Data Processing Agreement

Last updated: April 25, 2026.

This Data Processing Agreement (“DPA”) forms part of the agreement between:

Stayvolution (“Processor”)

and

the customer using the Stayvolution platform (“Controller”).

1. SUBJECT MATTER

This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the use of the Stayvolution platform.

2. ROLES

  • The Controller determines the purposes and means of processing personal data.
  • The Processor processes personal data on behalf of the Controller.

3. NATURE AND PURPOSE OF PROCESSING

The Processor processes personal data as necessary to provide the functionalities of the Stayvolution platform, including:

  • sending surveys and feedback requests
  • collecting guest feedback and messages
  • organising and storing such data
  • analysing feedback and generating insights
  • displaying results to the Controller via the platform

4. TYPES OF PERSONAL DATA

The Processor may process the following categories of personal data:

  • guest name
  • contact details (email, phone number)
  • booking or stay-related information
  • feedback, complaints, and messages
  • any other personal data submitted by the Controller through the platform

5. CATEGORIES OF DATA SUBJECTS

  • guests of the Controller
  • individuals submitting feedback or complaints

6. CONTROLLER OBLIGATIONS

The Controller:

  • remains solely responsible for compliance with applicable data protection laws
  • ensures that personal data is collected lawfully and with a valid legal basis
  • provides appropriate information to data subjects where required
  • ensures that it has the right to share such data with the Processor

7. PROCESSOR OBLIGATIONS

The Processor shall:

  • process personal data only as necessary to provide the Service
  • implement appropriate technical and organisational measures to protect personal data
  • ensure that persons authorised to process data are subject to confidentiality obligations
  • assist the Controller, where reasonably possible, in responding to data subject requests
  • notify the Controller without undue delay in case of a personal data breach

8. SUB-PROCESSORS

The Controller authorises the Processor to use third-party service providers (sub-processors) necessary for the operation of the platform, such as:

  • hosting and cloud providers
  • analytics providers
  • communication tools
  • payment providers

The Processor remains responsible for the performance of its sub-processors.

9. INTERNATIONAL TRANSFERS

The Controller acknowledges that some sub-processors may be located outside the European Economic Area (EEA).

10. DATA RETENTION AND DELETION

Upon termination of the Service:

  • personal data will be deleted or made inaccessible within a reasonable timeframe, unless retention is required by law

11. SECURITY

The Processor implements appropriate security measures, including:

  • access controls
  • encrypted data transmission (HTTPS)
  • system monitoring and logging

12. LIABILITY

Each party is responsible for its own compliance with applicable data protection laws.

The Processor is not responsible for the lawfulness of the collection of personal data by the Controller.

13. GOVERNING LAW

This DPA is governed by Italian law.

Any dispute shall be subject to the exclusive jurisdiction of the Court of Florence, Italy