Data Processing Addendum

Article 28 DPA.

Data Processing Addendum forming part of the Terms of Service between the customer (data controller) and Rezlynxpms Retail Ltd (data processor), compliant with Article 28 of the UK GDPR.

1. Definitions

«UK GDPR» means Regulation (EU) 2016/679 as it forms part of UK domestic law by virtue of the European Union (Withdrawal) Act 2018. «Personal data», «processing», «controller» and «processor» carry the meanings given in Article 4 of the UK GDPR. «Customer» is the customer identified in the order confirmation.

2. Subject matter and duration

Subject matter: processing of personal data supplied by the customer or read from the customer’s Rezlynx tenancy in order to deliver the modules purchased. Duration: for so long as the modules are active plus the retention windows in the Privacy Policy.

3. Nature and purpose

Nature: reading, writing and transient storage. Purpose: to deliver the functions described on each module’s product page.

4. Categories of data subject and personal data

Data subjects: guests staying at the customer’s properties. Categories: name, contact details, reservation dates, room type, folio charges, dietary or accessibility notes where the customer chooses to expose them via the Rezlynx API.

5. Processor obligations (Art. 28(3))

  • Process personal data only on documented instructions from the controller.
  • Ensure staff processing the data are under a duty of confidentiality.
  • Take all measures required by Article 32 (security of processing).
  • Engage sub-processors only with prior specific or general written authorisation from the controller.
  • Assist the controller in fulfilling data-subject rights and DPIA obligations.
  • Notify the controller of a personal-data breach without undue delay and within 72 hours.
  • On termination, delete or return all personal data.
  • Make available all information necessary to demonstrate compliance and allow audits.

6. Sub-processors

Current sub-processors: Stripe Payments UK Ltd (payment tokens), Amazon Web Services EMEA SARL (London region only) for compute and storage, Twilio Ireland Ltd (for SMS notifications, where applicable). Any change communicated 30 days in advance; the controller may object.

7. International transfers

No transfers outside the United Kingdom. If that ever changes, transfers will be subject to UK IDTA or Standard Contractual Clauses as applicable.

8. Signature

This DPA is signed automatically as part of the order confirmation flow. A countersigned PDF is available on request from dpo@rezlynxhub.co.uk.