Legal

Data Processing Addendum

Effective date: September 11, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service or another agreement governing access to bemyguest (the "Agreement") between:

the customer that creates or manages accommodation guides through bemyguest ("Customer", "Controller", "you", or "your"); and
MANDARINO, obrt za informatičke usluge, vl. Giorgio Nikolov, an obrt (a Croatian sole proprietorship / registered trade business) established in Croatia, with its registered address at Ulica Giuseppea Tartinija - Via Giuseppe Tartini 12, 52210 Rovinj-Rovigno, Croatia and registration number MBO (matični broj obrta) 99365219 ("bemyguest", "Processor", "we", "us", or "our").

This DPA applies when bemyguest processes Personal Data on behalf of the Customer in connection with the Service.

By accepting the Agreement, creating an account, or continuing to use the Service after this DPA becomes effective, the Customer enters into this DPA on behalf of itself and any organisation it is authorised to represent.

1. Definitions

For this DPA:

Applicable Data Protection Law means privacy and data-protection laws that apply to the processing under this DPA, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and applicable national implementing laws.
Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach, and Supervisory Authority have the meanings given by Applicable Data Protection Law.
Customer Data means Personal Data processed by bemyguest on the Customer's behalf through the Service.
GDPR means Regulation (EU) 2016/679.
Service means the bemyguest website, account area, digital guest guides, AI-assisted features, guest assistant, and related services covered by the Agreement.
Subprocessor means a third party engaged by bemyguest to process Customer Data on behalf of the Customer.
UK GDPR means the GDPR as incorporated into United Kingdom law.

Terms not defined in this DPA have the meanings given in the Agreement.

2. Roles and scope

2.1 Customer as Controller

The Customer determines the purposes and essential means of processing Customer Data submitted to the Service. The Customer normally acts as Controller for Personal Data relating to:

guests and prospective guests;
people travelling with a guest;
employees, contractors, and authorised account users;
property contacts and service providers whose details the Customer adds to a guide.

2.2 bemyguest as Processor

bemyguest processes Customer Data only on behalf of the Customer and according to documented instructions, except where law requires different processing.

2.3 Independent-controller activities

This DPA does not apply where bemyguest acts as an independent Controller for its own purposes, including:

account creation and administration;
subscription and transaction records received from Paddle;
fraud prevention and service security;
product analytics selected and controlled by bemyguest;
support records;
legal compliance;
establishing, exercising, or defending legal claims.

Those activities are described in the bemyguest Privacy Policy.

2.4 Customer responsibility

The Customer is responsible for:

complying with Applicable Data Protection Law;
having a valid lawful basis for processing Customer Data;
providing required privacy information to Data Subjects;
ensuring Customer Data is accurate, relevant, and limited to what is necessary;
responding to Data Subject requests as Controller;
using guide links, access controls, and deletion tools appropriately;
ensuring its instructions do not violate Applicable Data Protection Law.

3. Processing instructions

3.1 Documented instructions

The Customer instructs bemyguest to process Customer Data as necessary to:

provide, maintain, secure, and support the Service;
create, store, personalise, and display digital guest guides;
generate and manage guest-specific links;
deliver arrival, stay, local-guide, and checkout content;
provide AI-assisted drafting and guest-assistant features selected by the Customer;
prevent abuse and investigate security incidents;
delete, export, or return Customer Data as described in the Agreement and this DPA;
comply with other documented instructions submitted through authorised product settings, support requests, or written communications.

The Agreement, this DPA, the Customer's use of product settings, and documented support instructions together constitute the Customer's instructions.

3.2 Unlawful instructions

If bemyguest believes an instruction violates Applicable Data Protection Law, it will notify the Customer unless prohibited by law. bemyguest may suspend the affected processing until the parties resolve the issue.

3.3 Processing required by law

If law requires bemyguest to process Customer Data outside the Customer's instructions, bemyguest will notify the Customer before processing unless the law prohibits that notice.

4. Details of processing

The subject matter, duration, nature, purpose, Data Subjects, and categories of Personal Data are described in Annex 1.

5. Confidentiality

bemyguest will ensure that people authorised to process Customer Data:

are bound by confidentiality obligations;
access Customer Data only where necessary for their role;
receive appropriate privacy and security guidance;
process Customer Data only according to this DPA and the Customer's documented instructions.

Confidentiality obligations survive the end of employment, engagement, or this DPA.

6. Security

6.1 Security measures

bemyguest will implement and maintain appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

The current measures are described in Annex 2.

6.2 Risk-based approach

Security measures will take account of:

the nature, scope, context, and purposes of processing;
the sensitivity of Customer Data;
the likelihood and severity of risks to Data Subjects;
current technology and implementation costs.

