Annex 1. Data Processing Agreement

1.1 This DPA applies to the processing of personal data by stayi on behalf of the Customer in the course of providing the Services ("Customer Personal Data").

1.2 The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Schedule 1. The processing shall continue for the duration of the Agreement and thereafter until the return or deletion of Customer Personal Data in accordance with Article 11.

2.1 The Customer shall ensure that it has a lawful basis for the processing of Customer Personal Data, that it has provided data subjects with all information required by Data Protection Law, and that its instructions to stayi comply with Data Protection Law.

3.1 stayi shall process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers to third countries, unless required to do so by Union or Member State law, in which case stayi shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 The Agreement and the Customer's configuration of the Services constitute the Customer's complete instructions. stayi shall immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law.

4.1 The Customer acknowledges and authorises that stayi may retain and process data generated through the use of the Services, including guest interaction data, for the purposes of analysing, developing and improving the Services, and of attributing bookings made through the Partner Experiences to the Customer's establishment and to the conversation in which an offer was shown, calculating and allocating Commission, and keeping the Partner Ledger. In respect of such processing, stayi acts as an independent controller and is solely responsible for compliance with Data Protection Law.

4.2 stayi shall not sell such data, use it for advertising purposes, or use it to identify individual data subjects. Showing Guests, within the Services, offers of Travel Partners and Local Providers that are relevant to their requests, including offers that bear Commission (Terms and Conditions, Article 8A), is part of the Services provided to the Customer and is not advertising within the meaning of this Article. stayi does not build profiles of Guests for that purpose, and does not use the data of one stay, room or establishment to select offers for another.

4.3 stayi keeps the Partner Ledger as its accounting records for the period, and in the form, set out in Article 11.4 of the Terms and Conditions.

5.1 stayi shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

6.1 stayi shall implement appropriate technical and organisational measures in accordance with Article 32 GDPR, as described in Schedule 2. stayi may update such measures from time to time, provided that the overall level of protection is not materially diminished.

7.1 The Customer grants stayi general written authorisation to engage sub-processors. The sub-processors engaged at the date of acceptance, including their own sub-processors where stayi relies on them for the Services, are listed in Schedule 3, Part B, with each one's name, address, the processing it carries out, the location of processing and the transfer mechanism relied on under Article 8. The Customer authorises them by accepting this DPA. stayi keeps that list up to date and makes the current version available to the Customer at all times at stayi.app/subprocessors.

7.2 stayi shall notify the Customer by email to its notice address (Terms and Conditions, Article 21.4) at least thirty (30) days before adding or replacing a sub-processor, stating the information listed in Article 7.1. The Customer may object in writing within that period on reasonable grounds relating to data protection. Within fifteen (15) days of an objection, stayi shall either propose a measure that addresses it or confirm that the sub-processor will not process Customer Personal Data. Failing either, the Customer may terminate the affected Services with effect before the sub-processor is engaged, and Article 9.5 of the Terms and Conditions applies. If the Customer does not object within the notice period, the change is authorised. Where a sub-processor must be replaced urgently for security or continuity, stayi may give shorter notice, with its reasons, and the Customer's right to object runs from that notice.

7.3 stayi shall impose on each sub-processor, by written contract, the same data protection obligations as set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of the GDPR, and shall remain fully liable to the Customer for the performance of each sub-processor's obligations.

8.1 stayi shall not transfer Customer Personal Data to a country outside the European Economic Area unless the conditions laid down in Chapter V GDPR are complied with, including by means of an adequacy decision or standard contractual clauses adopted by the European Commission.

9.1 Taking into account the nature of the processing, stayi shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests for the exercise of data subjects' rights. stayi shall promptly refer to the Customer any request it receives in respect of Customer Personal Data.

10.1 stayi shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and shall provide such information as the Customer may reasonably require to meet its obligations under Articles 33 and 34 GDPR.

10.2 Taking into account the nature of the processing and the information available to it, stayi shall provide reasonable assistance to the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR.

11.1 Upon termination of the Agreement, stayi shall, at the choice of the Customer, delete or return Customer Personal Data within a reasonable period, and delete existing copies, unless Union or Member State law requires their storage.

