Data Processing Agreement for STRYK.

1. Subject matter and roles

The customer is the controller within the meaning of Art. 4 No. 7 GDPR for the personal data that it or its users process in STRYK (“Processed Data”). Nextpulse processes Processed Data as processor.

The subject matter of the processing is the provision, operation, maintenance, backup and support of STRYK under the main contract, including trial contracts.

For its own purposes – contract administration, billing, identity accounts with Nextpulse ID, platform security, abuse prevention and the enforcement of legal claims – Nextpulse acts as an independent controller; these processing activities are described in the Privacy Policy.

2. Duration

This agreement applies for the duration of the main contract, including the transition and retrieval period after the end of the contract, and beyond that for as long as Nextpulse processes Processed Data, until their deletion under clause 14.

3. Nature and purpose of processing

Nature of processing: collection, recording, storage, organisation, adaptation, retrieval, use, transmission to recipients selected by the customer, comparison, restriction, backup, restoration and deletion. The purpose is the provision of the functions used by the customer, in particular:

• hotel management: reservations, rooms, occupancy, housekeeping, guest profiles, invoices, payment status, financial postings, reporting and staff organisation;
• Booking Engine, guest website, online check-in, guest portal and kiosk, including the capture of registration and identity document data, insofar as the customer activates these functions;
• guest communication by e-mail and in further channels, including AI-supported analysis, reply suggestions and automated replies, insofar as activated;
• distribution of availability, prices and reservations via the channel manager, insofar as activated;
• connection of payment, cash register, banking and other systems, insofar as the customer activates them;
• data transfer from legacy systems, error analysis, support and security measures, insofar as required for the service.

4. Data subjects and categories of data

• Guests, accompanying persons, bookers and prospective guests: identity and contact data, stay and booking data, preferences, communication content, invoice and payment status data, registration and guest register data.
• Identity document data: details from travel documents and images of identity documents, insofar as the customer uses the relevant function.
• Employees and users of the customer: name, contact details, role, duty and task assignments, activity and access logs.
• Business contacts, corporate customers, suppliers and partners: master, contact, contract and billing data.
• Special categories of personal data within the meaning of Art. 9 GDPR, such as health information in guest requests, only if the customer decides to record such data and has a legal basis for doing so.
• Not processed are full card numbers, card verification codes and online banking access credentials; payment means are processed by the customer’s payment service provider.

5. Instructions

Nextpulse processes Processed Data only on the customer’s documented instructions, including with regard to transfers to third countries, unless Nextpulse is required to process it by Union law or the law of a Member State; in that case, Nextpulse notifies the customer of those legal requirements before processing, unless the law prohibits such notification.

The main contract, this agreement, and the customer’s configuration and use of the functions constitute the instructions. Individual instructions are given in text form.

If Nextpulse is of the opinion that an instruction infringes data protection provisions, Nextpulse informs the customer without delay and may suspend execution until the instruction is confirmed or amended.

6. Confidentiality

Nextpulse ensures that persons authorised to process Processed Data have committed themselves to confidentiality or are subject to an appropriate statutory duty of confidentiality. Access to Processed Data takes place only insofar as it is required for operation, security or support. Modifying support measures in platform administration are logged with reasons.

7. Security of processing

Nextpulse implements the technical and organisational measures required under Art. 32 GDPR. These are described in clause 17. Nextpulse may adapt the measures to technical progress, provided the level of protection is not reduced.

8. Sub-processors

The customer gives general authorisation for the engagement of the companies named in the list of sub-processors. Nextpulse informs the customer in text form at least 30 days before engaging a new sub-processor or replacing an existing one.

The customer may object to the change in text form within 14 days after receipt of the information, on material data protection grounds. The parties endeavour to find an amicable solution. If this is not achieved, the customer may terminate the affected contract or part thereof as of the time of deployment; prepaid fees for the period thereafter are refunded pro rata.

Where a change is urgently required to avert an acute security or availability risk, Nextpulse informs the customer without delay after the fact; the rights of objection and termination apply accordingly.

Nextpulse imposes on each sub-processor by contract essentially the same data protection obligations as those set out in this agreement, and is liable to the customer for their compliance.

9. Rights of data subjects

Nextpulse supports the Customer with appropriate technical and organisational measures in responding to requests from data subjects, primarily through the functions available in STRYK, in particular for rectification, data export and the erasure or anonymisation of guest profiles. Where these functions are not sufficient for a request, Nextpulse shall, at the Customer’s request, provide the data of the data subject processed on the Customer’s behalf in a common machine-readable format, or erase it, within ten working days. If a data subject contacts Nextpulse directly, Nextpulse shall forward the request to the Customer within five working days and shall not answer it itself unless required by law.

10. Support with security, impact assessments and consultation

Taking into account the nature of the processing and the information available, Nextpulse assists the customer in complying with its obligations under Arts. 32 to 36 GDPR, in particular by providing information for a data protection impact assessment and in prior consultations with the supervisory authority.

Support services going beyond the provision of existing information and functions, and not caused by a breach by Nextpulse, may be charged by Nextpulse at reasonable rates after prior notice.

