DATA PROCESSING AGREEMENT (DPA)

1. Parties

2. Subject matter and duration (art. 28.3 GDPR)

The Controller instructs the Processor to process personal data on its behalf through the Vezpa platform. The processing has the duration of the subscription contract between the parties and ends upon its termination, without prejudice to §14.

3. Nature, purposes and categories of data processed

3.1 Purposes

• Management of bookings, stays and check-in/check-out
• Fulfilment of the Controller's legal obligations towards public authorities (AlloggiatiWeb, ISTAT, PayTourist, Feratel/Meldeamt, SES.HOSPEDAJES, NTAK, eVisitor, SEF, UbyPort, eTurizem)
• Transmission of booking data to OTA channels and the channel manager activated by the facility
• Issuing communications to the guest (confirmations, pre-check-in, payments)
• Processing payments via Booking Engine or Stripe link
• Production of reports and statistics for the Controller

3.2 Categories of data subjects

• Guests of the facilities and their companions
• Persons who book on behalf of others
• Emergency contacts, if any, provided by the guest

3.3 Types of personal data processed

• Identification and personal data (first name, last name, date and place of birth, citizenship, gender)
• Identity documents (type, number, date of issue, issuing authority, scanned or photographed image)
• Text data extracted from the document via automatic OCR
• Contact data (email, phone, address)
• Booking and stay data
• Payment data (managed by Stripe, not stored on Vezpa)

4. Controller's instructions (art. 28.3.a GDPR)

The Processor processes personal data exclusively on the basis of documented instructions of the Controller. General instructions are contained in this DPA, in the Privacy Policy, in the GDPR Notice and in the Terms of Service. Specific instructions may be issued by the Controller through:

• Settings in its own account (activation/deactivation of governmental connectors, OTAs, retention)
• Connection of external services chosen by the Controller, such as the voice platform that answers the property's phone (e.g. Retell, Vapi, ElevenLabs): the Processor sends the service, only when it queries the Processor with the key generated by the Controller, the data needed to answer (availability, prices, property details and, after verification of phone number and surname, dates and amounts of the caller's booking) and receives messages and call summaries from it. The external service is chosen, contracted and paid for by the Controller: it is the Controller's processor, not a sub-processor of the Processor, and the Controller is responsible for it (contract under Art. 28 GDPR, information to data subjects, any call recording, transfers outside the EU).
• Written communication to info@vezpa.it or via PEC to lavezpa@pec.it

Should the Processor consider that an instruction infringes the GDPR or other applicable provisions, it shall immediately inform the Controller.

5. Obligations of the Processor (art. 28.3.b-h GDPR)

The Processor undertakes to:

1. Confidentiality: process data confidentially and ensure that persons authorised to process the data are bound by a confidentiality obligation;
2. Security: adopt the technical and organisational measures set out in Annex B, appropriate to the risk;
3. Sub-processors: comply with the conditions of §6;
4. Assistance to the Controller: assist the Controller in fulfilling its obligations, in particular:
   • Response to data subject requests (articles 15-22 GDPR) within time frames that allow the Controller to respond within the statutory 30 days;
   • Notification of data breaches to the Controller within 48 hours of discovery (§7);
   • Support for DPIAs (art. 35) and prior consultations (art. 36);
   • Demonstration of compliance through documentation and, where requested, audits (§9).
5. Return / deletion of data at the end, as provided for in §14;
6. Information: make available to the Controller all information necessary to demonstrate compliance with this DPA.

6. Sub-processors (art. 28.2 and 28.4 GDPR)

6.1 General authorisation

The Controller authorises the Processor to appoint the sub-processors listed at vezpa.it/subprocessors and those that will subsequently be added according to the procedure described here.

6.2 Prior notice of changes

The Processor shall notify the Controller of its intention to add or replace a sub-processor with at least 30 days' notice, by email to the registered address and/or notice in the dashboard. Within that period the Controller may object with reasons. In case of an unresolvable objection, either party may terminate the contract with cessation of the processing concerned.

6.3 Obligations towards sub-processors

The Processor shall impose in writing on sub-processors data protection obligations equivalent to those set out here, and shall be liable to the Controller for the performance of the sub-processors.

