Data Processing Agreement

Last updated 10 August 2026

1. Parties, and how this applies

This Data Processing Agreement ("DPA") is between Rockenue Tech sp. z o.o., registered seat in Kraków, ul. Józefa Chełmońskiego 118/4, 31-348 Kraków, Poland, KRS 0001246600, NIP 9452331438 ("Processor", "we"), and the hotel or hotel operator using the Rockenue Tech booking platform ("Controller", "you").

It is incorporated into and forms part of the services agreement between us. It takes effect when you begin using the platform and continues for as long as we process personal data on your behalf. Where it conflicts with any other term of our agreement on the subject of data protection, this DPA prevails.

"GDPR" means Regulation (EU) 2016/679 and, where it applies to you, the UK GDPR and Data Protection Act 2018. Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the GDPR.

2. Who is responsible for what

You are the controller. The guests are your guests, the booking is with you, and you decide why and how their data is processed.

We are your processor. We process guest personal data only to run the booking service you have engaged us to run, and only on your documented instructions.

Your instructions are: this DPA, our services agreement, the configuration you set in the administration tool, and anything else you tell us in writing. If we believe an instruction breaches data protection law, we will tell you and may pause that processing.

Two things are outside this DPA and worth stating plainly. First, your property management system — Cloudbeds, Mews or another — is your system, which you contract with directly; we write reservations into it on your instruction, but it is not our sub-processor. Second, for card payments Stripe acts as an independent controller under its own terms with you, since you are the merchant of record; card data is collected by Stripe, not by us.

3. What we process, and why

Subject matter: providing your branded booking website, taking reservations, sending guest correspondence, and writing the reservation into your property management system.

Duration: for as long as our services agreement is in force, plus the wind-down period in clause 10.

Nature of the processing: collection, storage, organisation, retrieval, transmission to your property management system and to the guest, and deletion.

The categories of data subject and personal data are set out in Annex I.

4. Confidentiality

We keep guest personal data confidential. Access is limited to the people who need it to deliver or support the service, each of whom is bound by a duty of confidentiality and has been made aware of the obligations in this DPA. We do not use guest data for our own purposes, we do not sell it, and we do not use it to market to your guests.

5. Security

We implement appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the cost of implementation, and the risk to the people concerned. Those measures are described in Annex II. We may change them, but not in a way that materially reduces the level of protection.

6. Sub-processors

You give us general authorisation to engage sub-processors. The sub-processors we currently use are listed in Annex III, which is published on this page.

Before adding or replacing a sub-processor we will update Annex III and notify you at least thirty (30) days in advance. You may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, you may terminate the affected part of the service without penalty.

We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

7. International transfers

Guest personal data is stored in the European Economic Area. Where a sub-processor listed in Annex III processes data outside the EEA, that transfer is made under the European Commission's Standard Contractual Clauses, and where applicable in reliance on the provider's certification under the EU–US Data Privacy Framework, together with any supplementary measures required. The UK Addendum applies where the UK GDPR governs the transfer. We will give you details of the safeguards on request.

8. Helping you meet your own obligations

Guest requests. If a guest contacts us directly to exercise a right — access, correction, deletion, objection, portability — we will not respond on your behalf. We will pass it to you without undue delay and help you answer it, including by locating, exporting, correcting or deleting the data.

Assessments and consultation. Taking into account the nature of the processing and the information available to us, we will assist you with data protection impact assessments and any prior consultation with a supervisory authority.

9. Personal data breaches

If we become aware of a personal data breach affecting guest data we process for you, we will notify you without undue delay and in any event within 48 hours of becoming aware of it.

The notification will describe what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of it at once, we will provide it in phases as it becomes available. We will help you meet your own notification duties under Articles 33 and 34 GDPR — but the decision to notify a supervisory authority or the guests is yours to make, as controller.

10. Return and deletion

When our agreement ends you may export your data through the administration tool, or ask us for an export, at any point during the thirty (30) days following termination.

