Data Processing Terms

1Scope

These Data Processing Terms ("DPA") form part of the Terms of Service between Book2dream and each Hotel Customer. They apply whenever Book2dream processes personal data on a Hotel Customer's behalf while providing the service.

If you have signed a separate data processing agreement with us, it prevails where it conflicts with these terms. Capitalised terms not defined here have the meaning given in the Terms of Service.

2Roles of the parties

For personal data processed on your behalf through the booking engine, messaging, AI features and administrative tools, you are the controller and Book2dream is the processor. If you yourself act for another controller, such as the owner of the property, Book2dream is your subprocessor.

For the data we need to run our own relationship with you — account administration, billing, support and marketing to hotels — Book2dream is an independent controller, and our Privacy Policy describes how we handle it.

3Details of the processing

• Subject matter and duration — providing the Book2dream service to you, for the term of your subscription and the deletion period described below.
• Nature and purpose — hosting, storing, organising, transmitting, displaying and analysing data in order to take and manage bookings, process payments through the providers you choose, send messages to guests, run the AI features you enable, and support you.
• Data subjects — your guests and prospective guests, people who contact you through the booking engine or messaging channels, and the staff and contractors who use the platform for you.
• Categories of personal data — names and contact details, including email addresses and mobile numbers; booking details such as stay dates, rooms, rates, party size and special requests; payment references and card tokens, never full card numbers on our own systems; the content and delivery status of email, text and WhatsApp messages and, where available, calls; messaging consent and opt-out records; survey and review responses; conversations with AI assistants; and device, browser and usage data.
• Sensitive data — the service is not designed for special categories of personal data. Guests sometimes volunteer such details, for example dietary or accessibility needs in a special request. We protect them like all other Customer Data, and you should not ask guests for more than you need.

4Processing only on your instructions

We process personal data only on your documented instructions: the Terms of Service, these terms, the way you configure the platform, and the requests you make to our support team. We do not process it for any other purpose unless the law requires us to, in which case we tell you first unless the law prohibits it.

If we believe an instruction breaks data protection law, we will tell you, and may decline to carry it out until it is resolved.

5Confidentiality of our people

Everyone at Book2dream who can access personal data is bound by a written duty of confidentiality, is trained in handling it, and has access only to the extent their role requires.

6Security measures

We maintain technical and organisational measures appropriate to the risk, and review them as the service and the threats to it change. They include:

• Encryption in transit using TLS 1.2 or higher, and encryption at rest using AES-256 for databases, backups and file storage.
• Named accounts with mandatory multi-factor authentication, and production access limited to the staff who need it.
• Logical separation of every hotel's data, so one Hotel Customer can never reach another's records.
• Logging and monitoring of access to production systems, with alerting on anomalous activity.
• Encrypted, regularly tested backups.
• Vulnerability scanning, prompt patching and periodic penetration testing.
• Card details captured and tokenised by a PCI DSS certified provider, so full card numbers never reach our own systems.

7Use of subprocessors

You give us general authorisation to engage subprocessors to help provide the service. The current list follows, grouped by what each provider does.

Each subprocessor is bound by a written agreement with data protection obligations no less protective than these terms, and accesses personal data only as needed for the service it provides. We remain responsible to you for their performance.

We give at least 30 days' notice before a new subprocessor starts processing your personal data, by updating this page and emailing the owner of your account. If you have reasonable data protection grounds to object, tell us within that period. We will try to resolve the objection; if we cannot, you may terminate the affected part of the service and receive a pro-rata refund of the fees you prepaid for it.

