Data Processing Addendum (DPA)

Data Processing Agreement (DPA) 1. Definitions and Scope This Data Processing Agreement ("DPA") supplements the AdminRentist Terms of Service and governs the processing of personal data by MEDITERRAN-IA LTD ("Processor" or "AdminRentist") on behalf of the customer ("Controller"). The Controller is a company or professional who contracts the services of the AdminRentist platform for the management of tourist accommodations and activities associated with said management. The Processor is a company specialized in providing technological services for the comprehensive management of tourist accommodations, through a SaaS platform that allows managing bookings, guests, incidents, service providers, and other services associated with the stay. Whereas under the Terms of Service accepted by the Controller, the Processor may access personal data for which the customer is the Data Controller. Whereas pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the parties have agreed to enter into this Data Processing Agreement. 2. Purpose of the Agreement The purpose of this Agreement is to regulate the processing of personal data owned by the customer by the Processor, in order to provide the services defined in the terms and conditions (hereinafter, the "Services") entrusted by the Controller. This Agreement constitutes access to data on behalf of a third party and not a transfer or disclosure of personal data, such that the customer continues to maintain control over the uses and purposes of the processing of personal data for which it acts as Data Controller. 3. Duration The processing of personal data will be carried out during the term of the Terms of Service. Upon termination, data may be retained for a maximum period of sixty (60) days solely for the purposes of retrieving, returning, or exporting information, remaining blocked for any other purpose. Once this period has elapsed, data will be securely deleted, unless its retention is required by a legal obligation. 4. Personal Data Processing These stipulations authorize the Processor to process, on behalf of the Controller, the personal data necessary to provide the Services. The Processor has been selected after verifying that it offers sufficient guarantees to implement appropriate technical and organizational measures, ensuring that the processing meets legal requirements and safeguards the rights of data subjects. The categories of data subjects include owners, managers, maintenance personnel, and guests (names, emails, phone numbers, traveler registration data, and tax identification numbers). The Processor will carry out the following processing operations: collection, recording, organization, structuring, storage, consultation, use, and erasure. 5. Processor Obligations 2.1 Processing under instructions: AdminRentist will process personal data solely in accordance with documented instructions from the Controller. Furthermore, the Processor will process data exclusively to provide the Services to the Controller. Under no circumstances may data be used for purposes other than those set out in this Agreement. 2.2 Confidentiality and Security: The Processor will ensure that all personnel authorized to access data are bound by confidentiality obligations. It will take measures to ensure that any person acting under its authority who has access to personal data may only process it following the Controller's instructions. Furthermore, it will not disclose data to third parties, unless expressly authorized by the Controller. The Processor will implement appropriate technical and organizational measures pursuant to Article 32 GDPR and aligned with the Cyber Essentials scheme (encryption in transit and at rest, multi-factor authentication, and role-based access control) and will provide a general description of such measures. 2.3 Assistance and Rights: AdminRentist will actively assist the Controller in fulfilling its obligations regarding data subject rights (access, rectification, erasure, portability, and objection), as well as conducting Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities, where appropriate. In this regard, when data subjects exercise said rights before the Processor, it must notify the Controller via email immediately and in any case no later than the working day following receipt of the request, accompanied by all relevant information to resolve the request. Additionally, the Processor must make available to the Controller all information necessary to demonstrate compliance with the obligations established in this Agreement. 2.4 Breach Notification (Strict Deadlines): AdminRentist will notify the Controller of any security breach without undue delay and, where feasible, within a maximum of 24-48 hours of becoming aware of the incident. The notification will include the nature of the breach, affected data, consequences, and mitigating measures. The Controller retains the obligation to notify the competent supervisory authority within a maximum period of 72 hours. 6. Controller Obligations The Controller undertakes to: 6.1 Ensure compliance with all necessary technical and organizational measures to guarantee personal data security, preventing alteration, loss, unauthorized processing, or access. 6.2 Notify the Processor of any changes occurring in the provided personal data in order to keep it updated. 6.3 Collect processed personal data in compliance with applicable Data Protection legislation. 