LuViHub Data Processing Agreement

This Data Processing Agreement ("DPA") under Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") is Annex 1 to the LuViHub Terms of Service for Hosts ("Terms") and is concluded between:

• the Host who uses LuViHub (the "Controller"), and
• LuVi Solutions j.d.o.o., [street and number], [postcode] [city], Croatia, OIB [OIB] (the "Processor", "we").

It is accepted together with the Terms. Terms defined in the Terms (e.g. Service, Host Data, User, Guest) have the same meaning here. The Croatian version is binding.

1Subject matter and duration

1.1. The Processor processes personal data on behalf of the Controller in order to provide the Service under the Terms. Annex 1 describes the nature and purpose of the processing, the types of personal data and the categories of data subjects.

1.2. This DPA applies for as long as the Processor processes personal data on behalf of the Controller — from the conclusion of the contract until the deletion of the data under section 11.

2Roles

2.1. For the personal data of Guests and other persons that the Controller or its Users enter into the Service or that the Service receives on its behalf (e.g. from booking channels or from Guests through the online check-in), the Host is the controller and LuVi Solutions j.d.o.o. is the processor.

2.2. For the data of Hosts and Users that we process for our own purposes (contract, billing, support, security of the Service, preventing misuse), we are the controller; our Privacy Policy applies.

2.3. We may create anonymised, aggregated statistics from the use of the Service (e.g. number of bookings per country) that do not allow conclusions about individual persons or Hosts, and use them to improve the Service.

3Instructions

3.1. We process personal data only on documented instructions of the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law; in such a case we inform the Controller of that legal requirement before processing, unless that law prohibits such information.

3.2. The Terms, this DPA, the functions of the Service and the settings the Controller and its Users choose in the Service (e.g. which booking channels, smart locks, messaging or AI functions are connected, which guest registration is used, which messages are sent automatically) are the Controller's documented instructions. Further instructions must be given in writing (e-mail is sufficient) and must be technically feasible and within the scope of the Service.

3.3. We inform the Controller without delay if, in our opinion, an instruction infringes data protection law. We may suspend carrying out the instruction until it has been confirmed or changed.

3.4. Transmissions on the Controller's instruction. When the Controller uses functions that transmit data to recipients chosen by it — for example guest registration with eVisitor, reporting under the Austrian Registration Act, fiscalization and e-invoicing with the Tax Administration, statistics to the municipality, or reservations and availability to booking channels — we transmit the data on its behalf. These recipients receive the data as recipients of the Controller and are not our sub-processors.

4Obligations of the Controller

4.1. The Controller is responsible for the lawfulness of the processing, in particular for having a legal basis, informing data subjects (Articles 13 and 14 GDPR) and answering their requests.

4.2. The Controller enters only personal data that is necessary for its purposes. Special categories of personal data (Article 9 GDPR, e.g. health data) should not be entered in free-text fields or messages unless the Controller has a legal basis.

4.3. The Controller informs us without delay if it discovers errors or irregularities in the processing.

5Confidentiality

We ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process the data only on our instructions and to the extent necessary.

6Security of processing

6.1. We implement appropriate technical and organisational measures under Article 32 GDPR to ensure a level of security appropriate to the risk. The measures are described in Annex 2.

6.2. The measures are subject to technical progress. We may adapt them as long as the level of security is not reduced.

7Sub-processors

7.1. The Controller gives its general authorisation for us to engage sub-processors. The sub-processors engaged at the time of conclusion are listed in Annex 3; the current list is available at luvihub.com/legal/dpa.

7.2. We inform the Controller by e-mail and in the Service at least 30 days before adding or replacing a sub-processor. The Controller may object within this period for reasonable data protection reasons. If we cannot address the objection, the Controller may terminate the contract free of charge before the change takes effect. In urgent cases (e.g. a sub-processor stops its service or a security problem) the period may be shorter; we inform the Controller as soon as possible.

7.3. We impose on each sub-processor, by contract, data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees for appropriate technical and organisational measures. We remain liable to the Controller for the performance of the sub-processor's obligations.

7.4. Sub-processors connected only when the Controller switches on the related function (e.g. WhatsApp, smart locks, AI functions, the channel manager) process data only for Controllers that use that function.

8Transfers to third countries

8.1. We store and process the Host Data on servers in the European Union (data centre in Frankfurt am Main, Germany).

8.2. Personal data is transferred to a country outside the European Economic Area only if the conditions of Chapter V GDPR are met — in particular on the basis of an adequacy decision of the European Commission (e.g. United Kingdom, or the EU–U.S. Data Privacy Framework for certified recipients) or the Standard Contractual Clauses of the European Commission, with supplementary measures where necessary. Annex 3 states the transfer basis for each sub-processor.

9Personal data breaches

9.1. We notify the Controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, so that the Controller can meet its obligation under Article 33 GDPR (notification of the supervisory authority within 72 hours).

9.2. The notification contains, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information we do not have yet is provided as soon as it is available.

9.3. We take the necessary measures to secure the data and to limit possible adverse effects, and document every breach.

10Assistance

10.1. Taking into account the nature of the processing, we assist the Controller with appropriate technical and organisational measures in responding to requests of data subjects (access, rectification, erasure, restriction, data portability, objection). The Service provides functions for this (e.g. viewing, correcting, exporting and deleting guest data). If a data subject contacts us directly, we forward the request to the Controller without delay and do not answer it ourselves unless instructed.