8Subprocessors: hosting and operations

• Salesforce, Inc. (Heroku)PurposeApplication servers, primary database and cacheLocationUnited States
• Vercel Inc.PurposeHosting and content delivery for booking engines, hotel websites and our web applicationsLocationUnited States, with a global edge network
• Amazon Web Services, Inc.PurposeStorage of images, documents and other filesLocationUnited States
• Datadog, Inc.PurposeApplication monitoring and log analysisLocationUnited States
• SolarWinds Worldwide, LLC (Papertrail)PurposeApplication log storage and searchLocationUnited States
• PostHog, Inc.PurposeProduct analytics on booking engines and the hotel adminLocationUnited States
• BrowserlessPurposeReading a hotel's public website when it is imported into a Book2dream siteLocationUnited States

9Subprocessors: messaging

• Amazon Web Services, Inc. (Amazon SES)PurposeSending booking, notification and guest emailLocationBrazil
• Twilio Inc.PurposeSending and receiving text messages (SMS and MMS) and, where available, phone callsLocationUnited States
• KapsoPurposeConnecting hotels' WhatsApp numbers to Book2dream and relaying their messagesLocationUnited States
• WhatsApp LLC (Meta)PurposeDelivering WhatsApp messages through the WhatsApp Business PlatformLocationUnited States

10Subprocessors: AI features

OpenRouter passes each request to the provider that serves the language model selected for that feature. We send only the data the feature needs to do its job.

• OpenRouter, Inc.PurposeRouting requests from AI features — guest assistants, content generation, translation and rate analysis — to language modelsLocationUnited States

11Subprocessors: card security

• PCI Booking LimitedPurposeCapturing, tokenising and securely storing guest card details used to guarantee bookingsLocationIreland

12Providers for our own relationship with you

These providers handle data for which Book2dream is the controller — about Hotel Customers and visitors to our website — and never your guests' data. We list them for completeness.

• Paddle.com Market LimitedPurposeSubscription billing, as merchant of recordLocationUnited Kingdom
• Mercado PagoPurposePayment of monthly statementsLocationLatin America
• Haulmer SpA (OpenFactura)PurposeIssuing electronic tax documents to Chile's Internal Revenue Service (SII)LocationChile
• ResendPurposeDelivering messages sent through our website formsLocationUnited States
• Google LLC (Google Analytics)PurposeMeasuring use of our marketing website, only with the visitor's consentLocationUnited States

13Services you choose to connect

When you connect Book2dream to another service — a property management system such as Oracle OPERA Cloud, a channel manager or distribution partner, a payment gateway under your own merchant account such as Webpay, Mercado Pago or PayPal, or your own analytics — we send data to it because you instructed us to. Those providers are not our subprocessors: your own agreement with each of them governs how it handles the data.

14International transfers

Our subprocessors operate in the countries listed above, so personal data collected in one country may be processed in another. Where the law of the exporting country restricts transfers, we rely on recognised safeguards, such as the European Commission's Standard Contractual Clauses, and on the transfer mechanisms permitted by Chilean Law No. 19.628 as amended by Law No. 21.719, Brazil's General Data Protection Law (LGPD) and other applicable laws.

15Helping you meet your obligations

• Guest requests — the platform lets you find, export, correct and delete a guest's data. If a guest contacts us directly, we pass the request on to you and help you answer it.
• Messaging records — on request, we provide the consent and opt-out records held for your property, so you can answer a regulator, carrier or guest.
• Assessments — we give you the information you reasonably need for data protection impact assessments and for consultations with supervisory authorities.
• This assistance is free unless a request is manifestly excessive.

16Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, your personal data, we notify you without undue delay and within 72 hours.

We tell you what happened, which data and people are likely to be affected, the likely consequences and what we are doing about it, and keep you updated as we learn more. Where you must notify an authority or the people affected, we help you do so.

17Return and deletion

You can export your data at any time during your subscription. When it ends, we keep your data available for export for 30 days and then delete it within 90 days, unless the law requires us to keep it. Copies held in encrypted backups are deleted as those backups expire.

18Information and audits

We make available the information reasonably needed to demonstrate compliance with these terms, including answers to one security questionnaire a year.

If that is not enough, or a supervisory authority requires it, you may audit our compliance once a year, on 30 days' written notice, during business hours, at your cost and under a duty of confidentiality. For our subprocessors, their own certifications and audit reports satisfy this right.

19Liability

Each party's liability under these terms is subject to the limitations in the Terms of Service, except where the law does not allow them to apply.

20Changes to these terms

We may update these terms to reflect changes in the law or the service. We will not reduce the protection they give your data without telling you in advance, and changes to the subprocessor list follow the notice process described above.

21Contact

Questions about these terms or our subprocessors can be sent to contact@book2dream.com.