Data Processing Agreement

Controller: the VYNOS client who accepted the Terms and Conditions (the "Controller").

Processor: KANIK Advisory, s.r.o., registered office Panská 27, 811 01 Bratislava, Slovakia, company ID (IČO): 57 852 863, tax ID (DIČ): 2123315623, not registered for VAT, registered in the Commercial Register of the Bratislava III City Court, section Sro, file no. 203859/B (the "Processor").

The Processor processes personal data on behalf of the Controller solely to provide VYNOS: analysing reservations and property performance, preparing price recommendations, reports and the action plan and, at levels L2 and L3, synchronising with the Controller's property management system (PMS).

Nature of processing: collection (file upload, PMS synchronisation), storage, organisation, evaluation, writing prices back to the PMS, and erasure.

Data subjects: guests of the Controller's property; Portal users on the Controller's side.

Categories of data:

• reservation data — reservation number, stay and booking dates, room type, number of guests, price, commission, sales channel, status,
• data contained in files uploaded by the Controller (PMS exports) — may include guest name, contact details, country or notes; these columns are not transferred into the Service database; the original file is kept in encrypted private storage only to verify processing and is deleted automatically 30 days after upload (a file awaiting manual processing after 90 days at the latest), while the processed data remain,
• Portal user data — name, e-mail, credentials and activity records.

Special categories of personal data (Art. 9 GDPR) are not processed; the Controller must not enter them into the Service.

Processing lasts for the term of the Service contract. Afterwards the Processor, at the Controller's choice, returns the data and deletes them within 90 days including original files, unless the law requires further retention. Data are removed from backups in the normal backup rotation.

• process personal data only on documented instructions of the Controller, which are the contract, the Service settings chosen by the Controller and its written instructions; inform the Controller without undue delay if an instruction in its opinion infringes the law,
• ensure that persons authorised to process personal data are bound by confidentiality,
• implement appropriate technical and organisational measures under Art. 32 GDPR (section 7),
• assist the Controller with data subject requests and with obligations under Art. 32 to 36 GDPR,
• notify the Controller of a personal data breach without undue delay and within 48 hours of becoming aware of it, with the information under Art. 33(3) GDPR available to it,
• make available information necessary to demonstrate compliance and allow audits (section 8),
• not use personal data for its own purposes, except for anonymisation under section 10a.

The Controller grants the Processor general authorisation to engage sub-processors. As of the effective date they are:

• Supabase Inc. — database and file storage, data stored in Ireland (AWS eu-west-1),
• Vercel Inc. — application hosting, compute in Ireland (region dub1),
• Resend Inc. — e-mail delivery (reports, notices) from the EU region,
• Anthropic PBC — drafting the action-plan text from aggregated property data; guest personal data are not sent.

The Processor informs the Controller by e-mail at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable grounds; if the parties do not agree, the Controller may terminate the Service contract as of the change. The Processor imposes equivalent data protection obligations on sub-processors and remains liable for them.

The Controller's PMS is not a sub-processor of the Processor; it is the Controller's own system, accessed with the Controller's permission.

• encryption in transit (TLS/HTTPS, HSTS) and encryption at rest by the database provider,
• data stored in the European Union,
• database-level access control (Row Level Security); the application accesses data only through a server-side key, with no direct browser access,
• separate client and internal domains; a client sees only its own properties,
• password login with cryptographic hashing, server-side sessions, account lockout after 8 failed attempts, rate limiting,
• audit records of staff and client actions in the application,
• removal of guest personal data columns before reservations are stored in the database, and automatic deletion of original files after 30 (at most 90) days,
• daily database backups,
• access to production data only for authorised Processor staff bound by confidentiality,
• price writing to the PMS only after explicit activation, with a global kill switch.

On request the Processor provides documentation of its measures. An on-site audit by the Controller or an auditor bound by confidentiality is possible with at least 30 days' notice, at most once a year unless investigating a breach; the Controller bears the audit costs.

Any transfer of personal data outside the European Economic Area (e.g. support by a US-based sub-processor) relies on the Commission's adequacy decision (EU–US Data Privacy Framework) or on Standard Contractual Clauses.

The Controller is responsible for the lawfulness of the personal data it provides, in particular for having a legal basis and informing guests. It provides only data necessary for the purpose of the Service.

The Controller instructs the Processor to anonymise reservation data: remove guest names, contact details, reservation numbers and other guest identifiers, keeping only stay data (dates, room type, number of guests, price, sales channel, status). Data so anonymised are not personal data; the Processor may use them to develop and train the Service's models, including after the contract ends.

Guest personal data in identifiable form are not used to develop or train models and are deleted after the contract ends under section 4.

This agreement takes effect on acceptance of the Terms and Conditions and lasts as long as the Processor processes personal data on behalf of the Controller. Liability is governed by Art. 82 GDPR and the Terms and Conditions. If the Controller wishes to conclude this agreement in paper or signed electronic form, the Processor will send it for signature on request.