Data Processing Agreement

1. Parties and Definitions

This Data Processing Agreement ("DPA") is entered into by and between:

• "Controller" or "Customer" - The entity that determines the purposes and means of processing Personal Data
• "Processor" or "Ilora" - The entity that processes Personal Data on behalf of the Controller
• "Personal Data" - Any information relating to an identified or identifiable natural person
• "Processing" - Any operation performed on Personal Data
• "Sub-processor" - Any third party engaged by Processor to process Personal Data

2. Subject Matter and Scope

This DPA applies to all processing of Personal Data by the Processor on behalf of the Controller in connection with the use of Ilora's hotel analytics platform.

2.1 Categories of Data Subjects

• • Customer employees and authorized users
• • Hotel guests (where applicable)
• • Business contacts and stakeholders

2.2 Types of Personal Data

• • Contact information (name, email, phone)
• • Account credentials and authentication data
• • Usage data and activity logs
• • Property and financial analytics data

2.3 Nature and Purpose of Processing

• • Providing hotel analytics and intelligence services
• • User authentication and access management
• • Customer support and service delivery
• • Platform improvement and security monitoring

3. Processor Obligations

The Processor agrees to:

• 3.1 Process Personal Data only on documented instructions from the Controller
• 3.2 Ensure that persons authorized to process Personal Data have committed to confidentiality
• 3.3 Implement appropriate technical and organizational security measures
• 3.4 Assist the Controller in responding to data subject requests
• 3.5 Notify the Controller without undue delay of any Personal Data breach
• 3.6 Delete or return all Personal Data upon termination of services
• 3.7 Make available all information necessary to demonstrate compliance

4. Security Measures

The Processor implements the following security measures:

5. Sub-processors

The Controller authorizes the Processor to engage the following sub-processors:

The Processor will notify the Controller of any changes to sub-processors with at least 30 days advance notice.

6. International Data Transfers

Where Personal Data is transferred outside the European Economic Area (EEA), the Processor ensures adequate protection through:

• • EU-US Data Privacy Framework certification
• • Standard Contractual Clauses (SCCs) as approved by the European Commission
• • Binding Corporate Rules where applicable
• • Adequacy decisions by the European Commission

7. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject rights including:

• • Right of access (Article 15 GDPR)
• • Right to rectification (Article 16 GDPR)
• • Right to erasure (Article 17 GDPR)
• • Right to restriction (Article 18 GDPR)
• • Right to data portability (Article 20 GDPR)
• • Right to object (Article 21 GDPR)

8. Data Breach Notification

In the event of a Personal Data breach, the Processor will:

• 8.1 Notify the Controller without undue delay and no later than 48 hours after becoming aware
• 8.2 Provide details of the nature of the breach, categories affected, and likely consequences
• 8.3 Describe measures taken to address the breach and mitigate effects
• 8.4 Cooperate with the Controller in any required notifications to authorities or data subjects

9. Audit Rights

The Processor will make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Such audits shall be conducted with reasonable notice and during normal business hours.

10. Duration and Termination

This DPA shall remain in effect for the duration of the main service agreement. Upon termination:

• • All Personal Data shall be deleted or returned within 30 days at Controller's request
• • Processor shall certify deletion in writing upon request
• • Provisions relating to confidentiality and liability shall survive termination