7. Data breach (art. 33 GDPR)

In case of personal data breach affecting data processed on behalf of the Controller, the Processor shall:

• Notify the Controller without undue delay and in any case within 48 hours of discovery, save for documented force majeure;
• Provide the information required by art. 33.3 GDPR (nature, categories and approximate number of data subjects and data, likely consequences, measures taken or proposed);
• Cooperate with the Controller in communications to data subjects and to the supervisory authority;
• Document the incident and the actions taken.

Notification to the Controller takes place via email to the registered address and PEC, if available. The Controller remains responsible for external notifications (Italian Data Protection Authority (Garante), data subjects) pursuant to articles 33-34 GDPR.

8. Rights of data subjects (art. 28.3.e GDPR)

If a data subject contacts the Processor directly to exercise rights relating to data processed on behalf of the Controller, the Processor shall forward the request to the Controller without delay and shall not respond on behalf of the Controller unless otherwise instructed.

The Processor makes available to the Controller, in the dashboard and via API, features for:

• Export of a data subject's data (access and portability)
• Rectification
• Erasure or anonymisation
• Restriction of processing

For requests requiring manual technical intervention, the Processor shall respond within 10 working days of receipt of the Controller's instruction.

9. Audit (art. 28.3.h GDPR)

The Processor shall provide the Controller, upon request, with information and documentation demonstrating compliance with this DPA, including:

• Summary of the security measures implemented
• List of sub-processors with locations and transfer bases
• Records of processing activities (relevant extracts)
• Certifications of sub-processors (ISO 27001, SOC 2, DPF) where available

9.1 Audit methods and limits

• Default method — remote documentary audit: the Controller may request, with at least 30 days' written notice and no more than once a year, the sharing of security documentation, certifications, records and answers to questionnaires. This is the standard method.
• On-site audit at Vezpa's premises: permitted only in the event of an established breach of contract or a confirmed data breach attributable to the Processor, with at least 30 days' written notice.
• Duration: each audit may not exceed 2 working days, carried out during working hours and without interfering with ordinary operations.
• Third-party auditors: admitted only if bound by an NDA with Vezpa and free of conflicts of interest (not direct competitors of the Processor).
• Costs: borne entirely by the Controller (including the Processor's reasonable internal costs), unless the audit establishes a breach attributable to the Processor, in which case the costs are borne by the latter.
• Confidentiality: information obtained during the audit is subject to a confidentiality obligation extending beyond the term of the contract for at least 5 years.

10. Transfers outside the EU (Chapter V GDPR)

The list of sub-processors with indication of location and legal basis for the transfer is published at vezpa.it/subprocessors. For transfers not covered by an adequacy decision, the Processor adopts:

• Standard Contractual Clauses 2021/914 and supplementary measures where necessary (documented Transfer Impact Assessment);
• Or other appropriate safeguards provided for by art. 46 GDPR.

11. Role of the Controller

The Controller declares and warrants that it:

• Has provided data subjects with the information notice required by articles 13-14 GDPR;
• Has obtained any legal bases (consent, contract, legal obligation) necessary for the processing;
• Issues lawful instructions to the Processor;
• Ensures the proper storage and deletion of data after withdrawal from the Vezpa platform.

12. Confidentiality

Each party shall keep strictly confidential all information received from the other party in the performance of this DPA, for the entire duration of the contract and for 5 years thereafter.

13. Liability

The liability of each party under art. 82 GDPR towards data subjects remains governed by law. In the relations between the parties, the contractual liability regime is that established in the Terms of Service (§9-10), without prejudice to the mandatory allocation provided for by art. 82 GDPR.

14. Termination of processing

Upon termination of the contract for any reason, the Processor shall:

1. Make available to the Controller the tools to export its own data in a structured format (CSV/JSON) for 30 days following termination;
2. After 30 days have elapsed, delete or anonymise the data processed on behalf of the Controller from production systems;
3. Delete the data from backups within the following rotation cycle (typically within 90 days);
4. Retain data that Vezpa is required to retain by law (typically: invoicing data and security logs) only for the time imposed by the applicable legislation, maintaining adequate security measures on them.

15. Changes

The Processor may amend this DPA to reflect regulatory developments (e.g. new SCCs, measures of the Italian Data Protection Authority (Garante)) or organisational changes. Substantial changes shall be communicated to the Controller with at least 30 days' notice. If the Controller does not accept, it may withdraw without penalty for the unused portion of the subscription.

16. Governing law

This DPA is governed by Italian law. For disputes, §16 of the Terms of Service applies.