Nokumo Group Data Processing Agreement (DPA)

1.1 Parties and application. This Data Processing Agreement (DPA) is part of the Agreement under the Terms of Service (the Terms) between the Customer and each Nokumo company that is a party to the Agreement for the Services it supplies (Section 1.1 of the Terms), each as processor for those Services. This DPA is Group wide: it is the same for every Nokumo Group company, and a Group Company that becomes a party under Section 7 of the Terms is bound by it as processor for the Services designated to it, without further signature. It applies automatically, without signature, to all processing of personal data by Nokumo on behalf of the Customer in providing the Services. It satisfies Art 28(3) GDPR. A signed copy can be issued on request but is not needed for the DPA to apply.

1.2 Definitions. GDPR, personal data, controller, processor, processing, personal data breach, data subject, supervisory authority and Standard Contractual Clauses (SCCs) have the meaning in the GDPR and the Commission's SCCs. Customer Personal Data means personal data within Customer Data that Nokumo processes for the Customer. Sub-processor means a processor engaged by Nokumo to process Customer Personal Data. Sub-processor Register means the list in the Legal & Trust Centre at nokumo.net. Other capitalised words have the meaning in the Terms.

2.1 Roles. For Customer Personal Data, the Customer is the controller and Nokumo is the processor. For personal data of the Customer's Authorised Users and contacts that Nokumo uses to run accounts, billing, security and its own legal duties, the Nokumo Group company that decides why and how that data is used is an independent controller, as the Privacy Policy and the Group Company List explain. Where an Authorised User or contact is acting for the Customer, the Customer remains responsible for them as in Section 3.

2.2 Instructions. Nokumo processes Customer Personal Data only on the Customer's documented instructions: the Agreement, the Customer's use of the Services and settings, and written instructions the Customer reasonably gives that fit the Services. This DPA and the Customer's use of the Services are the Customer's complete instructions. If Nokumo believes an instruction breaches data protection law, it tells the Customer promptly and may pause that instruction until it is confirmed or changed. Nokumo may process data where EU or Member State law requires it, and tells the Customer first unless the law forbids it.

2.3 Details of processing. Subject matter, duration, nature, purpose, data types and data subjects are in Annex I.

2.4 AI Features. Where the Customer turns on AI Features, Nokumo processes Customer Personal Data through them only to provide the feature to the Customer, does not use it to train models for other customers, and lists the AI Sub-processors in the Sub-processor Register.

3.1 Lawfulness. The Customer is responsible for the lawfulness of its processing and its instructions, including having a legal basis for Guest Data, giving Guests the information in Arts 13 and 14 GDPR, honouring objections and consents, and recording its own processing as controller.

3.2 The Customer's user list. The Customer is solely responsible for keeping a complete, accurate and current list of the individuals it has given access to the Services (Authorised Users), such as employees and contractors, and for making sure each has access only to the data and functions their role needs. In particular the Customer must: (a) add a person only when there is a need and a lawful basis; (b) remove or deactivate leavers and role changes by the end of the next working day; (c) review the list at least quarterly; (d) use individual accounts and no shared logins, and apply strong authentication where available; (e) tell its Authorised Users how their data is used in the Services and how the Customer's own monitoring or logs may be used; and (f) tell Nokumo within 24 hours if it suspects credentials are compromised or the access list is wrong in a way that could expose personal data.

3.3 Responsibility for users' acts. The Customer is responsible for what its Authorised Users do and for unlawful processing that arises from the Customer's failure to keep the list current or to limit access. Nokumo does not check whether an Authorised User is still employed or entitled, and is entitled to rely on the Customer's list and instructions. This is without prejudice to Nokumo's own duties as processor, including security under Art 32 GDPR.

3.4 Personal data of Authorised Users. The Customer gives its Authorised Users the notice the law requires about Nokumo's processing of their data as an independent controller, by pointing them to the Privacy Policy in the Legal & Trust Centre.

