Data processing agreement

The parties

The host who holds the account is the controller.

Meik Schütz, NIF 231101538, Rua Parque Norte, 23, 2.1, 4600-105 Braga, Portugal, who provides stay’in, is the processor. Contact: hello@stayin.pt.

Subject matter, nature and purpose

stay’in processes the data only to provide the service to the host:

• storing and showing bookings, read from the platforms' calendars and emails;
• collecting guests' registration details and reporting them to SIBA when the host asks;
• showing each guest the page for their stay;
• reading and sending messages with guests through the mailbox the host connects;
• storing the documents, invoices and receipts the host uploads;
• preparing tourist tax, VAT and Modelo 30;
• the artificial intelligence features the host uses.

Duration

For as long as the account exists, and until the data is deleted under “End of processing”.

Data and data subjects

Data subjects: the host's guests and the people they exchange messages with through the platform.

Data:

• identification: name, date of birth, nationality, country of residence, type, number and issuing country of the identity document;
• contact: email address and phone number;
• stay: dates, number of guests, platform and booking amounts;
• messages exchanged with the host and documents the host uploads.

The service is not intended for special categories of data (Article 9 GDPR). The host must not enter them.

Instructions

We process the data only on the host's documented instructions. These terms and the host's use of the platform are those instructions.

If we believe an instruction breaks data protection law, we tell the host.

We do not use the data for our own purposes, sell it or use it for advertising.

Confidentiality

Only the people who need access to provide the service have it, and all of them are bound by confidentiality.

Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), including:

• servers in Finland, in the European Union;
• encrypted connections (HTTPS);
• passwords stored only in hashed form;
• mailbox app passwords stored encrypted;
• one account cannot reach another account's data;
• guest pages open only from a link that cannot be guessed;
• guests' personal data is deleted automatically after the period the host sets.

Sub-processors

The host authorises the use of these sub-processors:

• Hetzner Online GmbH (Germany): server hosting, in Finland (European Union).
• Anthropic, PBC (USA): artificial intelligence features the host uses — suggested message replies, reading invoices and receipts, and translations.

We bind each of them to data protection obligations equivalent to this agreement's. Before adding or replacing a sub-processor, we give at least 30 days' notice by email. The host can object; if we cannot meet the objection, the host can cancel before the change.

Transfers outside the European Union

When a sub-processor processes data outside the European Union, the transfer relies on the standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework.

Data subjects' rights

If a guest contacts us to exercise their rights, we pass the request on to the host. We help the host respond, as far as the platform allows.

Personal data breaches

If we become aware of a personal data breach affecting the account, we tell the host without undue delay and, where possible, within 48 hours, with the information we have so the host can meet Articles 33 and 34 GDPR.

Assistance

Taking into account the nature of the processing and the information available to us, we help the host meet the obligations of Articles 32 to 36 GDPR: security, breach notification, impact assessments and prior consultation.

End of processing

When the account ends, the host can ask for a copy of the data. We delete the data within 30 days, except what the law requires us to keep.

Audits

We make available to the host the information needed to show compliance with this agreement. The host, or an auditor they appoint who is bound by confidentiality, can carry out an audit once a year, with reasonable notice and at the host's cost, or at any time after a data breach.

Final provisions

Liability, governing law and the competent courts are those of the terms of service. If this agreement and the terms conflict on data protection, this agreement prevails.