Data Processing Agreement.
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Hotel and HospitalityOS LLC, a Colorado limited liability company, 110 16th Street, Suite 1460, Denver, CO 80202 ("Nightcap", "we", "us"). It applies whenever we process personal data on the Hotel's behalf. Capitalized terms not defined here have the meaning in the Terms of Service. In this DPA, "personal data", "controller", "processor", "processing" and "data subject" have the meanings given by the applicable data protection laws, including the Colorado Privacy Act, the California Consumer Privacy Act, the EU and UK GDPR and the laws of other U.S. states, to the extent each applies.
1. Roles
The Hotel is the controller (or "business") of guest personal data. Nightcap is the processor (or "service provider" or "contractor"). Each party complies with the obligations the applicable laws place on its role. The Hotel confirms it has provided any notices and obtained any consents required to give us the personal data and to instruct the processing described in Annex 1.
2. Instructions and purpose limitation
We process personal data only on the Hotel's documented instructions, which are: the Terms of Service, this DPA, the settings the Hotel configures in the Service (objectives, approval mode, Voice Card, channels, quiet hours, limits), and the Hotel's written instructions. We will not: sell or share personal data; retain, use or disclose it for any purpose other than providing the Service; retain, use or disclose it outside the direct business relationship with the Hotel; or combine it with personal data from any other source except as permitted by law to perform the Service. We will tell the Hotel if we believe an instruction breaks the law. If we cannot comply with our obligations under this DPA we will tell the Hotel, and the Hotel may suspend the processing.
3. Confidentiality and staff
We limit access to personal data to people who need it to provide the Service, bind them to confidentiality, train them in data protection, and remove access when it is no longer needed.
4. Security
We maintain the technical and organizational measures in Annex 2, review them at least annually, and do not reduce them during the term. They include a separate encrypted database and encryption key per hotel, encryption in transit and at rest, multi-factor authentication, role-based access, immutable logging of access, exports and deletions, zero data retention with our AI provider, and no storage of payment card numbers or identity documents.
5. Subprocessors
The Hotel authorizes the subprocessors below. We impose on each subprocessor data protection obligations at least as protective as this DPA and remain responsible for their performance. We will post changes to this list at nightcap.tech/dpa and email the Hotel at least 30 days before a new subprocessor begins processing its data; the Hotel may object on reasonable data-protection grounds within that period and, if we cannot resolve the objection, end the Service for the affected processing without penalty.
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, application runtime, per-hotel database, email routing | United States (global edge) |
| Anthropic, PBC | Generating and classifying message text, configured for zero data retention; no training on Hotel Data | United States |
| Twilio Inc. | SMS and WhatsApp delivery, carrier registration | United States |
| Resend, Inc. (on Amazon Web Services) | Email delivery | United States |
| Amazon Web Services, Inc. | Key management for per-hotel encryption keys | United States |
| HubSpot, Inc. | Customer relationship records for the Hotel as our customer (not guest data) | United States |
| Stripe, Inc. | Billing the Hotel (not guest data) | United States |
6. Data subject requests
The Service lets the Hotel view, correct, export and delete any guest's data. If we receive a request directly from a guest we will forward it to the Hotel within five business days and help the Hotel respond, and will not respond ourselves except to direct the guest to the Hotel or as the law requires.
7. Security incidents
We will notify the Hotel without undue delay, and in any case within 72 hours of becoming aware, of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to personal data we process for the Hotel. The notice will describe what happened, the data and people affected as far as known, the likely consequences, and the steps taken. We will cooperate with the Hotel's investigation and any notifications the Hotel must make, and will not notify the Hotel's guests or regulators ourselves unless the law requires us to.
8. Assistance
Taking into account the nature of the processing, we will help the Hotel with data protection impact assessments, consultations with regulators, and its security and data subject obligations, at no charge for reasonable requests and at our then-current rates for extensive ones.
9. Audit
On request, no more than once a year unless a regulator requires it or an incident has occurred, we will provide the information reasonably needed to demonstrate compliance with this DPA, including our most recent security assessment or audit report when we have one, and will allow an audit by the Hotel or an independent auditor bound by confidentiality, on 30 days' notice, during business hours, in a way that does not disrupt the Service or expose other hotels' data.
10. Return and deletion
During the term the Hotel can export all its data from the Service. On termination we delete personal data from live systems within 30 days and from backups within 90 days, and certify deletion on request, unless the law requires us to keep it, in which case we keep it isolated and process it only as the law requires. After a Scan that does not lead to a subscription we delete within 30 days of delivering the report.
11. International transfers
We process in the United States. Where the Hotel's guest data is subject to the EU or UK GDPR or Swiss law, the parties enter into the EU Standard Contractual Clauses (Module Two, controller to processor, Decision 2021/914) and the UK International Data Transfer Addendum, which are incorporated by reference with the Hotel as data exporter, Nightcap as data importer, Annex 1 and Annex 2 of this DPA as the Clauses' Annexes, the optional docking clause not used, Clause 9 Option 2 with 30 days' notice, and Ireland as the governing law and forum for the Clauses only.
12. Liability and term
This DPA lasts as long as we process personal data for the Hotel. Liability under this DPA is subject to the Terms of Service, including Section 11 (limitation of liability) and the higher cap it sets for breaches of the DPA's security obligations.
Annex 1. Description of processing
| Subject matter | Guest communication and guest-revenue analytics for the Hotel |
|---|---|
| Duration | The term of the Terms of Service plus the deletion periods in Section 10 |
| Nature and purpose | Reading reservation, profile, folio, point-of-sale and CRM data; resolving guest identity; building preference profiles; writing and sending messages in the Hotel's name; routing conversations to staff; recording consent and opt-outs; reporting attributed revenue |
| Data subjects | The Hotel's past, current and future guests and enquirers; the Hotel's staff who use the Service |
| Categories of personal data | Name, email, phone, postal address, stay dates, room and rate type, booking source, folio and point-of-sale totals and items, preferences and requests, message content and metadata, consent and opt-out records, satisfaction scores. Not processed: payment card numbers, identity document numbers, dates of birth, special categories of data except as a guest volunteers them in a message, which we do not extract or profile |
| Retention | For the term; deletion per Section 10 |
Annex 2. Technical and organizational measures
- One database and one encryption key per hotel; no cross-hotel queries are possible in the application layer.
- TLS 1.2 or higher in transit; AES-256 at rest; keys held in a hardware-backed key management service in a separate cloud account.
- Credentials for Hotel systems held in a separate vault, encrypted per hotel, never on disk or in logs; connections are view-only unless the Hotel enables write-back of notes and tags.
- Multi-factor authentication for all staff and Hotel users; role-based access (owner, GM, staff, Nightcap Launch Specialist with a stated end date); immediate removal on exit.
- Immutable audit log of every message, approval, access, export and deletion, visible to the Hotel in the Service.
- AI generation with zero data retention at the provider; no training on Hotel Data; every generated message stored with its inputs and reasons.
- No storage of payment card numbers or identity documents; hosted payment pages only.
- Daily encrypted backups; tested restore; deletion from backups within 90 days.
- Vulnerability management, dependency updates, annual penetration test, SOC 2 Type II program under way; staff security training on hire and annually; written incident response plan with a 72-hour customer notice standard.
- Operator-assisted data pulls (where the Hotel provides exports): files stored only in the Hotel's encrypted folder, superseded files deleted, every access and deletion logged.