Data Processing Agreement (Art. 28 GDPR)

This agreement forms part of the ApartmanLink Terms of Service. It governs how Aquatrek Solutions P.S.A., as processor, processes guests' personal data on behalf of the host as controller.

1. Parties and subject matter

• Controller: the host who has accepted the ApartmanLink Terms of Service; the host's details are in the panel.
• Processor: Aquatrek Solutions P.S.A., ul. Romana 20A, 93-370 Łódź, Poland, KRS 0001044483, [email protected].
• Subject matter: maintaining the property website and processing the data of guests who visit it or send an enquiry, as described in Annex A.
• Duration: for as long as the service contract lasts and until the processor deletes the data under section 8.

2. Controller instructions

• The processor processes data only on the controller's documented instructions, including with regard to transfers to third countries (section 5 and Annex C). The instructions consist of the Terms of Service, this agreement and the settings the controller chooses in the panel; the controller gives any further instructions by e-mail.
• The processor processes data outside these instructions only where Union or Member State law requires it, and informs the controller in advance unless the law prohibits this.
• If the processor considers that an instruction infringes the GDPR or other data protection rules, it informs the controller immediately.
• The processor does not use the guest data it processes on the controller's behalf for its own purposes. The following processing is not carried out on the controller's behalf; the processor carries it out as a separate controller, for its own purposes and under its own responsibility, as described in its Privacy Policy: (a) technical data needed for the security of the service (IP address, time of request), kept for up to 30 days unless it is needed to investigate a specific incident; (b) visit statistics without cookies and without storing IP addresses; (c) only on property websites at an ApartmanLink address (not on the controller's own domain) and only with the visitor's consent, the Meta Pixel and the Meta Conversions API for the processor's own advertising, for which the processor and Meta Platforms Ireland Limited are joint controllers. The processor never sends Meta the content of enquiries or guests' contact details. The controller does not receive the data in (a) to (c) or access to the processor's advertising audiences. The processor alone informs visitors about this processing, obtains and records their consent and handles their requests.

3. Confidentiality and security

• Only people who need access to provide the service, and who have committed to confidentiality or are under a statutory duty of confidentiality, have access to the data.
• The processor applies the technical and organisational measures in Annex B and adapts them to the risk and the state of the art (Art. 32 GDPR).

4. Sub-processors

• The controller gives the processor general written authorisation to engage the sub-processors (other processors under Article 28(2) GDPR) listed in Annex C.
• The processor notifies the controller by e-mail at least 14 days in advance of any intended addition or replacement of a sub-processor. The controller may object on reasoned grounds within that period; if the parties cannot resolve the objection, the controller may cancel the service contract with a refund of the proportionate part of fees paid in advance.
• The processor concludes a contract with each sub-processor imposing the same data protection obligations as in this agreement and remains fully liable to the controller for the performance of the sub-processor's obligations.

5. Transfers outside the EEA

The processor transfers data outside the European Economic Area only with the safeguards in Chapter V of the GDPR: on the basis of a European Commission adequacy decision, including the EU-U.S. Data Privacy Framework, or on the basis of standard contractual clauses (Commission Implementing Decision (EU) 2021/914, Module 3).

6. Assistance to the controller

• The processor lets the controller view enquiries in the panel. At the controller's request, within 5 working days, it provides a copy of the data about a particular guest, corrects it or deletes it.
• The processor forwards to the controller, within 5 working days, any request it receives directly from a guest, and does not respond to it on its own.
• Taking into account the nature of the processing and the information available, the processor assists the controller with its obligations under Articles 32 to 36 GDPR: security of processing, breach notification, impact assessment and prior consultation.

7. Personal data breaches

• The processor notifies the controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it. The notice contains the information under Article 33(3) GDPR known at that time, and the processor provides the rest as soon as it learns it.
• The processor immediately takes reasonable measures to limit the consequences of the breach.

8. Deletion and return of data

• The processor deletes without delay any enquiries the controller deletes and stops processing them.
• The processor automatically deletes enquiries older than 12 months unless the controller requests a different period.
• After the service contract ends, the processor keeps the data for 30 days so that the controller can request a copy, and then deletes it; copies in backups are deleted in the next regular cycle unless the law requires them to be kept.

9. Demonstrating compliance and audits

• On request, the processor gives the controller the information needed to demonstrate compliance with Article 28 GDPR.
• Once a year, with 30 days' notice, the controller may carry out an audit itself or through an independent auditor bound by confidentiality. The audit takes place during business hours, without endangering other customers' data, and the controller bears its costs. An additional audit is possible after a personal data breach or at the request of a supervisory authority.

10. Liability and final provisions

• The parties' liability towards data subjects is governed by Article 82 GDPR; otherwise, the liability provisions of the Terms of Service apply.
• In data protection matters, this agreement takes precedence over the Terms of Service.
• The governing law and jurisdiction are set out in the Terms of Service.
• The processor announces changes to this agreement in the same way as changes to the Terms of Service, and changes of sub-processors under section 4.

Annex A. Description of processing

Annex B. Technical and organisational measures

• encrypted connections (HTTPS) for property websites, the panel and forms;
• access to data only for authorised people with personal accounts, and two-factor authentication for administrator accounts;
• passwords and login links stored only as a cryptographic hash;
• separated access: in the panel, a host sees only the enquiries for their own properties;
• regular backups and tests of data restoration;
• protection of forms against abuse (rate limiting and bot protection);
• logging of security events, with logs kept for up to 30 days unless they are needed to investigate a specific incident;
• regular updates of software and libraries;
• a duty of confidentiality for everyone with access to the data;
• a procedure for detecting and reporting personal data breaches;
• data processing agreements with all sub-processors.

Annex C. Sub-processors