Data Processing Addendum

Scope of this Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between the hospitality business using RK Guest ("Client") and RK Hospitality Studio for the provision of the RK Guest service.

This DPA applies only to processing in which RK Hospitality Studio processes personal data on behalf of the Client and the Client determines the purposes and essential means of that processing.

It does not apply to processing for which RK Hospitality Studio independently determines the purposes and means, including its own sales, client administration, billing, support, security, accounting and legal-compliance activities. For those activities, RK Hospitality Studio generally acts as a controller and its Privacy Policy applies.

If there is a conflict between this DPA and another part of the service agreement concerning the processing of personal data on behalf of the Client, this DPA will take precedence to the extent of that conflict.

Definitions

In this DPA:

• Client Personal Data means personal data processed by RK Hospitality Studio on behalf of the Client through RK Guest.
• Client means the hospitality business receiving the RK Guest service.
• RK Guest means the hosted digital guest-information service provided by RK Hospitality Studio.
• Data Protection Law means applicable UK data-protection legislation, including the UK GDPR and Data Protection Act 2018, as amended or replaced from time to time.
• Sub-processor means another processor engaged by RK Hospitality Studio to process Client Personal Data in connection with RK Guest.

Terms such as controller, processor, personal data, processing, data subject and personal-data breach have the meanings given to them by applicable Data Protection Law.

Roles of the parties

For Client Personal Data covered by this DPA, the Client acts as controller and RK Hospitality Studio acts as processor, except where Data Protection Law requires otherwise.

The Client is responsible for determining the purposes for which Client Personal Data is processed through RK Guest and for ensuring that it has an appropriate lawful basis, provides any required privacy information and otherwise complies with its obligations as controller.

RK Hospitality Studio will process Client Personal Data only to provide RK Guest, maintain and secure the service, provide support and perform other processing documented in this DPA or instructed by the Client.

Nothing in this DPA prevents RK Hospitality Studio from acting as an independent controller for separate processing carried out for its own legitimate business, legal, administrative or security purposes.

Processing instructions

RK Hospitality Studio will process Client Personal Data only on documented instructions from the Client, unless processing is required by applicable law.

The Client instructs RK Hospitality Studio to process Client Personal Data as reasonably necessary to:

• provide and operate RK Guest;
• host and display Client-provided guest-guide content;
• manage property and dashboard functionality;
• provide QR-location functionality;
• generate agreed service and engagement analytics;
• maintain, secure, troubleshoot and support RK Guest;
• create and maintain service backups; and
• use authorised sub-processors where necessary to provide the service.

Additional documented instructions may be provided through the service agreement, authorised dashboard actions, support requests, email or another written method capable of being retained as a record.

If RK Hospitality Studio believes that an instruction infringes applicable Data Protection Law, it will inform the Client without undue delay and may suspend the affected processing while the matter is clarified.

Where RK Hospitality Studio is required by law to process Client Personal Data other than on the Client's instructions, it will inform the Client before carrying out that processing unless the law prohibits such notification.

Confidentiality

RK Hospitality Studio will ensure that persons authorised to process Client Personal Data are subject to an appropriate duty of confidentiality.

Access to Client Personal Data will be limited to persons and service providers that reasonably require access to operate, maintain, secure or support RK Guest.

Security of processing

RK Hospitality Studio will implement and maintain appropriate technical and organisational measures designed to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Security measures will take account of the nature of the processing, available technology, implementation costs and the risks presented by the processing.

Current measures relevant to RK Guest are described in the Security Measures Schedule below.

Security measures may change as the service, technology and identified risks develop, provided that the overall protection of Client Personal Data is not materially reduced without reasonable justification.

Sub-processors

The Client authorises RK Hospitality Studio to engage sub-processors where reasonably necessary to provide RK Guest, subject to the requirements of this DPA and applicable Data Protection Law.

RK Hospitality Studio will ensure that a sub-processor that processes Client Personal Data is subject to written obligations that provide an appropriate level of data-protection protection for the processing it performs.

RK Hospitality Studio remains responsible for the performance of its data-protection obligations where it uses a sub-processor, subject to applicable law and the terms of the main service agreement.

Current material RK Guest sub-processors are identified in the Sub-processor Schedule below.

RK Hospitality Studio may add or replace sub-processors where reasonably necessary to operate, maintain, secure or improve RK Guest.

Where required by applicable Data Protection Law or the applicable client agreement, RK Hospitality Studio will provide reasonable notice of a material new sub-processor and allow the Client to raise reasonable data-protection concerns.

International transfers

RK Hospitality Studio will not knowingly transfer Client Personal Data outside the United Kingdom except where the transfer is permitted under applicable Data Protection Law.

Where an authorised sub-processor processes Client Personal Data outside the United Kingdom, RK Hospitality Studio will ensure that an appropriate transfer mechanism or safeguard is used where required by law.

Such safeguards may include applicable adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission Standard Contractual Clauses, or another lawful transfer mechanism available under UK Data Protection Law.

