DATA PROCESSING AGREEMENT (DPA)

1. Parties

2. Subject Matter and Duration (art. 28.3 GDPR)

The Data Controller instructs the Data Processor to process personal data on its behalf through the Vezpa platform. Processing lasts for the duration of the subscription agreement between the parties and ceases upon its termination, subject to Section 14.

3. Nature, Purposes, and Types of Data Processed

3.1 Purposes

• Management of bookings, stay, and check-in/check-out
• Fulfillment of the Data Controller's legal obligations to public authorities (AlloggiatiWeb, ISTAT, PayTourist, Feratel/Meldeamt, SES.HOSPEDAJES, NTAK, eVisitor, SEF, UbyPort, eTurizem)
• Communication of booking data to OTA channels and channel manager activated by the property
• Issuing communications to the guest (confirmations, pre-check-in, payments)
• Payment processing through the Booking Engine or Stripe link
• Reports and statistics for the Data Controller

3.2 Categories of Data Subjects / Consumers (CCPA)

• Property guests and their companions
• Persons booking on behalf of others
• Emergency contacts optionally provided by the guest

3.3 Types of Personal Data Processed

• Identification and registration data (first name, last name, date and place of birth, citizenship, gender)
• Identity documents (type, number, date of issue, issuing authority, scanned or photographed image)
• Textual data extracted from the document via automatic OCR
• Contact data (email, phone, address)
• Booking and stay data
• Payment data (handled by Stripe, not stored on Vezpa)

4. Instructions from the Data Controller (art. 28.3.a GDPR / CCPA)

The Data Processor processes personal data exclusively on the basis of the Data Controller's documented instructions. General instructions are contained in this DPA, in the Privacy Policy, and in the Terms of Service. Specific instructions may be issued by the Data Controller via:

• Configurations in its account (activation/deactivation of government connectors, OTAs, retention)
• Connection of external services chosen by the Data Controller, such as the voice platform that answers the property's phone (e.g., Retell, Vapi, ElevenLabs): the Data Processor sends the service, only when it queries the Data Processor with the key generated by the Data Controller, the data needed to answer (availability, prices, property details and, after verification of phone number and surname, dates and amounts of the caller's booking) and receives messages and call summaries from it. The external service is chosen, contracted and paid for by the Data Controller: it is the Data Controller's processor, not a sub-processor of the Data Processor, and the Data Controller is responsible for it (contract under art. 28 GDPR and, where applicable, the CCPA/CPRA, notice to individuals, any call recording, international transfers).
• Written communication to info@vezpa.it or by PEC to lavezpa@pec.it

Should the Data Processor believe that an instruction violates the GDPR, CCPA, or other applicable provisions, it will immediately inform the Data Controller.

Under the CCPA/CPRA, Vezpa as Service Provider: (a) will not sell or share personal information; (b) will not retain, use, or disclose personal information outside the direct business relationship with the Data Controller; (c) will not retain, use, or disclose personal information for any purpose other than the specific purposes set forth in this DPA; and (d) will comply with applicable CCPA obligations and provide the same level of privacy protection required by the CCPA.

5. Obligations of the Data Processor (art. 28.3.b-h GDPR / CCPA)

The Data Processor commits to:

1. Confidentiality: process data in a confidential manner and ensure that persons authorized to process are bound by confidentiality obligations;
2. Security: adopt the technical and organizational measures in Annex B, adequate to the risk;
3. Sub-processors: comply with the conditions of Section 6;
4. Assistance to the Data Controller: assist the Data Controller in fulfilling its obligations, in particular:
   • Response to data subject requests (art. 15-22 GDPR / consumer requests under CCPA) within timeframes that allow the Data Controller to respond within the 30 days required by law (or 45 days under CCPA);
   • Data breach notification to the Data Controller within 48 hours of discovery (Section 7);
   • Support for DPIA (art. 35) and prior consultations (art. 36);
   • Demonstration of compliance through documentation and, where required, audits (Section 9).
5. Return / deletion of data upon termination, as provided in Section 14;
6. Information: make available to the Data Controller all information necessary to demonstrate compliance with this DPA.

6. Sub-processors (art. 28.2 and 28.4 GDPR / CCPA)

6.1 General Authorization

The Data Controller authorizes the Data Processor to appoint the sub-processors listed at vezpa.it/subprocessors and those that will subsequently be added according to the procedure described here.

6.2 Notice of Change

The Data Processor will notify the Data Controller of its intention to add or replace a sub-processor with at least 30 days' notice, via email to the registered address and/or dashboard notice. Within such period, the Data Controller may object on reasoned grounds. In case of an objection that cannot be resolved, either party may terminate the contract, with cessation of the processing concerned.

6.3 Obligations toward Sub-processors

The Data Processor imposes on sub-processors in writing data protection obligations equivalent to those provided here, and is liable to the Data Controller for the sub-processors' conduct.

