Data Processing Terms

1. Parties and nature of these terms

These Data Processing Terms (the DPA) form part of the Terms of Service and are the data processing agreement under Article 28 of the General Data Protection Regulation (GDPR) between the Customer as controller and Dendora Bt. (2500 Esztergom, 48-as tér 11., Hungary, company registration number 11-06-011289) as processor (the Processor).

By accepting the Terms of Service, the Customer also accepts this DPA. Where it differs from the Terms of Service, this DPA governs the processing of personal data.

2. Subject, purpose and duration

The Processor processes the Customer's guest data to provide the Stayfellow service: keeping bookings, guest links and guest messages, online check-in, issuing guest invoices in the Customer's own Számlázz.hu account, and exchanging data with the booking platforms the Customer connects.

Processing lasts for the term of the contract under the Terms of Service and then until deletion under section 9.

3. Data subjects and categories of data

Data subjects: the Customer's guests and their travel companions, and the buyers on guest invoices.

Data: name, party size, arrival and departure, email address, phone number, notes, booking amount and source; messages exchanged with guests; door codes; at online check-in, name, sex, date and place of birth, nationality, document type and number; on guest invoices, the buyer's name, address, email address, tax number and the invoice lines; booking data arriving from connected booking platforms.

Stayfellow does not ask for special categories of personal data. The Customer must not enter such data in free-text fields (notes, messages) either.

4. The Customer's instructions

The Processor processes the data only on the Customer's documented instructions. Instructions are the Terms of Service, this DPA, and every action the Customer and its users take in Stayfellow (for example entering a booking, sending a guest link, connecting a platform, issuing an invoice). An owner may give further instructions by email to info@dendora.hu.

If the Processor believes an instruction infringes the law, it informs the Customer without delay.

Instructions also cover transfers outside the EEA, to the providers and with the safeguards named in section 7; any other transfer needs a new instruction.

If EU or member state law requires the Processor to process the data for another purpose, it informs the Customer before processing, unless that law prohibits it.

5. Confidentiality

Only those at the Processor who need access to run the service, fix faults or carry out the Customer's requests can access the data, and they are bound by confidentiality.

6. Security

The Processor applies the measures required by Article 32 GDPR, in particular: every connection is encrypted (HTTPS); the database is stored encrypted, in EU jurisdiction; door codes, online check-in data and the Számla Agent key are additionally encrypted at application level (AES-GCM).

Sign-in uses passkeys instead of passwords; session identifiers are stored only as hashes and sessions expire after 7 days. Customers' data is separated in every query; within an account there are owner and staff roles, and only owners can manage door codes and account settings.

Online check-in data is deleted automatically one year after the departure date. The Processor reviews these measures as technology develops; the level of protection may not decrease as a result.

7. Sub-processors

The Customer gives general authorisation to engage sub-processors. Guest data currently involves: Cloudflare, Inc. (USA; hosting and database, the database in EU jurisdiction); Plus Five Five, Inc. (Resend, USA; sending emails to guests); Channex.io LTD (United Kingdom, booking platform connections, only when the Customer connects a platform).

The Processor imposes the same data protection obligations on sub-processors by contract and remains liable for their performance. Data is transferred outside the European Economic Area only with safeguards under Chapter V GDPR (an adequacy decision or standard contractual clauses).

The Processor notifies owners by email without delay after learning of it, and at least 7 days before adding or replacing a sub-processor, naming the provider, its task, where it processes data and the transfer safeguard. The Customer may object on data protection grounds; if no suitable solution exists, it may terminate free of charge before the change, with a pro rata refund of unused prepaid fees.

Booking platforms (such as Booking.com, Airbnb or Szallas.hu), which process guest data as controllers in their own right, and Számlázz.hu, which acts under the Customer's own contract, are not sub-processors; Stayfellow passes data to them only on the Customer's instruction.

8. Assisting the Customer

The Customer handles data subject requests (access, rectification, erasure, restriction, portability, objection). Data can be viewed and corrected in Stayfellow; what cannot be done there, such as erasing or exporting a guest's data, the Processor does without undue delay, normally within 10 days of an owner's request. If a data subject contacts the Processor directly, it forwards the request to the Customer without delay.

The Processor notifies owners of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with the information listed in Article 33(3) GDPR as far as known, and helps investigate and mitigate it.

The Processor gives the Customer the information needed for security, breach notification, data protection impact assessments and prior consultation with the supervisory authority.

9. Deletion and return of data

When the account is closed (Terms of Service, Cancellation and termination), the Processor, at the Customer's choice, returns the guest data in a machine-readable format (CSV or JSON) and then deletes it, or deletes it without returning it. Without an instruction it asks an owner first. Deletion from active systems, including copies held by sub-processors, happens at the latest 30 days after the return or after the export period ends. Data in database restore points is deleted within a further 30 days and is not restored for ordinary use meanwhile.

The only exception is data that EU or member state law applicable to the Processor requires it to keep; keeping its own subscription invoices does not allow further storage of guest data. The Processor confirms deletion in writing on request.

10. Audits

On request, the Processor makes available all information needed to demonstrate compliance with this DPA. The Customer, or an independent auditor it appoints who is bound by confidentiality, may audit once a year at its own cost with at least 30 days' notice, and additionally, with shorter notice, after a personal data breach, in proceedings by an authority or on a substantiated compliance concern. If an audit reveals a material breach attributable to the Processor, the Processor bears the justified costs of investigating and remedying it.

11. Liability and other provisions

The parties' liability is governed by the Terms of Service, without prejudice to Article 82 GDPR. This DPA is amended under the rules for amending the Terms of Service, but amendments cannot reduce the protection the GDPR requires; sub-processor changes follow section 7.

Contact for data protection matters: info@dendora.hu.