Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Principal Agreement") between the hotel ("Customer") and The Something Group Limited, trading as Biteluxe ("Biteluxe"). It sets out how Biteluxe processes personal data on the Customer's behalf, in line with UK GDPR and, where it applies, EU GDPR.

2. Definitions

• Controller: the Customer.
• Processor: Biteluxe.
• Data subject: an individual whose personal data is processed.
• Personal data: any information relating to an identified or identifiable person.

3. Subject matter and duration

This DPA covers the personal data Biteluxe processes for the Customer, and stays in effect for as long as Biteluxe processes it.

4. Nature and purpose of processing

Biteluxe processes personal data to run the guest journeys set out in the Principal Agreement: communications with guests before, during and after their stay, requests and bookings, feedback, and the service messages that relate to the stay.

5. Types of personal data

• Guest names, email addresses and phone numbers.
• Booking details and preferences.
• Feedback and survey responses.

6. Data subjects

The Customer's guests, and people who contact the Customer before booking.

7. The Customer's obligations

• Comply with data protection law.
• Obtain consent from data subjects for marketing messages where the law requires it.
• Give Biteluxe documented instructions for processing, and keep WhatsApp and other messages within the scope of service messages unless guests have opted in to more.

8. Biteluxe's obligations

• Process personal data only on the Customer's documented instructions.
• Make sure everyone with access to personal data is bound by confidentiality.
• Protect personal data with appropriate technical and organisational measures.
• Help the Customer respond to data subject requests.
• Tell the Customer about any personal data breach without undue delay.
• Keep records of processing activities.

9. Messaging: what is sent, on what basis, and how often

Service messages. Biteluxe helps the Customer send WhatsApp, SMS, email, Messenger and web chat messages that relate to the guest's stay. That includes replying to enquiries a guest starts before booking, and sending messages from the point of booking through to departure: check-in details, in-hotel reservations such as restaurant bookings, and other updates the stay needs. Service messages do not need opt-in, because they are sent on the basis of contractual necessity: they are needed to perform the contract, or to take steps the guest asked for before it.

Marketing messages. Any message not directly linked to fulfilling the booking, such as promoting a third party's service, is a marketing message.

A limit on marketing. Marketing messages are sent on the basis of the Customer's legitimate interest. To stay within what guests reasonably expect, no more than two WhatsApp messages that are not purely about the stay may be sent to a guest from the point of booking.

10. Sub-processors

Biteluxe may use sub-processors. When it does, it will make sure they meet the same data protection obligations, get the Customer's prior written consent for any new sub-processor, and remain fully liable for their performance. A current list is available on request.

11. Data subject rights

Biteluxe will help the Customer respond to requests to exercise data protection rights, including access, rectification or erasure, restriction, portability and objection.

12. International transfers

Biteluxe will process or store personal data outside the UK or the European Economic Area only where adequate safeguards are in place, such as the UK International Data Transfer Agreement or Addendum, Standard Contractual Clauses approved by the European Commission, binding corporate rules, or another lawful transfer mechanism. The Customer can ask at any time which transfers take place.

13. Personal data breaches

If there is a personal data breach, Biteluxe will notify the Customer without undue delay, give it enough information to meet its own obligations, and take the steps needed to limit the breach.

14. Return or deletion

When the Principal Agreement ends, Biteluxe will return or delete all personal data, as the Customer chooses, unless the law requires it to keep some.

15. Audits

Biteluxe will allow for and contribute to audits and inspections by the Customer, or an auditor the Customer appoints, to check compliance with this DPA.

16. Liability and indemnity

Each party will indemnify the other against any claim, damage or loss arising from its breach of this DPA.

17. Governing law

This DPA is governed by the laws of the jurisdiction where the Customer's hotel is located, and any dispute will be resolved in the courts of that jurisdiction.

Contact