4.1 Confidentiality. Nokumo ensures that persons authorised to process Customer Personal Data are bound by confidentiality duties and process it only on instructions.

4.2 Security. Nokumo implements and maintains the technical and organisational measures in Annex II, appropriate to the risk under Art 32 GDPR, and may update them provided the overall level of protection is not reduced. Nokumo makes no claim of any security certification in this DPA. A certification or audit report is stated only where the Security Overview in the Legal & Trust Centre names it, with scope and reference.

5.1 General authorisation. The Customer gives Nokumo general written authorisation under Art 28(2) GDPR to engage Sub-processors, including Group Companies, listed in the Sub-processor Register at nokumo.net, subject to this Section.

5.2 Register. The Sub-processor Register states for each Sub-processor its name, the service, the data types, the processing location and the transfer mechanism. It is maintained separately from the Terms, so adding or changing a Sub-processor does not require an amendment to the Terms or this DPA.

5.3 Notice of changes. Nokumo gives at least 30 days' notice before a new or replacement Sub-processor starts processing Customer Personal Data, by updating the Sub-processor Register and by email to customers who have subscribed to updates or to the Account Owner. The Customer must keep its contact details current and may subscribe through the Legal & Trust Centre.

5.4 Objection. The Customer may object on reasonable data protection grounds in writing within 14 days of the notice. The parties then discuss in good faith. If the issue is not resolved within 30 days, the Customer may stop using the affected Services by ending them under Section 6.2 of the Terms. The objection and the ending of the Services give no right to a refund of prepaid fees or to a reduction or waiver of fees or of any early-termination amount, and fees remain payable until the Termination Date. This does not limit rights that the law gives the Customer and that cannot be excluded. Nokumo does not need to delay the change for the discussion unless the law requires it.

5.5 Emergency replacement. Where a Sub-processor must be replaced at once for security, legal or continuity reasons, Nokumo may do so and informs the Customer as soon as possible, and the objection right in Section 5.4 then applies afterwards.

5.6 Flow-down and responsibility. Nokumo binds each Sub-processor by contract to data protection duties no less protective than this DPA and remains responsible for their performance of those duties to the Customer.

5.7 Group Companies. A Group Company that is not itself a party to the Agreement may process Customer Personal Data only as a Sub-processor of the Nokumo company that is the processor. It must be listed in the Sub-processor Register with its role and location, be bound under Section 5.6 by a written agreement (including an intra-group agreement) with duties no less protective than this DPA, and be subject to the notice and objection rights in Sections 5.3 and 5.4. The Group Company List does not replace the Sub-processor Register.

6.1 Principle. Nokumo processes Customer Personal Data in the EEA unless the Sub-processor Register states otherwise. Nokumo does not state that data never leaves the EEA, because some Sub-processors may access or process data outside it.

6.2 Mechanisms. Where Customer Personal Data is transferred outside the EEA, Nokumo relies on an adequacy decision (including the EU-US Data Privacy Framework for certified recipients), or on the Standard Contractual Clauses, with supplementary measures where needed. The Sub-processor Register states the mechanism for each. If an adequacy decision is annulled or suspended, Nokumo moves to another mechanism or stops the transfer within a reasonable time.

6.3 SCCs. To the extent the SCCs apply between Nokumo as processor and a non-EEA Sub-processor, Module 3 (processor to processor) applies, completed as in Annex IV. If the Customer is itself subject to a transfer and needs SCCs with Nokumo, Module 2 (controller to processor) applies between them, completed as in Annex IV, and is signed by this DPA's acceptance. These rules apply to a Group Company outside the EEA that acts as a Sub-processor in the same way as to any other Sub-processor.

6.4 Requests from authorities. Nokumo tells the Customer of any binding request from a public authority for Customer Personal Data unless the law forbids it, challenges requests it considers unlawful, and discloses only the minimum required.