6.3 Customer security responsibilities

The Customer is responsible for:

protecting account credentials;
restricting account access to authorised people;
promptly removing access for people who no longer need it;
securing devices and communication channels;
deciding whether guest-specific links should expire or be regenerated;
avoiding unnecessary sensitive data;
changing temporary door, keybox, or access codes when appropriate;
not using a standard guest link as a substitute for a high-security credential system.

7. Personal Data Breaches

7.1 Notice

bemyguest will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data.

Target notification period: within 48 hours after becoming aware

A target period does not delay notice where earlier notice is reasonably possible.

7.2 Information provided

To the extent available, the notice will describe:

the nature of the breach;
the categories and approximate number of affected Data Subjects;
the categories and approximate volume of affected records;
likely consequences;
measures taken or proposed to address the breach;
a contact point for further information.

Information may be provided in phases where it is not available at the same time.

7.3 Cooperation

bemyguest will take reasonable steps to contain, investigate, and remediate the breach and will reasonably assist the Customer with legally required notifications.

The Customer remains responsible for deciding whether to notify a Supervisory Authority or Data Subjects.

8. Subprocessors

8.1 General authorisation

The Customer gives bemyguest general written authorisation to engage Subprocessors needed to provide the Service, subject to this section.

8.2 Current Subprocessors

The current Subprocessors and processing locations are listed in Annex 3 of this DPA.

8.3 Subprocessor obligations

bemyguest will enter into a written agreement with each Subprocessor that imposes data-protection obligations no less protective than the relevant obligations in this DPA.

bemyguest remains responsible for each Subprocessor's compliance with those obligations to the extent required by Applicable Data Protection Law.

8.4 Notice of changes

bemyguest will provide at least 30 days advance notice before adding or replacing a Subprocessor that will process Customer Data, except where an urgent change is reasonably necessary for security, continuity, or legal compliance.

Notice may be provided by email, account notification, or an update subscription available through the Subprocessor page.

8.5 Objection

The Customer may object to a new Subprocessor on reasonable data-protection grounds by contacting hello@bemyguest.link within 15 days after notice.

The parties will work in good faith to resolve the objection. If no reasonable alternative is available, bemyguest may:

avoid using the Subprocessor for the Customer where technically and commercially reasonable;
offer a reasonable alternative;
allow the Customer to terminate the affected Service without penalty before the Subprocessor begins processing.

9. International transfers

9.1 Transfer safeguards

bemyguest will not transfer Customer Data to a country outside the European Economic Area, the United Kingdom, Switzerland, or another protected jurisdiction unless an appropriate legal mechanism applies.

Possible mechanisms include:

an adequacy decision;
the European Commission Standard Contractual Clauses;
the UK International Data Transfer Agreement or UK Addendum;
another mechanism permitted by Applicable Data Protection Law.

9.2 EU Standard Contractual Clauses

Where Customer Data protected by the GDPR is transferred to a recipient in a country not recognised as providing adequate protection and no other valid safeguard applies, the parties will apply the relevant modules of the European Commission Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914.

The applicable module, selections, annex details, competent Supervisory Authority, governing law, and forum will be completed according to the parties' roles and the actual transfer.

9.3 UK and Swiss transfers

Where the UK GDPR applies, the parties will use the current UK transfer mechanism where required.

Where Swiss data-protection law applies, the relevant transfer clauses will be adapted as required to protect Swiss Personal Data.

9.4 Hosting locations

Current primary processing and hosting regions: Supabase (database, authentication, storage) is hosted in the EU West region (Ireland). Vercel (hosting and delivery) operates a global edge network with primary regions in the EU and US.

10. Data Subject requests

10.1 Requests received by bemyguest

If bemyguest receives a request from a Data Subject relating to Customer Data, it will:

notify the Customer where legally permitted;
not respond on the Customer's behalf unless instructed or legally required;
direct the Data Subject to the Customer where appropriate.

10.2 Assistance

Taking into account the nature of processing, bemyguest will provide reasonable assistance through product features or support so the Customer can respond to requests for:

access;
correction;
deletion;
restriction;
objection;
portability;
withdrawal of consent, where applicable.

The Customer is responsible for verifying the requester's identity, determining whether a right applies, and providing legally required responses.

11. Assistance with compliance

Taking into account the nature of processing and information available to it, bemyguest will reasonably assist the Customer with:

security obligations;
breach assessment and notification;
data-protection impact assessments;
prior consultation with Supervisory Authorities;
records and information reasonably needed to demonstrate compliance.

The Customer remains responsible for determining whether a data-protection impact assessment or prior consultation is legally required.

