Data Processing Agreement

This agreement is Annex 1 to the terms of service and is accepted together with them. It sets out how Byte Bunny S.L.U. ("the Processor") processes personal data on behalf of the Customer ("the Controller") as Article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD) require.

1. Subject matter and duration

The Processor hosts and operates the BunnyOwn platform for the Controller. In doing so it processes the personal data the Controller and the Controller's websites put into it. Processing lasts for the term of the subscription and the deletion period in clause 9.

2. Nature and purpose

Storing, displaying, transmitting, backing up and — where the Controller uses those features — sending emails to and on behalf of the Controller, taking booking requests and payments, forwarding enquiries, syncing calendars, and making content available to AI clients the Controller connects. The only purpose is to provide the service the Controller subscribed to.

3. Categories of data and of data subjects

• Guests and enquirers of the Controller's websites: name, email address, phone number, dates of stay or booking, party size, messages, payment status (never card numbers, which the payment provider holds), IP address and technical data of a request.
• Members of the Controller's team: name, email address, role, and the actions they take in the workspace.
• Crew and staff the Controller schedules: name and calendar of duties.
• Correspondents of the Controller's website mailbox: address, messages and attachments.

No special categories of data are intended to be processed. The Controller will not put such data into the platform without agreeing additional measures with the Processor in writing.

4. Instructions

The Processor processes personal data only on the Controller's documented instructions. These terms, the platform's features and the Controller's use of them are those instructions. If the Processor believes an instruction infringes the law it will say so at once. Where Union or Member State law requires the Processor to process data otherwise, it informs the Controller before doing so unless that law forbids it.

5. Confidentiality

Only named operators of the Processor with a need to do so access the Controller's data, and each is bound by confidentiality. Operator actions are logged.

6. Security

The Processor applies measures appropriate to the risk, which currently include: encryption of data in transit (TLS) and at rest; logical isolation of each Controller's data by tenant in the database and the storage; per-website secrets for every pipeline; authentication through a dedicated identity provider with verified email addresses; role-based access for the Controller's team; daily backups kept on separate storage and rotated within 30 days; server-side integrations only, so no third-party script runs on the Controller's websites; and audit logs of operator actions. The Processor reviews these measures as the service and the state of the art evolve.

7. Sub-processors

The Controller authorises the Processor to use the following sub-processors:

• Hetzner Online GmbH, Germany — hosting of servers and storage, in data centres in Germany and Finland.
• Cloudflare, Inc., United States — DNS, edge delivery and protection of the platform and of the Controller's websites; transfers covered by Cloudflare's data processing addendum and its certification under the EU–US Data Privacy Framework.
• Stripe Payments Europe, Ltd., Ireland — payment processing for the Processor's own invoices. Where the Controller connects its own Stripe account, Stripe acts for the Controller directly and is not a sub-processor under this agreement.
• Resend, Inc., United States — delivery and receipt of email sent through the platform; transfers covered by the European Commission's standard contractual clauses.

The Processor will inform the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Controller may terminate the subscription before the change takes effect, without penalty. The Processor imposes on each sub-processor data-protection obligations equivalent to this agreement and remains liable to the Controller for their performance.

8. Assistance

The Processor assists the Controller, taking into account the nature of the processing, in answering data-subject requests (access, rectification, erasure, restriction, portability, objection), with the Controller's security obligations, with data-protection impact assessments and with prior consultation of the supervisory authority. Requests a data subject sends to the Processor about a Controller's data are forwarded to the Controller without undue delay.

The Processor notifies the Controller of a personal-data breach affecting the Controller's data without undue delay and no later than 48 hours after becoming aware of it, with the information Article 33(3) GDPR requires as far as it is available, and helps the Controller meet its own notification duties.

9. Deletion and return

At the end of the subscription the Controller may request an export of its data in a machine-readable format within 30 days. Thirty days after termination the Processor deletes the Controller's data from live systems; backup copies expire within a further 30 days. Data the Processor must keep by law (invoices and their supporting records) is kept only for that purpose and for the period the law sets.

10. Audit

The Processor makes available the information necessary to demonstrate compliance with this agreement and, once a year on 30 days' written notice, allows an audit by the Controller or an auditor mandated by it, in the form of a written questionnaire and, where that is insufficient, a remote inspection at a mutually agreed time. The Controller bears the cost of audits it requests.

11. International transfers

The Controller's data is stored in the European Union. Transfers to the sub-processors outside the EU named in clause 7 rely on the safeguards stated there. The Processor makes no other transfer outside the EU without the Controller's prior written authorisation.

12. Duration and precedence

This agreement applies for as long as the Processor processes personal data for the Controller. In a conflict between this agreement and the terms of service, this agreement prevails for data-protection matters. The English text is the binding version.