What this is about
This text summarises for hotels what a data processing agreement with the freestays platform is meant to cover. The operator of the platform is SnapNext GmbH & Co. KG. The platform is pre-launch. There is no signed agreement yet, and this text does not replace one. The allocation of roles is open for legal review.
Roles of hotel and operator
Not every processing operation on the platform is data processing on behalf of a controller. The following split by data flow is planned.
| Data flow | Content | Operator | Hotel |
|---|---|---|---|
| Staff accounts | Email, display name, roles, assignment to a property | Controller | Independent controller for the selection and invitation of its staff |
| Applications and agreements | Creator profile, channels, application, agreement and evidence, as far as the hotel sees them | Controller | Independent controller from receipt of the application |
| Images and logos | Media uploaded by people at the hotel | Processor | Controller |
| Notifications | Delivery log and email delivery | Controller | No role |
As currently assumed, the data processing agreement is to cover only the third data flow, that is, the images and logos the hotel uploads. In the other data flows, the operator is itself the controller under this split. It is planned that the hotel is responsible for creator data from receipt and the operator for accounts and platform operation. A data processing agreement is concluded separately where required.
What the agreement is meant to cover
- Subject matter, nature and purpose of the processing, categories of data and data subjects.
- Processing only on the hotel's documented instructions in text form.
- Confidentiality of the persons with access.
- Technical and organisational measures, with the status of each measure.
- Assistance with data subject requests, with notifications of personal data breaches and with impact assessments.
- Information and audit rights of the hotel.
- Deletion and return at the end of the agreement.
Specific deadlines are set out in the agreement. Currently assumed: assistance with data subject requests within 10 working days, notification of a breach without undue delay and at the latest within 48 hours of becoming aware of it, an audit once a year after 30 days' advance notice.
Changes to sub-processors
The service providers in use are listed on the sub-processors page. A general authorisation of this list is planned. The hotel is to be notified of a change in text form 30 days in advance. The hotel can object for good cause within 14 days. If the parties do not agree, the hotel is to be able to terminate its use of the platform extraordinarily. The same data protection obligations are to be imposed on each service provider by contract. Whether these contracts have already been signed with the active providers is currently being checked.
Deletion and return
After the end of the agreement, the operator is to hand over the data from the images and logos data flow as files, or delete it, at the hotel's choice, within 30 days, and to confirm this in text form. Remaining copies are then deleted, unless a statutory retention obligation applies.
A separate deletion procedure of the platform applies to creator accounts. It exists in the code and has not yet been tested in operation. The retention periods for agreements and logs have not yet been set.
Overview of security measures
The agreement is to list the measures with their status. "Exists in code" means: the measure is set up in the program code or in the database, but has not been checked in operation because there is no production system yet.
| Area | Status |
|---|---|
| Access protection in the database, deny by default | exists in code, partly |
| Sign-in by email link, session cookie not readable by scripts | exists in code |
| Security headers and encrypted transmission in production | exists in code, partly |
| Deletion procedure for data subject requests | exists in code, partly |
| Encryption of data at rest, backup and recovery, alerting | open |
Questions
support@freestays.app answers questions about this text. The contact point for data protection questions will be added before launch.