This Data Processing Agreement ("DPA") supplements the BookStayTrip Terms of Service and applies to the processing of personal data by BookStayTrip Inc. on behalf of travel hosts, accommodation operators, transport partners, and enterprise travel purchasers pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR) and international data protection laws.

1. Definitions & Scope of Processing

"Personal Data", "Controller", "Processor", "Data Subject", and "Processing" shall have the meanings assigned in Article 4 of the GDPR. Where a Partner acts as a Controller of guest data, BookStayTrip operates as a Data Processor to facilitate discovery, booking orchestration, communication delivery, and billing fulfillment.

2. Processing Instructions

BookStayTrip shall process Personal Data solely in accordance with documented instructions from the Controller, including with respect to international transfers, unless required to do so by applicable statutory law to which BookStayTrip is subject.

3. Technical & Organizational Measures (TOMs)

BookStayTrip implements state-of-the-art technical and organizational measures to ensure a level of security appropriate to the risk, including: (a) AES-256 bit encryption at rest and TLS 1.3 encryption in transit; (b) Strict role-based access control (RBAC) and least-privilege principles; (c) Routine vulnerability scans, penetration testing, and annual third-party audits; (d) Business continuity, high-availability data replication, and disaster recovery procedures.

4. Sub-processors

The Controller grants general authorization to BookStayTrip to engage certified sub-processors (including cloud hosting infrastructure, secure payment gateways, and transactional messaging providers). BookStayTrip maintains an up-to-date registry of sub-processors and imposes equivalent data protection obligations on each entity via written contractual covenants.

5. Incident Management & Breach Notification

In the event of a confirmed Personal Data Breach affecting guest or partner data, BookStayTrip shall notify the affected Controller without undue delay, and in any event within 72 hours of becoming aware of the incident, providing detailed remediation actions and statutory disclosures.

6. Audits & Regulatory Compliance

BookStayTrip makes available all documentation necessary to demonstrate compliance with this DPA and allows for and contributes to reasonable audits conducted by the Controller or an independent certified auditor.

7. DPA Inquiries & Execution