Data processing agreement (DPA)
The guesthouse is the controller of its guest data; Gjestly is the processor. This agreement (GDPR article 28) comes with the subscription and is signed digitally.
1. Parties and roles
The guesthouse: controller. Gjestly: processor.
2. Nature, purpose and duration of processing
This section is under legal review and is not final.
3. Categories of data subjects and data
Guests (name, contact, booking history), the guesthouse's users.
4. Sub-processors
See the table below.
5. Security measures
This section is under legal review and is not final.
6. Assistance, deletion and return
On termination: export of the data in a readable format, then deletion after the agreed deadline.
7. Audit
This section is under legal review and is not final.
Sub-processors
| Vendor | Role | What is processed | Data location | Transfer basis |
|---|---|---|---|---|
| Supabase | Database and authentication | Bookings, guest register, invoices, user accounts | Not confirmed yet | Not confirmed yet |
| Vercel | Application hosting | Traffic to the websites and booking pages | Not confirmed yet | Not confirmed yet |
| Stripe | Payment processing | Payments. Card data is processed by Stripe, never by Gjestly | The Stripe group (global) | EU-US Data Privacy Framework |
| Resend | Transactional email | Email addresses and booking confirmations | Not confirmed yet | Not confirmed yet |
The fields that are not confirmed yet are filled in once the vendor agreements have been reviewed. If you need them before that, get in touch and we will send what we have.