After that period we will delete the guest personal data we hold for you, including from routine backups on their normal rotation, unless EU or Polish law requires us to keep it — in which case we will keep only what the law requires, for only as long as it requires, and continue to protect it under this DPA.

11. Audit

We will make available the information necessary to demonstrate compliance with Article 28 GDPR, and will allow and contribute to audits and inspections conducted by you or an auditor you appoint.

In practice, please start by asking us — most questions are answered by the information on this page and by documentation we can send you. An on-site audit may be requested no more than once a year, unless a supervisory authority requires otherwise or there has been a breach, on reasonable notice, during business hours, without unreasonable disruption to our operations, and subject to confidentiality.

12. Liability and precedence

The limitations and exclusions of liability in our services agreement apply to claims under this DPA, except where the GDPR does not permit them to. Nothing here limits any right a data subject has under the GDPR.

If any provision of this DPA is invalid, the rest continues in force. This DPA is governed by the law stated in our services agreement and, in the absence of one, by Polish law.

Annex I — Details of the processing

Categories of data subject: guests who make, attempt or hold a booking on your website, and the people you authorise to use the administration tool.

Categories of personal data:

• identity and contact details — first name, last name, email address, telephone number, country;
• booking details — arrival and departure dates, room type, rate plan, number of guests, extras purchased, price and currency, booking reference and status;
• free text the guest chooses to enter as a special request, which they may use to mention an arrival time, an accessibility need or a similar matter;
• payment references — the identifiers issued by Stripe for the payment, the saved payment method and the customer record;
• correspondence — the guest emails we send on your behalf and their delivery status;
• technical data — IP address and device information recorded in server logs, and, where you have enabled analytics on your site and the guest has consented, the measurement data that follows from it.

We do not store card numbers, expiry dates or security codes. Card details are entered into payment fields hosted by Stripe and never reach our servers or our database; we hold only Stripe's tokens and references.

Special categories of data: none are requested and none are required. A guest may volunteer health-related information in a free text request; it is stored as ordinary booking text and is not used for any other purpose.

Children: the service is not directed at children. Where a booking includes children, only the number and ages needed to price and allocate the room are processed.

Frequency: continuous, for the duration of the agreement.

Annex II — Technical and organisational measures

Encryption. All traffic to and from the platform is served over TLS. Credentials for your property management system are held encrypted at rest using AES-256-GCM. Guest links that carry an entitlement — cancellation, payment update — are signed with HMAC-SHA256 and verified in constant time, so they cannot be guessed or tampered with. The database and object storage are encrypted at rest by the providers named in Annex III.

Access control.Administrative access is authentication-gated and limited to Rockenue personnel who need it. Provider consoles are protected by individual accounts. Secrets are held in the hosting platform's environment configuration, not in source code.

Separation.Each property's data is separated by property identifier and every guest-facing query is scoped to a single property, so one hotel's site cannot return another hotel's data. A separate staging environment with its own database is used for testing.

Minimisation. We collect only the fields needed to make and honour a booking. Error monitoring is explicitly configured not to attach personal data automatically.

Resilience. The database provider maintains point-in-time recovery. Payment and property-system operations are idempotent and retried on failure, so a network fault cannot silently lose or duplicate a reservation.

Monitoring. Application errors and failed fulfilment are monitored and alert a named person. Payment events are recorded in an audit trail against the booking.

Development practice. Changes are version-controlled and pass automated type, build and test checks before release. Third-party dependencies are kept current.

Annex III — Sub-processors

The following process guest personal data on our behalf. Your property management system is not on this list because it is your own contracted system, and Stripe is not, because for card payments it acts as an independent controller under its own agreement with you.

Where you enable Google Analytics on your site, Google is engaged on your instruction and under your own configuration; measurement runs only after the guest consents through the banner on your site.

Signing this

Most hotels rely on this page, which is incorporated into our services agreement and versioned by the date at the top. If your own compliance process needs a countersigned copy, ask karol at rockenue.com and we will send one for signature.

How we handle data in our own right, as controller — enquiries sent through this website — is a separate matter and is described in the Privacy Policy.