12. Audit and compliance information

12.1 Information

bemyguest will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the GDPR.

This may include:

security summaries;
policies and procedures;
independent certifications or audit reports, if available;
Subprocessor information;
written responses to reasonable compliance questionnaires.

12.2 Audits

If the available information is not reasonably sufficient, the Customer may request an audit no more than once per 12-month period, unless:

a Personal Data Breach has occurred;
a Supervisory Authority requires an audit;
there is a reasonable basis to suspect material non-compliance.

Audits must:

be conducted during normal business hours;
provide reasonable advance notice;
avoid disrupting operations;
protect other customers' information;
be performed by the Customer or an independent auditor bound by confidentiality;
be limited to systems and records relevant to Customer Data.

The Customer bears reasonable audit costs unless the audit identifies a material breach by bemyguest.

13. Return and deletion

13.1 During the subscription

The Customer may delete Customer Data using available product functionality or request assistance through hello@bemyguest.link.

13.2 After termination

After the Agreement ends, bemyguest will delete or return Customer Data according to the Customer's choice, unless law requires retention.

Default active-system deletion period:

within 30 days after termination

Backup deletion period:

within 90 days after deletion from active systems

13.3 Exceptions

bemyguest may retain limited data where necessary to:

comply with law;
resolve disputes;
prevent fraud or abuse;
maintain security records;
establish, exercise, or defend legal claims.

Any retained Customer Data remains protected by this DPA and will not be used for unrelated purposes.

14. Sensitive and high-risk data

The Service is not designed for large-scale processing of:

health information;
biometric identifiers;
government identification numbers;
payment-card details;
criminal-offence data;
precise location tracking;
data revealing race, ethnicity, political opinions, religion, trade-union membership, genetics, sex life, or sexual orientation.

The Customer must not submit such data unless the feature expressly supports it, the processing is necessary and lawful, and the parties have agreed appropriate additional safeguards in writing.

Property access codes and exact stay dates may create elevated security or privacy risks even where they are not legally classified as special-category data. The Customer must use them carefully and remove or rotate them when no longer needed.

15. AI-assisted processing

Where the Customer enables AI-assisted features, Customer Data may be sent to an approved AI Subprocessor to:

draft guide content;
organise existing information;
suggest local places;
answer guest questions using guide content.

The Customer instructs this processing by enabling and using the relevant feature.

The Customer must:

review AI output before publication where human review is available;
avoid submitting unnecessary Personal Data;
avoid submitting permanent credentials or highly sensitive information;
ensure use of AI features is lawful and appropriately disclosed.

AI interaction retention and account visibility:

Guest-assistant conversations are stored to maintain conversation history within a session. Accommodation operators do not currently have a dashboard feature to view guest chat transcripts. These logs are not yet subject to a fixed deletion schedule.

Customer Data will not be used to train general-purpose third-party AI models unless the Customer is clearly informed and a valid legal basis and contractual permission exist.

16. Legal requests

If bemyguest receives a legally binding request from a public authority for Customer Data, it will, where legally permitted:

notify the Customer;
assess the request for validity and scope;
disclose only the data legally required;
document the request and response;
challenge unlawful or disproportionate requests where there are reasonable grounds to do so.

17. Liability

Liability arising from this DPA is subject to the liability provisions in the Agreement, except where Applicable Data Protection Law prohibits or limits that allocation.

Nothing in this DPA excludes liability that cannot lawfully be excluded.

18. Duration and termination

This DPA begins when the Customer accepts the Agreement or first submits Customer Data to the Service.

It remains in effect for as long as bemyguest processes Customer Data on the Customer's behalf.

Obligations concerning confidentiality, security, deletion, audit records, and international-transfer safeguards survive termination for as long as relevant Customer Data remains in processing.

19. Order of precedence

If there is a conflict concerning processing of Customer Data, the following order applies:

applicable mandatory data-protection law;
any applicable Standard Contractual Clauses or mandatory transfer terms;
this DPA;
the Agreement;
other documentation.

20. Changes to this DPA

bemyguest may update this DPA where reasonably necessary to reflect changes in law, regulatory guidance, the Service, Subprocessors, or security controls.

bemyguest will provide reasonable advance notice of a material change that reduces the Customer's data-protection rights.

21. Contact

Processor: MANDARINO, obrt za informatičke usluge, vl. Giorgio Nikolov
Registered address: Ulica Giuseppea Tartinija - Via Giuseppe Tartini 12, 52210 Rovinj-Rovigno, Croatia
Country: Croatia
Privacy contact: hello@bemyguest.link
Legal contact: hello@bemyguest.link

Annex 1: Processing details

A. Subject matter

Processing of Customer Data to provide digital accommodation guides and related functionality through bemyguest.

