Data processing agreement
This agreement is between the hotel or lodge that has created a Staywarden account (the “controller”) and Staywarden ApS, CVR 44455854, Dalføret 2, 4. tv., 2300 København S, Denmark (the “processor”). It is entered into when the hotel or lodge accepts Staywarden’s terms, and it applies for as long as the hotel or lodge uses Staywarden. This is a translation of the Danish databehandleraftale; if the two differ, the Danish version applies.
1. Purpose
1.1 This agreement ensures that the processor processes personal data on behalf of the controller in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), in particular Article 28, and the Danish Data Protection Act.
1.2 The agreement covers the personal data that the hotel or lodge and its staff put into Staywarden or let Staywarden receive (for example from booking channels) about the hotel or lodge’s guests, contacts and staff. It does not cover the data Staywarden is itself the controller of (the hotel or lodge’s account, the subscription payment, Staywarden’s own marketing). That is described in Staywarden’s privacy policy.
1.3 Annex A describes the processing, Annex B the sub-processors, and Annex C the controller’s instructions and the security measures.
2. The controller’s rights and obligations
2.1 The controller is responsible for ensuring that the processing complies with the GDPR, including that there is a legal basis for it and that guests receive the information they are entitled to.
2.2 The controller decides the purposes and means of the processing. It does so through the choices the hotel or lodge makes in Staywarden (which features and connections are switched on) and through this agreement.
3. The processor acts on instructions
3.1 The processor processes personal data only on documented instructions from the controller, unless required to do so by EU or Danish law. In that case the processor informs the controller of that requirement before processing, unless the law prohibits it.
3.2 The instructions are set out in Annex C. The hotel or lodge’s use of the panel (for example sending a message, issuing an invoice or connecting a booking channel) is also an instruction.
3.3 If the processor believes an instruction infringes the GDPR or other data protection law, the processor informs the controller immediately.
4. Confidentiality
4.1 Only people who need it to provide the service get access to the data. They are bound by confidentiality.
4.2 The processor regularly reviews who has access and removes access when it is no longer needed.
5. Security
5.1 The processor takes the technical and organisational measures required by Article 32, taking into account the risk to guests’ rights. The measures in place today are set out in Annex C.
6. Sub-processors
6.1 With this agreement, the controller gives general prior authorisation for the processor to use sub-processors. Those in use today are listed in Annex B.
6.2 A sub-processor is bound by the same data protection obligations as in this agreement through a written contract.
6.3 The processor notifies the controller at least 30 days before a new sub-processor is engaged or an existing one is replaced. The controller may object. If the parties cannot agree, the controller may cancel the subscription with effect before the change takes effect.
6.4 The processor remains liable to the controller for the sub-processor’s performance of its obligations.
6.5 Some connections are chosen and contracted by the hotel or lodge itself, for example its own Stripe account for guests’ card payments. That provider is the hotel or lodge’s own supplier, not Staywarden’s sub-processor.
7. Transfers to third countries
7.1 The data is stored in the EU (Railway’s data centre in Amsterdam).
7.2 Some sub-processors are companies outside the EU/EEA or can access the data from there (Annex B). Transfers take place only on a valid basis under Chapter V of the GDPR, for example an adequacy decision (including the EU-U.S. Data Privacy Framework) or the European Commission’s standard contractual clauses.
8. Assistance to the controller
8.1 The processor helps the controller fulfil guests’ rights (access, rectification, erasure, restriction, data portability and objection). Much of this the hotel or lodge can do itself in the panel. Otherwise it writes to hola@staywarden.com.
8.2 If a guest contacts the processor directly about the hotel or lodge’s data, the processor forwards the request to the hotel or lodge and does not answer it itself.
8.3 The processor provides reasonable assistance with data protection impact assessments and prior consultation of the supervisory authority (Articles 35 and 36).
9. Personal data breaches
9.1 The processor notifies the controller without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting the hotel or lodge’s data.
9.2 As far as possible, the notification describes what happened, the categories and approximate number of guests and records concerned, the likely consequences, and what has been done or is proposed. Information not yet known is provided later.
9.3 The processor helps the controller notify the breach to the supervisory authority and inform guests where necessary.
10. Documentation and audits
10.1 The processor makes available the information needed to demonstrate compliance with this agreement. The controller receives a written security statement free of charge once a year.
10.2 The controller, or an independent auditor bound by confidentiality, may carry out an audit with at least 30 days’ written notice. For an on-site audit, the controller bears its own costs and the processor’s reasonable time.
11. Termination and deletion
11.1 When the hotel or lodge closes its account or deletes the hotel or lodge, the processor deletes its data from the live database within 30 days. Before that, the hotel or lodge can export its data from the panel.
11.2 Backups are encrypted and deleted automatically 90 days after they are taken. Data deleted from the live database is therefore gone from the backups no later than 90 days after deletion.
11.3 This does not apply to data the processor is required by law to keep, for example invoices and other accounting records issued in Staywarden. They are kept for as long as the law requires and used for nothing else.
12. Entry into force and changes
12.1 The agreement applies from the hotel or lodge’s acceptance of the terms and for as long as the processor processes data for it.
