Data processing agreement
Version 2026-11-04. This agreement is part of the A la carte Booking SaaS terms between the hotel (controller) and [company name] (processor, "A la carte Booking"). It meets Article 28 of the EU General Data Protection Regulation (GDPR) and, where it applies, Egyptian Law 151/2020.
1. Subject and duration
A la carte Booking processes personal data only to provide the booking, allocation and feedback service to the hotel, for as long as the hotel uses the service.
2. Data and data subjects
Guests: room number, last name, optional first name, arrival and departure date, number of adults and children, language, optional e-mail address, optional allergies or wishes, bookings, feedback scores and comments, the tour operator if the hotel imports it.
Staff: name, work e-mail, role, log-in times, audit log of actions.
We do not process passport data, dates of birth, nationality or payment card data of guests.
3. Instructions
A la carte Booking processes personal data only on documented instructions from the hotel. These terms and the settings the hotel chooses in the app are the instructions.
4. Retention
Personal data of a stay is deleted automatically 30 days after departure. Aggregated statistics without personal data are kept. Audit log entries are kept for 12 months.
5. Security
- Data is stored in the EU, encrypted in transit (TLS) and at rest.
- Strict separation per hotel in the database (row-level security), tested automatically.
- Rate limiting on guest log-in, non-sequential card codes, PIN log-in for shared tablets.
- No personal data in application logs or analytics.
- Access by A la carte Booking staff only when needed for support, and logged.
6. Sub-processors
The hotel gives general authorisation for these sub-processors. We announce changes at least 30 days in advance by e-mail; the hotel may object and end the agreement.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of the application | EU region (Frankfurt) |
| Neon Inc. | Database | EU region (Frankfurt) |
| Resend Inc. | Sending e-mails to guests and staff | EU region |
| Anthropic PBC | Translation of hotel texts and guest comments | United States (standard contractual clauses) |
| Stripe Payments Europe Ltd. | Billing of the hotel (no guest data) | EU |
Guest comments are sent for translation without name or room number.
7. Assistance and data subject requests
A la carte Booking helps the hotel answer requests from guests (access, correction, deletion) within 10 business days. Guests who contact A la carte Booking directly are referred to the hotel.
8. Personal data breaches
A la carte Booking informs the hotel without undue delay and at the latest within 48 hours after becoming aware of a breach, with the information the hotel needs to notify the authority.
9. Audits
The hotel may ask once a year for written information on our security measures. On-site audits are possible at the hotel's cost with 30 days' notice.
10. End of the agreement
After the end of the service, A la carte Booking deletes all personal data within 30 days, unless the law requires storage.