sabeemod informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The activation of a module by the Customer inside the workspace is deemed a documented instruction to carry out the processing described in the module documentation page.

10. Confidentiality of persons authorised to process

Sabeemod ensures that persons authorised to process the personal data have committed themselves to confidentiality by written contract, and are trained annually on data-protection basics, on the incident-response plan and on the Acceptable Use Policy. Access is granted on a role-based need-to-know basis and is reviewed quarterly.

11. Security measures (Article 32)

Sabeemod implements the following technical and organisational measures. Encryption in transit: TLS 1.2 minimum, TLS 1.3 preferred, HSTS enforced. Encryption at rest: AES-256 on databases, on object storage and on backups. Access control: role-based, mandatory multi-factor authentication for all employees, quarterly access reviews, immediate revocation on termination of employment. Logging: append-only, retained twelve (12) months, monitored for anomalies by a security-information-and-event-management system. Vulnerability management: automated scans daily, third-party penetration test annually, patch application within seven (7) days of a critical vulnerability disclosure. Backup: full backup nightly, incremental backup hourly, restoration drill twice a year with signed evidence. Business continuity: written plan, tested twice a year, targeting a recovery-time objective of four (4) hours and a recovery-point objective of one (1) hour. Physical security: hosting inside an ISO 27001 certified European data centre with twenty-four-hour manned security and access control by badge and biometric.

12. Assistance to the Customer

Sabeemod assists the Customer in fulfilling its own obligations under the GDPR. Concretely: on written request, Sabeemod provides within ten (10) business days the technical information required to answer a data-subject rights request, provides within fifteen (15) business days the technical information required for a data-protection impact assessment, and provides prompt cooperation in the event of an investigation by a supervisory authority. Assistance is included in the module subscription fees for reasonable volume; unusually large or unusually complex requests may be quoted separately at cost.

13. Personal data breach

Sabeemod notifies the Customer of a personal data breach without undue delay after becoming aware of it, and in any case within seventy-two (72) hours. The notification contains the nature of the breach, the categories and approximate number of data subjects concerned, the categories and approximate number of personal data records concerned, the likely consequences, and the measures taken or proposed to address the breach and to mitigate its possible adverse effects. Sabeemod cooperates in good faith with the Customer to enable the Customer to fulfil its own notification duties under Articles 33 and 34 GDPR.

14. Audit rights

The Customer may audit Sabeemod's compliance with this DPA once per calendar year, with thirty (30) days' prior notice, during business hours, at the Customer's cost, and provided the auditor signs a customary confidentiality undertaking. In practice, Sabeemod also makes available on request the summary reports of its annual third-party penetration test and its SOC 2 Type II report (available on the /security-whitepaper page), which typically satisfy the auditor's questions without an on-site visit being required. Where an on-site visit is nevertheless required, the parties agree on a mutually convenient date.

15. International transfers

Personal data is stored and processed inside the European Economic Area or in Montenegro. Any transfer outside this perimeter is protected by the standard contractual clauses adopted by the European Commission on 4 June 2021, complemented by the technical and organisational measures set out in this DPA and by a case-by-case transfer impact assessment. Sabeemod has not identified any transfer to a third country lacking an adequacy decision that would require the Customer's specific consent under Article 46 GDPR.

16. Deletion or return

On termination of the Terms of Service, Sabeemod deletes or returns all personal data to the Customer, at the choice of the Customer, within the timeframes set in section 3 above. Deletion includes backups, subject to the standard backup retention cycle described in section 11 (backups are retained thirty-five days, and are then overwritten by the normal rotation). Certified deletion evidence is provided on request.

17. Liability under the DPA

The liability of Sabeemod under this DPA is governed by the liability clause of the Terms of Service, subject to any mandatory rules of the GDPR that cannot be limited by contract. In the event of a joint claim by a data subject against both parties, Article 82(4) and (5) GDPR apply.

18. Governing law and jurisdiction

This DPA is governed by the same law and subject to the same jurisdiction clauses as the Terms of Service.

19. Order of precedence

In the event of a conflict between the Terms of Service and this DPA on a data-protection matter, this DPA prevails. In the event of a conflict between this DPA and the Privacy Policy, this DPA prevails.