Nokumo assists the Customer, through appropriate technical and organisational measures, in answering requests to exercise data subject rights under Arts 12-22 GDPR, to the extent the Customer cannot do so itself through the Services. Nokumo forwards to the Customer any request it receives about Customer Personal Data without answering it, unless the law requires otherwise. Reasonable assistance is free; Nokumo may charge for requests that need substantial extra work, if it says so in advance.

Nokumo notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice gives, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records, likely consequences, measures taken or proposed, and a contact point, and is supplemented as more becomes known. Nokumo takes reasonable steps to contain and remedy the breach. The Customer, as controller, decides whether to notify the supervisory authority (Art 33) and data subjects (Art 34) and does so within its own deadlines. Nokumo's notice is not an admission of fault.

Nokumo, taking into account the nature of the processing and the information available to it, helps the Customer with its duties under Arts 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation). Nokumo keeps the records of processing that Art 30(2) requires of processors.

10.1 Information. Nokumo makes available to the Customer the information needed to show compliance with Art 28, including the Security Overview, relevant policies and, if it holds any, independent audit reports.

10.2 Audits. If that information is not enough, or a supervisory authority requires it, the Customer may, on at least 30 days' written notice and not more than once a year (unless a breach or an authority requires otherwise), audit Nokumo's compliance with this DPA, by itself or through an independent auditor bound by confidentiality. The audit is during business hours, limited to what is relevant and must not disrupt Nokumo's business or expose other customers' data or Nokumo's trade secrets. The Customer pays its own costs and Nokumo's reasonable costs of extra time.

10.3 Sub-processor audits. Where Sub-processors' own audit reports or certifications are available, Nokumo shares them, and audits of Sub-processors are done through Nokumo as far as their contracts allow.

11.1 Export. For 30 days after the Termination Date the Customer can export Customer Personal Data using the self-service export tools and if such tool is not available to them, Customer can submit their claim to Nokumo Support to support@nokumo.net. Nokumo gives reasonable help in a commonly used machine-readable format, in line with Section 4.5 of the Terms and the data portability rules.

11.2 Deletion. Within 30 days after the Termination Date, Nokumo permanently deletes or irreversibly anonymises Customer Personal Data and instructs its Sub-processors to do the same, and confirms deletion on written request. Copies in backups are overwritten in the ordinary backup cycle, which does not exceed 35 days, and are not used for any other purpose in the meantime.

11.3 Retention required by law. Nokumo may keep Customer Personal Data to the extent EU or Member State law requires it, and then only for that purpose and for the period required, and tells the Customer on request what it keeps and why. This does not apply to Nokumo's own records as an independent controller, which the Privacy Policy covers.

Each party's liability under this DPA is subject to the limits and exclusions in Section 9 of the Terms, within what the law allows. That limit applies once across all Nokumo Group companies together, as Section 9.4 of the Terms states. Nothing in this DPA limits a data subject's rights against either party under Art 82 GDPR or a supervisory authority's powers, or liability that cannot be limited by law. Each party bears its own administrative fines. A party that has paid compensation for damage that another party is responsible for under Art 82(5) GDPR may recover that share from it.

13.1 Term. This DPA applies from the date the Agreement starts and for as long as Nokumo processes Customer Personal Data, including during the export and deletion period in Section 11.

13.2 Assignment to a Successor. Section 7 of the Terms applies to this DPA. On a Designation or Transfer, the designated Group Company or Successor takes over this DPA for the Services it supplies and becomes the processor for them, subject to the safeguards in Section 7.10 of the Terms. The Group Company List in the Legal & Trust Centre at nokumo.net names the Group Companies that may act as Service Provider. The Customer, as controller, instructs and agrees in advance that Nokumo may engage each designated Service Provider and any Successor as processor on these terms, and that Nokumo's Group Companies may act as Sub-processors under Section 5 in the meantime. A Change of Control does not change the processor. These provisions do not take away the Customer's rights as controller to give instructions, to object to a new Sub-processor under Section 5.4, or to switch under Section 6.2 of the Terms.