12.2 Changes to Annex B follow clause 6.3. Other changes are announced at least 30 days in advance.
12.3 If this agreement and Staywarden’s terms conflict, this agreement prevails as regards the processing of personal data.
12.4 The agreement is governed by Danish law.
Annex A — The processing
Purpose: to provide Staywarden to the hotel or lodge. This covers the calendar and bookings, booking page and website, guest page, messages with guests (email, WhatsApp, booking channels), payments, invoices, tasks and staff, tours, marketing to guests who have given consent, and The Warden (AI assistant).
Nature of the processing: storage, display, search, sending and receiving messages, synchronisation with booking channels, calculations (prices, occupancy, money), translation and reply drafts with AI, deletion.
Categories of data subjects: the hotel or lodge’s guests and their travel companions, contacts at agencies and partners, guides and suppliers, the hotel or lodge’s staff.
Guests: name, email, phone number, country, language, dates of stay, room, number of people, amount and payment status, messages, requests and notes written by the hotel or lodge, and newsletter sign-up. If the hotel or lodge switches on guest registration: ID document (name and passport or ID card number). If the hotel or lodge sells tours that need a park permit: each traveller’s name, nationality and passport number.
Agencies and partners: contact details and what the agency enters on its link (the guest’s name, dates, number of people, the agency’s reference and note).
Staff: name, role, email, a profile photo if they add one, messages in the team chat, and working hours and hourly pay if the hotel or lodge uses timesheets.
Card details are not processed by Staywarden. They go directly to the hotel or lodge’s payment provider.
Special categories of data (Article 9) must not be put into Staywarden. If a guest writes such data in a message, it is processed only as part of that message.
Duration: for as long as the hotel or lodge uses Staywarden, and afterwards as in clause 11.
Annex B — Sub-processors
Railway Corporation (USA). Servers, database and the encrypted backups. The backup storage is run by Railway’s supplier Tigris. Where: data centre in Amsterdam (EU); Railway is a US company. Basis: EU-U.S. Data Privacy Framework (certified since March 15, 2024) and standard contractual clauses in Railway’s data processing agreement.
Resend (Plus Five Five, Inc., USA). Sends emails to guests and staff. Where: USA. Basis: EU-U.S. Data Privacy Framework and standard contractual clauses in Resend’s data processing agreement.
Anthropic (Anthropic Ireland, Limited for customers in the EU). The Warden and the AI features: reply drafts for guest messages, translation of website texts, and reading receipts and files the hotel or lodge gives it. Where: stored in the USA. Basis: standard contractual clauses (modules 2 and 3) in Anthropic’s data processing agreement.
Cloudflare, Inc. (USA). Only if the hotel or lodge forwards its email to Staywarden’s inbox: receives emails and passes them to Staywarden. Where: Cloudflare’s global network. Basis: EU-U.S. Data Privacy Framework and standard contractual clauses in Cloudflare’s data processing agreement.
Channex.io LTD (England). Only if the hotel or lodge switches it on: booking channels (names, dates and amounts on bookings). Where: EU (AWS and DigitalOcean). Basis: the European Commission’s adequacy decision for the United Kingdom (valid until December 27, 2031).
Meta Platforms Ireland. Only if the hotel or lodge switches it on: WhatsApp messages. Where: Ireland (EU). Basis: not needed within the EU; Meta may transfer onward under its own terms.
Google LLC (USA). Only if staff switch on notifications: notifications on Android and in the browser (Firebase Cloud Messaging). Where: Google’s global network. Basis: EU-U.S. Data Privacy Framework; standard contractual clauses as a fallback in Firebase’s data processing terms.
Apple Inc. (USA). Only if staff switch on notifications: notifications on iPhone and in Safari (Apple Push Notification service). Where: not stated. Basis: not yet settled. Apple offers no data processing terms for notifications and is not on the Data Privacy Framework list.
Not sub-processors: the hotel or lodge’s own Stripe account (its own supplier, clause 6.5) and Revolut, which handles the hotel or lodge’s payment of its subscription to Staywarden. There Staywarden is itself the controller.
Annex C — Instructions and security
Instructions: The processor processes the data to provide the features the hotel or lodge uses in Staywarden, as described in Annex A, and otherwise according to the hotel or lodge’s actions in the panel. The data is not used for the processor’s own purposes and is not sold. Under its terms for business customers, the AI provider may not use it to train its models (Anthropic, Commercial Terms section B, in force from June 17, 2025).
Security today: Data is stored in the EU (Amsterdam), and all traffic is encrypted (HTTPS/TLS).
Passwords and session keys are stored only as hashes. Keys for third parties the hotel or lodge connects are stored encrypted.
Access is controlled by roles. The owner decides who on the team sees what, and can let others manage the team. No one can give more access than they have themselves. An accountant can be given read-only access.
Backups are taken every night and encrypted (AES-256-GCM) before they are stored. They are kept in storage in the EU (Amsterdam), each copy is downloaded again and opened as a check, and they are deleted automatically after 90 days.
Each hotel or lodge’s data is tied to that hotel or lodge, and only its own users get access to it.
Only the people at Staywarden who run the service have access to production.
