Data Processing Agreement

1. Roles

For the business-contact data a customer gathers about companies and people near its hotel and uses for outreach, the customer is the controller and Room Radius is the processor, acting on the customer’s documented instructions.

This DPA does not make Room Radiusa processor for everything. For the customer’s own account data, and for Room Radius’s own purposes — running the service, security, billing, and Room Radius’s own prospecting — Room Radius determines the purposes and acts as a controller. Those are described in our Privacy Policy, not here.

2. Subject matter and duration

The subject matter is the processing of personal data necessary to provide the service. This DPA lasts as long as Room Radius processes personal data on the customer’s behalf under the Terms, and its obligations survive termination until that data is returned or deleted.

3. Nature and purpose of processing

Room Radiusprocesses the personal data to: compile business-contact records near the customer’s hotel from public and third-party sources; help the customer identify relevant roles; send outreach through the customer’s own connected mailbox on the customer’s instruction; and record delivery, replies and suppression so the customer can manage its outreach. See Annex 1.

4. Categories of personal data

Business-context data about individuals in a professional capacity: name, job title, work email address, employer, employer’s public telephone number and address, the source a record came from, and the record of what the customer sent and whether it was opened, replied to or unsubscribed. Room Radius does not seek special categories of personal data.

5. Categories of data subjects

Employees and representatives of organisations near the customer’s hotel who may be responsible for booking accommodation, and the customer’s own users.

6. Processing on documented instructions

Room Radiusprocesses the personal data only on the customer’s documented instructions — which include the Terms, this DPA, and the customer’s use of the product’s features — unless required otherwise by law, in which case it informs the customer first where legally permitted. Room Radius tells the customer if it believes an instruction infringes data-protection law.

7. Confidentiality

Room Radius ensures that personnel authorised to process the personal data are bound by confidentiality and access it only as needed to provide the service.

8. Security

Room Radius implements appropriate technical and organisational measures under Article 32, described in Annex 2 and on our security page. The customer is responsible for the security of its own accounts and connected mailbox credentials.

9. Subprocessors

The customer gives general authorisation for Room Radius to engage subprocessors to provide the service. The current list is at subprocessors. Room Radius imposes data-protection obligations on each subprocessor no less protective than this DPA, remains responsible for their performance, and will give the customer notice of an intended change so the customer can object.

10. International transfers

Where providing the service involves transferring personal data outside the EEA, Room Radius relies on a lawful transfer mechanism — an adequacy decision, the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where applicable. The mechanism per provider is stated on the subprocessors page.

11. Assistance with data-subject requests

Taking account of the nature of the processing, Room Radius assists the customer with appropriate measures to respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, objection, portability). If a data subject contacts Room Radiusdirectly, it forwards the request to the customer and, where it can, acts on the customer’s instruction — for example, suppressing an address that objects to outreach.

12. Personal-data breaches

Room Radiusnotifies the customer without undue delay after becoming aware of a personal-data breach affecting the customer’s data, with the information the customer reasonably needs to meet its own notification duties. Breaches are handled in accordance with applicable data-protection law.

13. DPIAs and prior consultation

Room Radius provides reasonable assistance to the customer with data-protection impact assessments and any prior consultation with a supervisory authority, where required and relating to the processing under this DPA.

14. Audits and information

Room Radius makes available the information reasonably necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the customer or an auditor it mandates, on reasonable notice, no more than once a year except where required by a supervisory authority or following a breach, and subject to confidentiality.

15. Return and deletion

On termination, and at the customer’s choice, Room Radiusdeletes or returns the personal data it processes on the customer’s behalf, and deletes existing copies, unless law requires storage. Retention periods are described in the Privacy Policy.

16. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms.

Annex 1 — Details of the processing

• Subject matter: provision of the Room Radius service.
• Duration: for the term of the Terms and until return or deletion of the data.
• Nature and purpose:discovery, contact identification, outreach sending via the customer’s mailbox, and delivery/reply/suppression tracking.
• Categories of data: as in section 4.
• Data subjects: as in section 5.

Annex 2 — Technical and organisational measures

Current measures, described in full on the security page, include: encryption of data in transit (TLS); tenant isolation enforced at the database level so one customer cannot access another’s data; application-level encryption of connected-mailbox credentials; access restricted to authorised personnel with secrets held server-side and never exposed to the browser; and hosting on infrastructure providers that maintain their own recognised security certifications. Measures are reviewed as the service develops.

Annex 3 — Subprocessors

The current subprocessors, their purpose, location and transfer mechanism are listed at subprocessors.

Contact

Data-protection enquiries about this DPA: privacy@roomradius.io. The supervisory authority in Norway is Datatilsynet (the Norwegian Data Protection Authority).