10.2. We assist the Controller, taking into account the information available to us, with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation).

10.3. We may charge reasonable costs for assistance that goes beyond the functions of the Service and is not caused by our own breach.

11Deletion and return

11.1. After the end of the contract the Controller can export its data for 180 days (section 14.6 of the Terms). After that period we delete the personal data processed on behalf of the Controller, unless Union or Member State law requires us to store it. Deleted data may remain in backups for up to 30 days until it is overwritten.

11.2. During the contract, data is deleted according to the functions and settings of the Service (e.g. the Austrian guest register is deleted automatically 7 years after the entry) or when the Controller deletes it.

11.3. On request we confirm the deletion in writing.

12Information and audits

12.1. We make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR — in particular this DPA, the description of the measures (Annex 2), the list of sub-processors and, where available, certifications or audit reports.

12.2. The Controller may carry out audits, including inspections, itself or through an independent auditor bound to confidentiality, after announcing them at least 30 days in advance, during normal business hours, without disturbing operations and at most once per calendar year — unless there is a specific reason (e.g. a personal data breach or an order of a supervisory authority). The Controller bears its own costs; we may charge reasonable costs for our effort. Audits of the data centres of sub-processors are replaced by their certifications and reports.

13Liability

The liability of the parties towards data subjects is governed by Article 82 GDPR. In the relationship between the parties, the liability provisions of the Terms apply, unless mandatory law provides otherwise.

14Final provisions

14.1. In case of conflict, this DPA prevails over the Terms as regards data protection.

14.2. We may change this DPA under the conditions of section 18 of the Terms (notification at least 30 days in advance, right to terminate). Changes required by law or by a supervisory authority may apply earlier.

14.3. Croatian law applies. The competent supervisory authority for the Processor is the Croatian Personal Data Protection Agency (AZOP), Zagreb.

14.4. Contact for data protection: team@luvihub.com.

Annex 1 – Description of the processing

Purpose: provision of the Service to the Controller: management of accommodation, reservations and guests; booking pages and online bookings; online check-in and guest registration; guest communication; invoices and payments; access to the accommodation (smart locks, parking); statistics and reports; AI functions if switched on.

Nature of the processing: collecting (through forms, interfaces and imports), recording, organising, storing, adapting, retrieving, using, transmitting on the Controller's instruction, restricting and deleting.

Categories of data subjects:

• Guests and persons travelling with them (including minors);
• persons who make enquiries or bookings;
• the Controller's Users (staff, owners, cleaners, local hosts) and other contact persons;
• owners of properties managed by the Controller.

Types of personal data:

• identity data: name, gender, date of birth, nationality;
• travel document data: type, number, date of issue, issuing authority and country (for guest registration);
• address, e-mail address, phone number, language;
• reservation data: dates, unit, number of guests, prices, booking channel, notes, special requests;
• online check-in data: arrival time, arrival method, parking request, licence plate;
• signatures (Austrian guest register);
• payment data: amounts, payment status, payment method details provided by the payment processor (no full card numbers are stored by us);
• invoice data, tax data (tourist tax, Ortstaxe, exemptions);
• access data: access codes, key validity periods, door opening logs;
• communication: e-mails and messages with Guests (including WhatsApp/SMS if used);
• technical data: IP address, browser, time stamps on guest pages (e.g. for signatures and security).

Duration: for the duration of the contract and until deletion under section 11.

Annex 2 – Technical and organisational measures (Article 32 GDPR)

Confidentiality

• Servers in a professionally operated data centre in Frankfurt am Main (Germany) with physical access control, video surveillance and controlled access by the hosting provider.
• Encrypted connections (HTTPS/TLS) for all access to the Service and for interfaces to third parties.
• A separate database for each Host with its own database user; the application separates the data of different Hosts.
• Role-based access in the Service (admin, sales, owner, local host, cleaner …) and restriction to the units assigned to a User.
• Passwords stored only as salted hashes (bcrypt); rate limits against password guessing; system administrator access with two-factor authentication.
• Access credentials for third-party services (e.g. smart-lock and channel tokens) stored encrypted.
• Guest links with random, non-guessable tokens; device binding for access links.
• Administrative access to servers only for authorised persons, over encrypted connections; database ports not reachable from the internet.

Integrity

• Logging of important changes (e.g. corrections of guest register sheets with old and new value, user and reason; door opening logs; payment events).
• Signed guest register sheets protected by a checksum.
• Input validation and protection against common web attacks (e.g. content security policy, protection of forms).

Availability and resilience

• Automatic daily backups of all databases and uploaded files, checked and kept for 30 days, with an encrypted copy at a separate provider in the EU.
• Monitoring of the services; restart procedures; tested restoration of backups.
• Updates of the operating system and software components.

Procedures for regular testing and evaluation

• Review of the measures at least once a year and after significant changes or incidents.
• Separate test environment; changes are tested before release; test systems do not send messages to real guests and do not operate real locks.
• Documented process for personal data breaches (section 9).

Annex 3 – Sub-processors