B. Duration

For the term of the Agreement and any limited retention period described in this DPA, the Privacy Policy, or applicable law.

C. Nature of processing

Processing may include collection, recording, organisation, storage, retrieval, consultation, personalisation, display, transmission to authorised guide recipients, AI-assisted analysis and generation, support, security monitoring, correction, export, restriction, and deletion.

D. Purposes

create and manage accommodation guides;
personalise guest links;
provide arrival, stay, local, and departure information;
display property and contact information selected by the Customer;
reduce repeated guest questions;
support review prompts and optional services;
provide AI-assisted setup and guest responses;
secure and maintain the Service;
provide customer support.

E. Categories of Data Subjects

guests and prospective guests;
people travelling with a guest where the Customer includes their information;
Customer employees, contractors, and authorised users;
property owners, managers, and contacts;
local service providers or emergency contacts whose details are included by the Customer.

F. Categories of Personal Data

Guest data

first and last name;
arrival and departure dates;
personalised welcome message;
language or preferences;
email address or phone number, if entered by the Customer;
guide identifier and access information;
assistant questions and interactions, if enabled;
browser, device, IP address, and guide-usage logs.

Customer and property-contact data processed on behalf of the Customer

name;
profile image;
telephone number;
email address;
role or relationship to the property;
property address and location;
property photographs that include identifiable people;
arrival and access instructions;
Wi-Fi details;
door, keybox, or access codes;
recommendations and personal notes;
optional-service contact details.

G. Special categories

No special-category data is intentionally required. Incidental processing may occur if a Customer or guest voluntarily includes such data. The Customer instructs users not to submit unnecessary sensitive data.

H. Frequency

Continuous or occasional, depending on account and guide usage.

Annex 2: Technical and organisational measures

The following measures describe the intended baseline. Update them to match the production environment before publication.

1. Access control

unique user accounts;
role-based access where supported;
least-privilege administrative access;
multi-factor authentication for privileged accounts where available;
prompt removal of access when no longer required;
periodic review of privileged access.

2. Authentication and credentials

managed authentication provider;
password hashing where passwords are used;
secure session management;
protection against common authentication attacks;
no storage of full payment-card credentials by bemyguest.

3. Encryption

encryption in transit using current TLS standards;
encryption at rest where supported by infrastructure providers;
protected secrets and environment variables;
restricted access to encryption keys and service credentials.

4. Application and infrastructure security

managed cloud infrastructure;
production and development environment separation where practicable;
dependency and security updates;
logging of relevant security events;
protection against common web vulnerabilities;
secure configuration and secret management;
backups and recovery procedures.

5. Data minimisation and retention

collection limited to data needed for product functionality;
optional guest personalisation;
instructions discouraging sensitive data;
deletion and account-management controls;
retention periods defined by category.

6. Guest-link safeguards

unique or difficult-to-guess guide identifiers;
ability to regenerate or disable links where implemented;
optional expiry or access control where implemented;
warnings concerning access codes and personal information;
minimisation of guest-specific content.

Current guest-link controls:

Guide links use long, random, unguessable identifiers. There is currently no feature to expire, regenerate, or revoke a link.

7. Security contact

Security issues may be reported to:

hello@bemyguest.link

Annex 3: Approved Subprocessors

Replace this table with confirmed production providers before publication.

Subprocessor	Purpose	Data categories	Processing location	Transfer mechanism
Supabase, Inc.	Database, authentication, storage, and backend services	Account, property, guide, guest, and usage data	EU West (Ireland)	Within the EEA — no additional transfer mechanism required
Vercel Inc.	Hosting, delivery, server functions, logs, and analytics	Website requests, account data, and guide data	Global edge network (primarily EU and US)	Standard Contractual Clauses, per Vercel's Data Processing Addendum
OpenAI, L.L.C. or applicable OpenAI entity	AI-assisted drafting and guest-assistant processing	Prompts, selected guide content, and generated responses	United States	Standard Contractual Clauses, per OpenAI's Data Processing Addendum
Resend	Transactional and account email	Name, email address, message, and delivery metadata	United States	Standard Contractual Clauses, per Resend's Data Processing Addendum

We do not currently use a dedicated error-monitoring provider or a separate analytics provider beyond Vercel Analytics (covered by the Vercel row above).

Paddle acts as Merchant of Record and normally processes payment information as an independent controller for its own payment, tax, fraud, and compliance purposes. Paddle should not be listed as a Subprocessor for Customer Data unless the actual integration causes it to process Customer Data solely on behalf of bemyguest.