11. Breaches of the protection of personal data

Nextpulse notifies the customer of a breach of the protection of Processed Data without undue delay and in any event within 48 hours after becoming aware of it. The notification is sent to the contact address stored by the customer.

The notification contains, where available, a description of the nature of the breach, the categories and approximate number of data subjects and data records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information not yet available is provided without undue delay.

The decision on notifications to the supervisory authority and notifications to data subjects is taken by the customer. A notification is not an admission of a breach of duty.

12. Places of processing and third-country transfers

Processed Data is processed primarily in the European Union or the European Economic Area. Individual sub-processors also process data in third countries, in particular in the United States; the list of sub-processors states the location and transfer basis for each provider.

Transfers to third countries take place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision such as the EU-US Data Privacy Framework for certified recipients, or of the European Commission’s standard contractual clauses, including necessary supplementary measures. Where an adequacy decision is relied upon, Nextpulse agrees standard contractual clauses as a supplementary basis, where possible.

13. Evidence and audits

Nextpulse provides the customer with all information necessary to demonstrate compliance with this agreement, in particular a current description of the technical and organisational measures and available evidence from sub-processors.

The customer, or an auditor it engages who is bound to confidentiality and is not a competitor of Nextpulse, may carry out reviews, including inspections. Regular reviews take place at most once a year, with at least 30 days’ prior notice. In the event of a breach of the protection of Processed Data, an order by the supervisory authority, or concrete indications of an infringement, additional reviews are permissible with reasonable prior notice.

Reviews take place during business hours, without disproportionate disruption to operations and while preserving the confidentiality of other customers’ data. The customer bears its own costs; if a review reveals a material breach by Nextpulse, Nextpulse bears the reasonable costs.

14. Return and deletion

During the term of the contract, the customer may retrieve Processed Data through the available export functions. After the end of the contract, Nextpulse keeps the Processed Data available for return during the transition and retrieval period under the B2B SaaS Terms; insofar as access to STRYK no longer exists, Nextpulse provides an export upon request.

After expiry of the retrieval period, Nextpulse deletes the Processed Data without undue delay and at the latest within 90 days, unless Union law or the law of a Member State obliges Nextpulse itself to retain it. Where such an obligation exists, Nextpulse restricts the affected data and processes it only for that purpose. Backups are overwritten in the regular backup cycle, at the latest after 90 days, and until then are no longer used for ongoing operation. Upon request, Nextpulse confirms deletion in text form.

Statutory retention obligations of the customer, for example under the BAO, UGB or the Registration Act (Meldegesetz), rest with the customer, which fulfils them on the basis of the return or exports. Nextpulse does not retain Processed Data for the customer after the end of the contract, unless the customer expressly orders this separately as its own service with a defined duration. Nextpulse’s own contract, billing and evidence data are not Processed Data.

15. Anonymised data

Nextpulse may anonymise Processed Data insofar as this is necessary to provide, secure and improve STRYK, and may use the anonymised data without any inference to natural persons or to the individual customer. Processed Data is not used to train AI models.

16. Precedence and liability

For data protection matters, this agreement prevails over the other contract documents, except for individual provisions that expressly refer to a specific provision of this agreement; a deviation from Art. 28 GDPR to the customer’s detriment is not agreed.

Mandatory liability under the GDPR is not excluded or limited. As between the parties, compensation is governed by Art. 82(5) GDPR; for that purpose and otherwise, the liability provisions of the B2B SaaS Terms apply, including their limitations for slight negligence.

17. Annex: Technical and organisational measures

The following measures describe the current state. They are reviewed regularly and developed further.

• Tenant separation: each customer’s data is marked by tenant; the database enforces separation in addition to the application logic through row level security policies that cannot be bypassed by the application role.
• Access control: user login via Nextpulse ID with OpenID Connect; support for a second factor; sensitive administrative actions in platform administration require a fresh login with a second factor. Device accounts for kiosk functions are restricted to the respective operation.
• Authorisation control: role-based permissions under the need-to-know principle, with server-side checking of every request; unassigned access is refused. Support measures are carried out via platform administration; modifying measures require a reason and are logged.
• Transmission control: access to STRYK over the internet takes place exclusively encrypted with TLS. E-mails are transmitted with transport encryption where the receiving server supports it. Access secrets for connected third-party systems are stored encrypted.
• Encryption at rest: backups are stored encrypted. For particularly sensitive content such as images of identity documents, Nextpulse recommends limiting capture to what is legally required and setting deletion periods.
• Deletion periods: for data from online check-in, including captured identity document data, the customer may set a deletion period in STRYK. It is not activated by default; setting deletion periods is the responsibility of the customer as controller.
• Uploads: uploaded files are checked for malware before processing.
• Input control and logging: logging of security-relevant and operationally relevant events; logs contain no passwords, tokens or access secrets.
• Availability control: daily backups stored encrypted in a storage location separate from production operation; documented recovery procedures; limitation of anonymous queries to protect against overload and abuse.
• Separation control: separation of development, test and production environments; no production access credentials in source code.
• Organisational measures: commitment to confidentiality, restriction of administrative access to authorised persons, procedures for security updates and for handling security incidents.