RK Hospitality Studio will make reasonable information about applicable international-transfer arrangements available to the Client on request where relevant to Client Personal Data.

Data-subject rights

Taking into account the nature of the processing, RK Hospitality Studio will provide reasonable assistance to the Client through appropriate technical and organisational measures to help the Client respond to requests from data subjects exercising their rights under applicable Data Protection Law.

This may include reasonable assistance with requests for access, rectification, erasure, restriction, objection or portability where the request relates to Client Personal Data processed through RK Guest.

If RK Hospitality Studio receives a request directly from a data subject relating to Client Personal Data, it will not normally respond to the substance of the request on the Client's behalf unless authorised or legally required to do so.

Where reasonably possible, RK Hospitality Studio will instead notify the Client or direct the data subject to the relevant Client.

Assistance with data-protection compliance

Taking into account the nature of the processing and the information available to RK Hospitality Studio, RK Hospitality Studio will provide reasonable assistance to the Client with its obligations relating to:

• the security of personal data;
• assessment and handling of personal-data breaches;
• notification of personal-data breaches to the Information Commissioner's Office where required;
• notification of affected individuals where required;
• data-protection impact assessments where required; and
• prior consultation with the Information Commissioner's Office where required by applicable law.

The Client remains responsible for determining whether a notification, impact assessment, consultation or other controller action is legally required.

Personal-data breaches

RK Hospitality Studio will notify the Client without undue delay after becoming aware of a personal-data breach affecting Client Personal Data.

Where reasonably available, the notification will include information sufficient to assist the Client in assessing the breach and meeting its obligations under applicable Data Protection Law.

Information may include:

• the nature of the personal-data breach;
• the categories of Client Personal Data affected;
• the categories of affected data subjects where known;
• the likely consequences of the breach where reasonably identifiable;
• measures taken or proposed to contain, investigate or mitigate the breach; and
• other information reasonably available and relevant to the Client's assessment.

Where complete information is not immediately available, RK Hospitality Studio may provide information in stages as the investigation develops.

Notification of a breach does not by itself constitute an admission of fault or liability.

Deletion and return of Client Personal Data

When the processing services covered by this DPA end, RK Hospitality Studio will, at the Client's choice and subject to applicable law, delete or return Client Personal Data processed on behalf of the Client where reasonably practicable.

RK Hospitality Studio may retain information where retention is required by applicable law or where RK Hospitality Studio processes that information separately as a controller for a legitimate legal, accounting, security or contractual purpose.

Client Personal Data contained in backup copies may remain for a limited period until those backups expire through the normal backup-retention process.

During that period, backup data will remain subject to the protections of this DPA and will not be restored or otherwise processed except where reasonably necessary for recovery, security, legal compliance or another permitted purpose.

Information, audits and compliance

RK Hospitality Studio will make available to the Client information reasonably necessary to demonstrate compliance with the processor obligations applicable under this DPA and Data Protection Law.

RK Hospitality Studio will allow for and contribute to reasonable audits or inspections relating to the processing of Client Personal Data where required by applicable Data Protection Law.

Where appropriate, compliance may initially be demonstrated through documentation, security information, policies, records, third-party assurance material or written responses rather than through an on-site inspection.

Any audit must, where permitted by law:

• be proportionate to the nature and risk of the processing;
• be subject to reasonable prior notice except where an urgent legal or security concern reasonably requires otherwise;
• minimise disruption to RK Hospitality Studio and other clients;
• protect confidential information, security controls, credentials and information relating to other clients; and
• be carried out by the Client or an appropriately qualified independent auditor subject to confidentiality obligations.

RK Hospitality Studio is not required to disclose information in a manner that would compromise the security of RK Guest, expose another client's confidential information or reveal passwords, private credentials or other security-sensitive material, provided sufficient alternative information is supplied where reasonably possible to demonstrate compliance.

Relationship with the service agreement

Except as expressly modified by this DPA, the RK Guest service agreement and applicable Terms continue to apply.

Commercial limitations, payment obligations and other contractual provisions contained in the main agreement apply to this DPA to the extent permitted by applicable Data Protection Law.

Nothing in this DPA excludes or limits a responsibility or liability where exclusion or limitation would be prohibited by applicable law.

Changes to this Data Processing Addendum

RK Hospitality Studio may update this DPA where reasonably necessary to reflect changes to RK Guest, applicable Data Protection Law, regulatory guidance, security arrangements or authorised sub-processors.

A change will not intentionally reduce the protection of Client Personal Data in a way that would cause the processing to breach applicable Data Protection Law.

Where a material change affects an active Client's data-protection rights or obligations, reasonable notice will be provided where appropriate.

Governing law

This DPA is governed by the laws of England and Wales, subject to any mandatory rights or requirements under applicable Data Protection Law.

Schedule 1 — Processing details

Subject matter of the processing

RK Hospitality Studio processes Client Personal Data as necessary to provide, operate, maintain, secure and support the RK Guest digital guest-information service.

