Data Processing Agreement

1. Roles

The Host decides why and how the personal data of its guests, team and property owners is processed and is the controller. Sostega processes that data only to provide the service and only on the Host's documented instructions, which are these Terms, this DPA and the settings the Host chooses in Sostega. Booking channels (for example Booking.com, Airbnb, Expedia or Vrbo) are independent controllers, not sub-processors of Sostega.

2. Details of processing (Annex 1)

Data subjects

• The Host's guests and the people travelling with them, including minors;
• the Host's team members (for example cleaners and accountants);
• owners of apartments that the Host manages on their behalf.

Categories of data

• Identification data for the legal guest record: names, date and place of birth, citizenship, home address, identity document or passport number, personal identification number (CNP);
• photos of identity documents and signatures made in the guest portal;
• booking data: dates, apartment, channel, number of guests, amounts, booking references;
• contact data: email, phone, messages exchanged with guests;
• invoicing data: billed person or company, address, tax ID;
• team and owner data: names, email, role, reports and photos sent from the app.

Sostega is not designed to process special categories of data (Art. 9 GDPR). Identity document photos are processed only for the legal guest record.

Purpose and duration

Providing Sostega: channel connections, calendar, guest registration and the legal arrival form, invoicing, cleaning, the guest portal and related features, for as long as the Host uses the service. Identity document photos and arrival forms are deleted automatically after the retention periods the Host sets in Sostega.

3. Sostega's obligations

• Process the data only on the Host's documented instructions, including for transfers.
• Tell the Host if an instruction appears to break data protection law, and inform it of any legal requirement to process data otherwise, unless the law forbids this.
• Ensure that everyone authorised to process the data is bound by confidentiality.
• Apply the security measures in Annex 2 and keep them up to date.
• Use sub-processors only under section 5.
• Help the Host answer requests from data subjects (access, correction, deletion, restriction, portability, objection), mainly through features in the app.
• Help the Host with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the information available to Sostega.
• At the end of the service, delete or return the data as described in section 8.
• Make available the information needed to show compliance with Article 28 and allow audits as in section 7.

4. The Host's obligations

• Have a legal basis for the processing and inform its guests, team and owners, including about the use of Sostega.
• Enter only data that is needed and keep it accurate.
• Choose retention periods that match its legal obligations.
• Keep its accounts secure and give each team member only the role they need.

5. Sub-processors

The Host gives Sostega a general authorisation to use sub-processors. The current list is in Annex 3. Sostega will announce any new or replaced sub-processor by email at least 30 days before the change. If the Host objects on reasonable data protection grounds and we cannot find a solution, the Host may end the service without penalty before the change applies.

Sostega imposes on each sub-processor the same data protection obligations as in this DPA and remains responsible to the Host for their performance.

6. Transfers and breaches

Personal data is stored in the European Union. Any transfer outside the EEA takes place only under an adequacy decision of the European Commission or the standard contractual clauses.

Sostega notifies the Host without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the Host's data, with the information available at that time, so the Host can meet its own 72-hour obligation.

7. Information and audits

On request, Sostega provides the information needed to show compliance with this DPA. The Host may carry out an audit, itself or through an independent auditor bound by confidentiality, once a year, with 30 days' notice and at its own cost, or at any time after a personal data breach.

8. End of the service

When the Host stops using Sostega, it can ask for a copy of its data. Sostega deletes the Host's personal data within 30 days after the end of the service, including from active systems, and from backups when they expire, unless the law requires Sostega to keep part of it (for example its own invoices to the Host).

9. General

Liability under this DPA follows the Terms, except where the law does not allow it to be limited. This DPA is governed by Romanian law. If it conflicts with the Terms on personal data, this DPA prevails. Questions: gdpr@sostega.com.

Annex 2 · Security measures

• Data stored on servers in the European Union; all traffic encrypted with TLS.
• Identity numbers, access codes and other sensitive fields encrypted at rest with AES-256-GCM, with the key kept outside the database.
• Every sign-in needs a one-time code sent by email; sessions in secure, http-only cookies.
• Strict separation between hosts; inside a host account, access by role (a cleaner does not see guest documents or invoices).
• Automatic deletion of identity document photos and arrival forms after the Host's retention periods.
• Daily database backups, kept for 14 days.
• An audit log of sensitive actions; access to servers limited to authorised administrators.

Annex 3 · Sub-processors