11.2 Data retained by stayi as an independent controller under Article 4 shall be deleted or anonymised in accordance with stayi's Privacy Policy, save as provided in Article 11.3.

11.3 The Partner Ledger is not deleted or anonymised upon termination. stayi pseudonymises it, removing all links to Guests, rooms, stays and conversations and any Guest email address, and keeps it for the period set out in Article 11.4 of the Terms and Conditions, with only the Travel Partner's booking reference as the key to the Travel Partner's own records.

11.4 Booking request details that stayi processes for the Customer when passing a Guest's request to a Local Provider are kept as follows: free-text details, such as a pickup point, a destination or a Local Provider's proposed alternative, are deleted thirty (30) days after the date of the service; a Guest's email address and the links to the Guest's room, stay and conversation are deleted thirteen (13) months after they are recorded. The Guest's email address is Customer Personal Data, used only to send that Guest the outcome of that booking; it is not part of the Partner Ledger.

12.1 stayi shall make available to the Customer all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, subject to reasonable prior notice, appropriate confidentiality undertakings, and a frequency and scope that are reasonable in the circumstances. The costs of any audit shall be borne by the Customer.

13.1 The limitations of liability set out in the Terms and Conditions shall apply to this DPA to the extent permitted by Data Protection Law. In the event of conflict between this DPA and any other part of the Agreement, this DPA shall prevail in respect of the processing of personal data.

The subject matter of the processing is the provision of the Services to the Customer.

The nature of the processing comprises collection, recording, storage, structuring, retrieval, use, transmission, analysis and erasure, including by automated means and artificial intelligence technologies.

The purpose of the processing is the provision of the AI concierge service to Guests, the transmission of Guest requests to the Customer, and the provision of reports and related functionality to the Customer. Where the Partner Experiences are activated, it also includes showing Guests offers of Travel Partners and Local Providers, passing Guests' booking requests to the Local Providers designated by the Customer by email, messaging, SMS or automated telephone call, receiving the Local Provider's response, and informing the Customer's staff, the Guest's room and, where the Guest provides an email address for this purpose, the Guest of the status of the booking.

The categories of data subjects are Guests and other users of the Services, Authorised Users and staff of the Customer, staff and representatives of the Customer's partners and Local Providers contacted through the Services, including the persons who answer automated telephone calls, and other third parties contacted through the Services at the Customer's instruction.

The types of personal data are the content of text and voice interactions and transcripts thereof, requests and related communications, questionnaire responses, usage, technical and device data, and contact details of Customer staff and of third parties configured by the Customer. Where the Partner Experiences are activated, they also include a Guest's email address, where the Guest enters it on screen to receive booking updates; the details of a booking request, being the offer, date, time, party size and room number and, for transfers, the pickup point and destination; the business contact details of Local Providers and their staff; and the content of their responses, including the recording, transcript and analysis of automated telephone calls, which the telephony provider keeps for up to thirty (30) days. No special categories of personal data are intended to be processed.

The duration of the processing is the term of the Agreement and the periods set out in Article 11.

stayi maintains measures appropriate to the risk, which include, as appropriate, the hosting of the Services in secure data centres located within the European Economic Area; the encryption of personal data in transit and at rest; the logical segregation of the data of each customer, together with authentication and authorisation controls for every access to the Services; the restriction of access to personal data to personnel with a need to know, subject to confidentiality obligations; the secure management of credentials and secrets; controlled change management and deployment processes; the protection of public interfaces against abuse; regular backups and logging; and procedures for the handling of personal data breaches and data subject requests.

stayi engages sub-processors that are necessary for the operation of the Services, in the following categories: cloud hosting and infrastructure; network, content delivery and connectivity services; authentication and identity management; artificial intelligence, speech recognition and speech synthesis technologies, including AI avatars; electronic communications, including email, messaging (including Viber), SMS and telephony, including automated telephone calls conducted by artificial intelligence; device management; application monitoring and metrics; and payment processing. The sub-processors engaged are named in Part B, and stayi informs the Customer of each addition or replacement in accordance with Article 7.2.

Travel Partners are not sub-processors. stayi does not disclose Customer Personal Data to them. As independent controller (Terms and Conditions, Article 8A.8), stayi discloses to them only an opaque reference that only stayi can link to the origin of a booking; they act as independent controllers of the bookings that Guests make with them.