7. Data Breach (art. 33 GDPR / US state breach notification laws)

In the event of a personal data breach involving data processed on behalf of the Data Controller, the Data Processor will:

• Notify the Data Controller without undue delay and in any case within 48 hours of discovery, save for documented force majeure;
• Provide the information required by art. 33.3 GDPR (nature, categories and approximate number of data subjects and data, likely consequences, measures taken or proposed);
• Cooperate with the Data Controller in communications to data subjects and the supervisory authority;
• Document the incident and actions taken.

Notice to the Data Controller occurs via email to the registered address and PEC, if available. The Data Controller remains responsible for external notifications (Italian Data Protection Authority (Garante), state Attorneys General where applicable under US state breach laws, data subjects) under arts. 33-34 GDPR and applicable US law.

8. Data Subject / Consumer Rights (art. 28.3.e GDPR / CCPA)

If a data subject or consumer contacts the Data Processor directly to exercise rights relating to data processed on behalf of the Data Controller, the Data Processor forwards the request to the Data Controller without delay and does not respond on behalf of the Data Controller except as otherwise instructed.

The Data Processor makes available to the Data Controller, through the dashboard and API, features for:

• Export of a data subject's data (access and portability / right to know)
• Rectification (right to correct)
• Deletion or anonymization (right to delete)
• Restriction of processing

For requests requiring manual technical intervention, the Data Processor responds within 10 business days of receipt of the Data Controller's instruction.

9. Audit (art. 28.3.h GDPR)

The Data Processor provides the Data Controller, upon request, with information and documentation demonstrating compliance with this DPA, including:

• Summary of implemented security measures
• List of sub-processors with locations and transfer bases
• Record of processing activities (relevant excerpts)
• Sub-processor certifications (ISO 27001, SOC 2, DPF) where available

9.1 Audit Methods and Limits

• Default method — remote documentary audit: the Data Controller may request, with at least 30 days' written notice and no more than once a year, the sharing of security documentation, certifications, records and answers to questionnaires. This is the standard method.
• On-site audit at Vezpa's premises: permitted only in the event of an established breach of contract or a confirmed data breach attributable to the Data Processor, with at least 30 days' written notice.
• Duration: each audit may not exceed 2 business days, carried out during business hours and without interfering with ordinary operations.
• Third-party auditors: admitted only if bound by an NDA with Vezpa and free of conflicts of interest (not direct competitors of the Data Processor).
• Costs: borne entirely by the Data Controller (including the Data Processor's reasonable internal costs), unless the audit establishes a breach attributable to the Data Processor, in which case the costs are borne by the latter.
• Confidentiality: information obtained during the audit is subject to a confidentiality obligation extending beyond the term of the contract for at least 5 years.

10. International Data Transfers (Chapter V GDPR)

The list of sub-processors with location and legal basis for transfer is published at vezpa.it/subprocessors. For transfers not covered by an adequacy decision, the Data Processor adopts:

• Standard Contractual Clauses 2021/914 and supplementary measures where necessary (documented Transfer Impact Assessment);
• Or other appropriate safeguards under art. 46 GDPR.

11. Role of the Data Controller

The Data Controller declares and warrants that it:

• Has provided data subjects with the notice required under arts. 13-14 GDPR and applicable US state privacy laws;
• Has obtained any necessary legal bases (consent, contract, legal obligation) for the processing;
• Issues lawful instructions to the Data Processor;
• Ensures proper retention and deletion of data after withdrawal from the Vezpa platform.

12. Confidentiality

Each party maintains strictly confidential all information received from the other party in the performance of this DPA, for the duration of the contract and for the 5 years following.

13. Liability

Each party's liability under art. 82 GDPR toward data subjects and under applicable US state law toward consumers remains governed by law. Between the parties, the contractual liability regime is that set out in the Terms of Service (Sections 9-10), subject to the non-derogable allocation provided by art. 82 GDPR.

14. Termination of Processing

Upon termination of the contract for any reason, the Data Processor will:

1. Make available to the Data Controller tools to export its own data in structured format (CSV/JSON) for 30 days from termination;
2. After 30 days, delete or anonymize the data processed on behalf of the Data Controller from production systems;
3. Delete data from backups within the next rotation cycle (typically within 90 days);
4. Retain data that Vezpa is required to retain by law (typically: billing data and security logs) only for the time required by applicable regulation, maintaining adequate security measures thereon.

15. Changes

The Data Processor may modify this DPA to reflect regulatory developments (e.g., new SCCs, decisions of the Italian Data Protection Authority (Garante), US state privacy law amendments) or organizational changes. Material changes are communicated to the Data Controller with at least 30 days' notice. If the Data Controller does not accept, it may terminate without penalty for the unused portion of the subscription.

16. Governing Law

This DPA is governed by Italian law. For disputes, Section 16 of the Terms of Service applies. Users located in the United States may additionally pursue small claims in their local state court as provided in the Terms of Service.