Data Processing Agreement

Under Art. 28 of Regulation (EU) 2016/679 (GDPR) · Last updated: 18 October 2026

1. Parties

The Customer who signs up to SDSHotel is the controller of the personal data it enters in the Software. Thomas Fait, [INDIRIZZO], VAT no. [P.IVA], is the processor. The agreement is accepted at sign-up together with the Terms of sale and lasts as long as the contract.

2. Subject and purpose

The processor processes the data only to provide the Software to the Customer: storing it, showing it to the users authorised by the Customer, backing it up, providing support. It does not use it for other purposes and does not disclose it to third parties except as provided in this agreement.

3. Data and data subjects

• Data subjects: the Customer's employees and contractors who use the Software; the property's guests and their companions.
• Data: users' names and emails; guests' personal details (first and last name, sex, date and place of birth, citizenship, residence), identity document details for the communication to the police (Alloggiati Web), email and phone; bookings, stays, charges and payments; data for the tourist tax and ISTAT statistics.
• The Software is not designed for special categories of data (health, etc.): the Customer undertakes not to enter them.

4. Processor's obligations

• It processes the data only on the Customer's documented instructions: these terms and the use of the Software count as instructions.
• It ensures that anyone accessing the data is bound by confidentiality.
• It takes appropriate security measures (Art. 32): encrypted HTTPS connection, passwords stored only in hashed form, lock-out after failed sign-in attempts, each company's data kept separate from the others, database backups.
• It helps the Customer answer data subjects' requests and with the obligations of Arts. 32-36.
• It informs the Customer without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach.
• It makes available the information needed to demonstrate compliance with this agreement and allows reasonable audits, with notice.

5. Sub-processors

The Customer authorises the processor to use the hosting provider (servers and database, with servers in [PAESE DEI SERVER]) and the email provider. The processor imposes equivalent data protection obligations on them and informs the Customer of any change, allowing it to object. If the servers are outside the European Union, the transfer takes place with the GDPR safeguards (adequacy decision or standard contractual clauses).

6. End of processing

On termination of the contract the processor, at the Customer's request made within 30 days, returns the data in a readable format; it then deletes it, including backups when they naturally expire, unless the law requires it to be kept.

7. Contacts

For any request about data processing: [EMAIL DI CONTATTO] · PEC: [PEC].