Data Processing Agreement

1. Scope and roles

This agreement applies whenever we process personal data on your behalf as part of providing the service, and it is incorporated into our Terms of Service.

Category	Controller	Processor
Guest and reservation data	You	Us
Your staff account records and security logs	Us	—

The second row is unusual to state and it is the honest position: we decide the retention, the security controls and the audit trail for logins, because those are ours to be responsible for. That processing is described in our Privacy Policy. Everything else in this document concerns the first row.

2. Subject matter, duration and purpose

• Subject matter: providing the Revio products your property subscribes to.
• Duration: for as long as your subscription lasts, plus the 30-day retention window described in section 10.
• Purpose: selling, recording and operating stays at your property. Nothing else.

Categories of data subject

• Your guests, and the people who book on their behalf.
• People who enquire through your booking page without completing a booking.

Categories of personal data

• Identity and contact details — name, email, telephone, address, nationality where you collect it.
• Stay data — dates, room, rate, source, requests and preferences, notes your staff record.
• Financial data — charges, taxes, invoices, payment method labels, and a payment token with the last four digits of a card. We never store a card number.
• Correspondence — the confirmations and messages sent about a booking.

Special category data

The products are not designed to hold special category data and we ask you not to put it in. If your staff record something in a free-text note that amounts to it — an accessibility need, a dietary requirement implying belief — you remain the controller of that choice, and we treat it with the same protections as everything else.

3. Our obligations

• We process personal data only on your documented instructions. Your use of the product is the instruction; anything beyond it needs to be agreed in writing.
• We tell you if we think an instruction breaches the GDPR, and we do not simply carry it out.
• We do not sell your data, share it for anyone else’s marketing, or use it to train machine-learning models.
• Everyone with access is bound by confidentiality, and access is limited to the people who need it to support you.
• If a law requires us to disclose your data, we tell you first unless the law forbids it.

4. Security measures

We apply, at minimum:

• Tenant isolation enforced by the database. Every row carries its owner and PostgreSQL Row-Level Security refuses to return another customer’s rows. Every application connects with a restricted role that cannot bypass the policy or alter the schema — so an application bug cannot expose your data.
• Encryption in transit for all connections, and encrypted backups at rest.
• No card data. Card details pass from the guest’s browser to our payment provider and never reach our servers.
• Credentials. Passwords are hashed and not recoverable by anyone here. Integration credentials are encrypted at rest and are never exposed to a hotel account.
• Access control. Individual logins, role-scoped permissions, sessions revocable on demand across every product, and a password change that ends all other sessions immediately.
• Resilience. Nightly encrypted backups with a restore procedure that has been executed and timed, not merely written down.
• Segregation. Our own operator console runs as a separate application on separate credentials, and hotel accounts cannot reach it.

These are the measures in place today, described honestly on our security page, including what we do not yet have.

5. Sub-processors

You give general authorisation for us to use sub-processors. The current list is maintained at /subprocessors:

• Railway — Application hosting, the Postgres database and object storage for uploaded images · European Union
• Channex.io — Connectivity to Booking.com, Expedia and other channels · European Union / United Kingdom
• Stripe — Card guarantees on direct bookings, and card payments where a property enables them · Ireland / United States (EU Standard Contractual Clauses)
• Resend — Transactional email — booking confirmations, invitations, password resets · United States (EU Standard Contractual Clauses)
• Google Analytics 4 — Anonymous traffic analytics on this marketing website only · United States (EU Standard Contractual Clauses)

We impose data protection terms on each of them at least as strict as these, and we remain fully liable to you for what they do. We give you 30 days’ notice by email before adding or replacing one. If you reasonably object, tell us within those 30 days and we will work it out with you; if we cannot, you may cancel without penalty and we will refund any prepaid, unused fees.

6. International transfers

The platform runs in the European Union. Where a sub-processor operates outside the EEA, the transfer relies on the European Commission’s Standard Contractual Clauses together with appropriate supplementary measures. The sub-processor page identifies which ones those are.

7. Helping you meet your obligations

• Data subject requests. Guests should come to you — you are their controller. The product lets you find, export, correct and erase a guest record yourself. Where you need us, we help without charge and within a timeframe that lets you meet the statutory deadline.
• Impact assessments. We give you the information you reasonably need for a DPIA or a consultation with a supervisory authority.

8. Personal data breaches

9. Audit

You may audit our compliance with this agreement once a year, and additionally after a breach affecting you. In practice this normally means we answer your security questionnaire in writing and walk you through the platform on a call — which we do for free. An on-site or third-party audit is available on reasonable notice, at your cost, subject to confidentiality and to not disrupting other customers.

10. Return and deletion

• You can export your data at any time during the subscription, without asking us.
• After termination we keep it for 30 days so you can export it or change your mind, then delete it from live systems.
• Backups age out on their own rolling schedule, after which it is gone from those too.
• Ask us within the window and we will delete it sooner, or produce a full export first.

11. Liability and precedence

Liability under this agreement is subject to the limits in our Terms of Service. Where this agreement and the Terms conflict on the protection of personal data, this agreement wins.

12. Signing it

This agreement takes effect automatically with your subscription — you do not need to request it. If your lawyer wants a countersigned copy, or wants to negotiate a clause, email legal@reviosoft.app and we will send one. We would rather have that conversation than have you sign something you have not read.

WEBER BG EOOD, 6 Preslav St, Ruse 7000, Bulgaria.