Data Processing Agreement

Customer is the data controller. StaySynq is the data processor. StaySynq processes personal data only on documented instructions from Customer, except where required by applicable law.

Subject matter: provision of the StaySynq platform.

Duration: the subscription term plus the data retention period set out in the Privacy Policy.

Nature: hosting, storage, processing, and transmission of personal data to operate the platform.

Data subjects:Customer's employees, guests, prospects, and other business contacts.

StaySynq will:

• Process personal data only per Customer's documented instructions.
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organizational measures (Annex II).
• Assist Customer with data subject requests, DPIAs, and authority consultations.
• Notify Customer without undue delay of personal data breaches.
• Delete or return personal data at the end of the subscription term.
• Make available the information necessary to demonstrate compliance and submit to audits.

Customer authorizes StaySynq to engage sub-processors. We maintain a current list at staysynq.com/legal/subprocessors. We will notify Customer at least 30 days before adding a new sub-processor; Customer may object on reasonable data protection grounds.

Where personal data is transferred outside the EEA, UK, or other restricted region, the transfer relies on the European Commission's Standard Contractual Clauses, the UK IDTA, or another approved mechanism, as appropriate.

StaySynq implements the following measures (non-exhaustive): encryption in transit (TLS); role-based access with additional authentication for sensitive actions; audit logging of changes; segregated tenant data; tokenized card payments through PCI-DSS compliant processors; documented incident response; code review before release; physical security at hosting providers.

This DPA takes effect on the start of the subscription term. To request a signed copy or negotiate amendments, email legal@staysynq.com.