6.4 The Controller guarantees: a. That personal data contained in its databases has been obtained directly from data subjects, who have been informed expressly, precisely, and unequivocally prior to data collection regarding: • The existence of a personal database. • The purpose of data collection. • The recipients of the information. • The consequences of obtaining data or refusing to provide it. • The possibility of exercising rights of access, rectification, erasure, objection, restriction, portability, and to be forgotten. • The identity and address of the Controller. b. That it has informed data subjects of the explicit and legitimate purposes for which their data will be used. c. That it offers data subjects the possibility to object to the processing of their data through a simple and free procedure. d. That it has implemented the necessary security measures to ensure data protection. e. That personal data is processed solely by employees whose intervention is required for contractual purposes, who have been instructed and trained regarding personal data protection obligations. f. That its data processing activities are lawful. g. That, where mandatory for its organization, it has appointed a Data Protection Officer. h. That it maintains a Record of Processing Activities. 7. Sub-processors and Right to Object 3.1 General authorization and objection: The Controller grants general authorization to AdminRentist to engage sub-processors. AdminRentist will notify in writing any changes to the sub-processor list 30 days in advance, allowing the Controller to object. The absence of objection within said period shall be deemed consent. All sub-processors shall be bound by obligations equivalent to this DPA. 3.2 Current List: Essential sub-processors to date are: (a) Amazon Web Services (AWS) (data hosted in the UK and EEA - Ireland); (b) Stripe, Inc. (payment gateway and fraud prevention); (c) Matomo (anonymized analytics). 8. International Transfers and Audits 4.1 Safeguards: In the event of international transfers of personal data outside the UK or the European Economic Area (EEA), appropriate safeguards required by applicable regulations will be implemented, including, where applicable, the International Data Transfer Agreement (IDTA), the European Commission's Standard Contractual Clauses (SCCs) and/or the relevant UK Addendum, as well as necessary Transfer Risk Assessments to ensure an adequate level of data protection. 4.2 Right to Audit: AdminRentist will permit reasonable audits and inspections by the Controller or an independent auditor, providing the information necessary to demonstrate compliance, subject to 30 days' advance notice. 4.3 Final Deletion or Return: Upon termination of the Services, the Controller will choose between the return or permanent deletion of its data. AdminRentist will delete all existing copies, unless legally required to retain them. Backup data will be taken out of use and securely deleted in the next cycle. 9. Liability in Case of Claims 9.1 If the Processor is involved in any investigation or administrative proceeding initiated by a supervisory authority, or in a third-party claim, it will immediately inform the Controller, describing the alleged facts and actions taken. Upon conclusion of the proceeding, it must provide a copy of the issued Resolution. 9.2 In the event that a supervisory authority sanctions the Controller or any third party as a direct or indirect consequence of the Processor's failure to comply with this Agreement, the Processor will indemnify the Controller or third party in an amount equal to the sanction, plus statutory interest, defense costs, and procedural expenses incurred, as well as any other damages caused. 9.3 Notwithstanding the foregoing, both parties mutually agree to be liable for all damages caused to the other in all cases of negligent or wrongful conduct in fulfilling contractual and statutory obligations under this Agreement. 10. Confidentiality 10.1 All information classified as confidential communicated between the parties in connection with the provision of the Services may only be used for such purpose. Neither party will disclose to any third party, directly or indirectly, without prior written consent, any information received from the other party in connection with this Agreement. 10.2 The Processor will apply all technical and organizational measures necessary to maintain confidentiality, specifically regarding the processing of Controller personal data pursuant to applicable regulations. 10.3 This restriction applies indefinitely and remains in effect following termination of this Agreement for any reason. Both parties agree that any confidential information received must be used solely to provide or receive services under this Agreement. 10.4 The foregoing restrictions will not apply to any information: a. That is or becomes generally accessible to the public other than through a breach of this provision. b. That is obtained from a third party not bound by confidentiality obligations. c. That was previously known to the recipient. d. Whose disclosure is mandated by law. 11. Breach and Termination of the Agreement In the event of a breach of obligations by the Controller, the Processor may terminate this Agreement simply by notifying the Controller. In the event of a breach of obligations by the Processor, the Controller may likewise terminate the Agreement by notifying the Processor. 12. Jurisdiction and Applicable Law 12.1 The parties waive their own jurisdiction and expressly submit to the jurisdiction of the Courts and Tribunals of England and Wales for any judicial dispute arising from a breach of this Agreement, agreeing that the governing law shall be that of England and Wales. 12.2 If any provision of this Agreement is held to be invalid, illegal, or unenforceable, the validity, legality, and enforceability of the remaining provisions will not be affected. The provisions of this Agreement shall be interpreted in accordance with good faith and the plain, usual meaning of the terms.