Duration of the processing

Processing normally continues for the duration of the Client's RK Guest service and for any limited additional period reasonably necessary for service closure, legal compliance, security, backup retention or other permitted purposes described in this DPA.

Nature and purpose of the processing

Processing may include:

• collecting and receiving Client Personal Data;
• storing and hosting Client Personal Data;
• organising and structuring data within RK Guest;
• displaying Client-provided information through digital guest guides;
• managing property accounts and dashboard access;
• providing QR-location functionality;
• recording service usage and engagement information;
• generating property-level analytics and service statistics;
• providing technical support;
• maintaining, troubleshooting and securing the service;
• creating and maintaining backups for resilience and recovery; and
• deleting or returning Client Personal Data when the service ends, subject to this DPA and applicable law.

Categories of data subjects

Depending on how the Client uses RK Guest, data subjects may include:

• employees, owners, managers and other representatives of the Client;
• users authorised by the Client to access the RK Guest dashboard;
• guests and prospective guests accessing a digital guest guide;
• members of staff whose business contact details are included within guest-facing information; and
• other individuals whose personal information the Client lawfully chooses to include within RK Guest.

Types of personal data

Depending on the Client's configuration and use of RK Guest, Client Personal Data may include:

• names;
• business email addresses;
• business telephone numbers;
• job titles or business roles;
• dashboard account and login-related information;
• property contact information;
• information supplied by the Client for publication within a guest guide;
• QR-location information;
• guest portal visit records;
• guide-section view records;
• QR scan records;
• session identifiers or session keys; and
• timestamps associated with service usage.

Special-category and highly sensitive data

RK Guest is not designed for the routine processing of special-category personal data, criminal-offence data or other highly sensitive personal information.

The Client must not use RK Guest to store or publish such information unless the processing has been specifically agreed with RK Hospitality Studio and the Client has established that the processing is lawful and appropriate.

Processing frequency

Processing may occur continuously or periodically while the RK Guest service is active, depending on Client activity, guest-guide access, dashboard use, QR scans, analytics, maintenance and backup operations.

Schedule 2 — Current RK Guest sub-processors

RK Hospitality Studio currently uses the following material sub-processor in connection with the live RK Guest service.

Railway may itself use authorised sub-processors in accordance with its contractual and data-processing arrangements.

The list of sub-processors may change where reasonably necessary to operate, maintain, secure or improve RK Guest. Material changes will be handled in accordance with the Sub-processors section of this DPA.

Schedule 3 — Technical and organisational measures

RK Hospitality Studio uses technical and organisational measures intended to provide a level of security appropriate to the nature and risks of the Client Personal Data processed through RK Guest.

Current measures include the following.

Production environment

• RK Guest is operated through a separate production environment.
• The production application is hosted through Railway.
• Production application traffic is served using HTTPS.
• Security-related HTTP headers and secure production cookie settings are used where configured by the application.

Database and storage

• Live application data is stored in a production PostgreSQL database.
• Local development data is maintained separately from the live production database.
• Uploaded production property assets are stored using persistent storage associated with the production service.

Access control

• Property-management functionality requires authorised account access.
• Dashboard functionality is access controlled.
• Application logic is used to separate access between properties and authorised property users.
• Access to production systems and information is limited to persons and providers who reasonably require it for operation, maintenance, security or support.

Credentials and configuration

• Production credentials and sensitive configuration are separated from application source code using environment configuration where appropriate.
• Production database credentials are not hard-coded into the standalone backup script.
• Credentials and administrative access are limited to authorised use.

Application security

• RK Guest uses Django's authentication, session and CSRF protection mechanisms where applicable.
• Secure cookie settings are enabled for the production service where appropriate.
• Development functionality and production functionality are separated through environment-specific configuration.

Backups and recovery

• Separate logical backups of the production PostgreSQL database are created for resilience and disaster recovery.
• Backup copies are timestamped.
• Backup files are checked to confirm that PostgreSQL can recognise and read the backup structure.
• Separate logical backup copies are normally retained for approximately 30 days.
• Older standalone backup copies are automatically removed in accordance with that retention period.
• Standalone backup copies are currently stored on a secured computer used to operate RK Hospitality Studio.

The standalone backup arrangement is intended to supplement the resilience arrangements provided through the production infrastructure. It does not constitute a guarantee of zero data loss, continuous availability, immediate restoration or any particular recovery time.

Monitoring and maintenance

• The production service may be maintained, updated and reviewed to address operational, reliability or security issues.
• Technical and organisational measures may be adjusted as risks, technologies and service requirements change.

Data minimisation

• Public RK Guest guides do not currently require guests to create an account.
• Guest-engagement analytics are designed around limited first-party operational information such as visits, section views, QR activity, session identifiers and timestamps.
• RK Guest is not designed to create advertising profiles, perform device fingerprinting or collect precise guest location for analytics purposes.

Security limitations

No internet-connected service or electronic storage system can be guaranteed to be completely secure.

RK Hospitality Studio may update, replace or improve the measures described in this Schedule where appropriate, provided that the overall level of protection is not materially reduced without reasonable justification.