13.3 Changes. Nokumo may update this DPA to follow changes in law, regulator guidance, SCCs or adequacy decisions, or to improve protection, on at least 30 days' notice under Section 11.1 of the Terms. Other changes follow the same section.

14.1 Precedence. If this DPA conflicts with the Terms or the Payments Terms on the processing of personal data, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail. Specific Terms under Section 1.8 of the Terms prevail over this DPA only where that Section allows.

14.2 Law and disputes. Sections 12.1 and 12.2 of the Terms apply, without limiting the SCCs' own governing-law and forum rules and the rights of data subjects and supervisory authorities.

14.3 Language. Section 1.6 of the Terms applies.

Subject matter and purpose: providing the Services to the Customer, including property management, channel management, booking engine, accommodation websites, guest messaging, pricing tools, payment features, AI Features and support.

Nature: hosting, storing, retrieving, organising, transmitting, displaying, analysing, deleting and otherwise processing as the Services require.

Duration: the term of the Agreement plus the export and deletion period in Section 11.

Frequency: continuous.

Data subjects: the Customer's Guests and their companions; the Customer's Authorised Users and staff; contacts of the Customer's suppliers and partners that the Customer enters into the Services.

Types of personal data: identity and contact details; booking, stay and preference data; guest registration data the law requires the Customer to collect (including identity document data where the Customer uses those features); messages and AI conversation content; payment references and status (not full card data, which stay with the Payment Provider); technical and usage data; Authorised User account data.

Special categories: not intended. The Customer must not enter them unless necessary and lawful, and takes responsibility if it does (for example health or dietary information that Guests volunteer in free text).

Instructions and retention: as in Sections 2 and 11.

Nokumo maintains measures appropriate to the risk. The measures below are a minimum and the Security Overview in the Legal & Trust Centre gives the current description. No certification is claimed.

Access control: unique accounts, least privilege, role-based access, multi-factor authentication for staff and administrators, prompt removal of leavers.

Encryption: in transit and at rest for Customer Personal Data in the production environment.

Separation: logical separation of customer data.

Logging and monitoring: logging of access and administrative actions, with alerting and review.

Vulnerability management: regular patching and vulnerability scanning, with independent penetration testing at least yearly.

Backup and recovery: regular backups, restore testing, a business continuity plan, with a backup cycle of 35 days.

Incident response: a documented plan, with the 48-hour customer notice in Section 8.

Personnel: confidentiality commitments, security and data protection training on joining and yearly.

Supplier management: data protection review of Sub-processors before and during use.

Physical security: provided through the hosting providers listed in the Sub-processor Register.

Deletion: secure deletion as set out in Section 11.

The Sub-processor Register is maintained in the Legal & Trust Centre at nokumo.net and is part of this DPA as updated under Section 5. It states for each Sub-processor: name and registered office, service, categories of data, location, transfer mechanism and the date added. Customers can subscribe to change notices there. Each entry states whether the vendor acts as a Sub-processor or as an independent controller. Stripe and other payment providers are listed there with their role.

Where Section 6.3 applies:

Modules: Module 3 for Sub-processors outside the EEA; Module 2 where the Customer needs SCCs with Nokumo.

Clause 7 (docking clause): included.

Clause 9(a): Option 2 (general authorisation), with notice of 30 days as in Section 5.3.

Clause 11(a): optional independent dispute resolution body not included.

Clause 17: Option 1, the law of the Republic of Croatia.

Clause 18: the courts of Croatia.

Annex I.A and I.B: the parties are the Nokumo company that is the processor for the Services (shown in the Account and the Group Company List) and, as the case may be, the Sub-processor (Module 3) or the Customer (Module 2); the details are in Annex I of this DPA.

Annex I.C competent supervisory authority: the Croatian Personal Data Protection Agency (AZOP).

Annex II: Annex II of this DPA.

Annex III: the Sub-processor Register.