Data Processing Agreement

Parties

This Data Processing Agreement is between Boostly Limited, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, and the customer using Connect by Boostly.

It forms part of the agreement between Boostly Limited and the customer using Connect by Boostly. It explains how personal data is processed when the customer uses the service.

1. Purpose

The purpose of this Data Processing Agreement is to set out the terms under which Boostly processes personal data on behalf of the customer in connection with Connect by Boostly.

2. Roles

For customer personal data processed through Connect by Boostly:

• Where the customer is the controller of the personal data, Boostly acts as processor.
• Where the customer acts as processor for another party, Boostly acts as sub-processor.

The customer is responsible for ensuring it has the right to use the service and to instruct Boostly to process the relevant personal data.

3. Scope of processing

Connect by Boostly may process personal data in connection with the following activities:

• Account creation and account management
• PMS connection and syncing
• Contact data syncing
• Guest and booking data syncing
• Listing and property data syncing
• Review and inquiry data syncing
• Support and troubleshooting
• Security logging
• Data export and deletion
• Billing and payment processing where relevant

4. Categories of data

Depending on how the customer uses the service, the following categories of data may be processed:

• Account owner details
• User account details
• Contact details
• Guest details
• Booking details
• Property and listing details
• Review content
• Support communications
• Security and login data
• Technical logs and usage records

5. Customer responsibilities

The customer is responsible for:

• Ensuring it is the controller of the personal data, or has authority from the controller.
• Ensuring it is authorised to connect each PMS or third-party system.
• Ensuring it is authorised to disclose personal data to Boostly for the purpose of providing the service.
• Providing any required privacy notices.
• Obtaining any required permissions, approvals, or internal authority.
• Ensuring any marketing carried out using the service complies with applicable privacy and electronic-marketing laws.

6. Boostly responsibilities

Boostly will:

• Process personal data only on the customer's documented instructions, except where required by law.
• Use personal data only to provide and support the service.
• Implement appropriate technical and organisational measures.
• Ensure persons authorised to process the personal data are under appropriate confidentiality obligations.
• Assist the customer with data-subject-rights requests where required.
• Notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data.
• Delete or return customer personal data in line with the service retention and deletion process at the end of the service, unless law requires retention.

7. Sub-processors

The customer gives general authorisation for Boostly to use sub-processors in connection with the service. A current list is available at /sub-processors.

Boostly will remain responsible for ensuring that any sub-processors used in connection with the service are subject to appropriate contractual obligations.

8. International transfers

Where personal data is transferred outside the United Kingdom or European Economic Area, Boostly will ensure that an appropriate transfer mechanism is in place where required by applicable law.

9. Security measures

Boostly maintains technical and organisational measures appropriate to the nature of the service and the risks involved. A summary is available at /privacy-security.

10. Data subject rights

Where the customer needs assistance in responding to a request relating to access, correction, deletion, restriction, portability, or objection, Boostly will provide reasonable assistance where required and where the customer cannot fulfil the request without Boostly's involvement.

11. Data breaches

If Boostly becomes aware of a personal data breach affecting customer personal data, Boostly will notify the customer without undue delay and provide reasonable information to support the customer's response obligations.

12. Term and termination

This Data Processing Agreement applies for as long as Boostly processes customer personal data in connection with the service. On termination of the service, Boostly will delete or return customer personal data in line with the retention and deletion process, unless retention is required by law.

13. Contact