Data Processing Agreement (DPA)

Last updated: 2026-08-02

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between CHATOTELLE LLC ("Processor") and the hotel or business entity using the Service ("Controller").

This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the Service.

2. Definitions

"Personal Data" means any information relating to an identified or identifiable individual processed by the Processor on behalf of the Controller through the Service.

"Breach" means unauthorized or unlawful access to, disclosure of, alteration of, or destruction of Personal Data. A Breach does not include errors, inaccuracies, or omissions in AI-generated responses — including but not limited to incorrect service information, pricing, or availability — unless such errors directly involve unauthorized processing of Personal Data.

"Subprocessor" means any third-party engaged by the Processor to process Personal Data on the Controller's behalf.

"Session" means a 24-hour Customer Service Window (CSW) opened when a guest initiates contact through the assigned WhatsApp number, consistent with the definition used by Meta Platforms, Inc..

"Flight Booking Service" means the optional feature of the Service that allows a guest to search for, receive offers for, and book flight tickets, as further described in Section 14 (Flight Booking Processing).

3. Duration

This DPA is effective for the duration of the Terms of Service and terminates automatically upon expiration or termination thereof.

4. Roles of the Parties

The Controller determines the purposes and means of processing personal data. The Processor processes personal data solely on behalf of the Controller and in accordance with its instructions.

5. Scope of Processing

The Processor processes personal data only as necessary to provide the Service, including guest communications via WhatsApp, service request management, AI-generated responses, flight booking where enabled, staff dashboard operations, and session credit tracking.

6. Categories of Data

Personal data processed on behalf of the Controller includes:

Guest Data: - Phone number and WhatsApp identifier (JID) - Name and gender - Room number and preferred language - Full conversation history (text, media, reactions) - Message timestamps and delivery statuses - Bot interaction status and session records - Staff-written notes (memos) on guest records - AI-generated behavioral summaries

Flight Booking Data (where the Flight Booking Service is enabled, in addition to the Guest Data above): - Date of birth and contact email - Booking and payment transaction history - Passport number, expiry date, nationality, and issuing country (international flights only)

Hotel & Staff Data: - Hotel identity, address, and contact information - Manager name and contact details - Department configurations and policies - Products, services, and menu listings - AI behavioral rules and configurations - Meta API credentials (phone number ID, access token) - Session credit balance and transaction history

Operational Data: - Service request tickets (title, description, status history, department assignment, associated items, timestamps) - AI usage metrics (model, token consumption, request type) - Dashboard access logs and technical session data

7. Categories of Data Subjects

Data subjects include hotel guests who interact with the WhatsApp assistant, guests who use the Flight Booking Service, hotel staff who access and operate the dashboard, and hotel managers whose contact details are stored as part of the hotel profile.

8. Purpose of Processing

Personal data is processed solely for the purpose of providing, maintaining, and improving the Service, including: operating the WhatsApp AI assistant, generating and routing service request tickets, searching for and booking flights where the Flight Booking Service is enabled, enabling staff dashboard operations, tracking session credit consumption, and ensuring system security and reliability.

9. Legal Basis for Processing

The Processor processes personal data under the following legal bases: contractual necessity (to deliver the Service), and legitimate interests (to secure and improve the platform).

The Controller is solely responsible for ensuring a valid legal basis exists for each processing activity and for providing documented instructions to the Processor accordingly. The Processor shall not be responsible for verifying the validity of the legal basis provided by the Controller.

10. WhatsApp Number Ownership

All WhatsApp phone numbers used to deliver the Service are owned and controlled exclusively by the Processor. Guest interactions occur through numbers assigned by the Processor. No number is registered under or transferred to the Controller at any time, including upon termination.

11. WhatsApp Number Exit Protocol

Guest records are keyed to the WhatsApp number through which they were created. Where the Controller's assigned number is retained, reserved, deactivated, or replaced in accordance with the exit protocol set out in the Terms of Service, associated guest data continues to be governed by this DPA until deleted in accordance with Section 23 (Data Retention & Deletion). A change of assigned number does not itself create new categories of data or trigger processing beyond what is described in this DPA.

12. Human Override & Staff Communications

The Service permits authorized hotel staff to disable the AI and send messages directly to guests through the platform. Messages sent by staff in this manner are stored as part of the conversation record. The Processor processes such messages solely as instructed by the Controller and bears no responsibility for their content.

13. Outbound Marketing Messages

Where the Controller uses the Service to send outbound or marketing-type messages to guests, the Controller is solely responsible for obtaining guest consent and ensuring compliance with applicable laws. The Processor facilitates delivery only on the Controller's documented instructions.

14. Flight Booking Processing

Where a Hotel Partner enables the Flight Booking Service, the Processor collects, processes, and stores additional Personal Data on behalf of the Controller as described in Section 6 (Categories of Data), including, for international flights, passport-level Advance Passenger Information.

The Processor is not independently accredited by IATA or ARC as a travel agency and relies on the Fare Data Provider's accreditation to issue tickets, acting as a reseller and merchant of record for flight booking transactions. The Fare Data Provider and the payment provider identified in Section 18 (Subprocessors) each act as Subprocessors with respect to this processing.

Passport numbers, dates of birth, and other flight-booking data of heightened sensitivity receive field-level encryption in addition to the security measures described in Section 17 (Security Measures), and passport-level data is retained for no longer than 12 months after the travel date, unless a longer period is required by applicable law, airline, or immigration retention rules, before deletion.

15. No Automated Decision-Making with Legal Effect

The AI system does not make automated decisions that produce legal or similarly significant effects on guests. All AI outputs are informational or operational in nature — routing requests, providing information, creating service tickets, presenting flight offers — and final decisions remain with the guest and hotel staff.

16. Processor Obligations

The Processor shall: - Process data only on documented instructions from the Controller - Ensure confidentiality of all personnel with access to data - Implement appropriate technical and organizational security measures - Not use personal data for its own purposes beyond service delivery - Not sell, share, or use data for advertising or model training - Assist the Controller in fulfilling data subject rights requests - Notify the Controller of any Breach within 72 hours of becoming aware - Notify the Controller of intended Subprocessor changes with reasonable prior notice

17. Security Measures

The Processor implements appropriate security measures including: - Encrypted data transmission (HTTPS/TLS) - Access control, authentication, and role-based permissions - Firewall and infrastructure hardening - Rate limiting and abuse prevention mechanisms - Restricted database access with compound authorization checks

18. Subprocessors

The Controller authorizes the use of the following Subprocessors: - Meta Platforms, Inc. (WhatsApp Business API) - Google Gemini (AI response generation) - Firebase by Google (dashboard authentication) - Stripe (payment processing for Flight Booking Service transactions) - Duffel (flight search and booking fulfillment, where the Flight Booking Service is enabled) - Hetzner (infrastructure hosting — Germany)

The Processor shall notify the Controller in writing of any intended addition or replacement of Subprocessors. The Controller shall have 10 business days to raise objections. The Processor shall ensure all Subprocessors are bound by data protection obligations consistent with this DPA.

19. International Data Transfers

Personal data may be processed in countries outside the Controller's jurisdiction, including the United States and Germany. Where the Flight Booking Service is used for international travel, Advance Passenger Information is additionally transmitted to the operating airline and the relevant destination-country immigration authorities, as legally required to complete the booking. The Processor ensures appropriate safeguards are in place in accordance with applicable laws.

20. Data Subject Rights

The Processor shall assist the Controller in responding to requests from data subjects, including access, correction, deletion, and portability requests, where applicable, within 30 days of a documented instruction from the Controller.

Guests wishing to exercise their data rights should contact the Hotel Partner directly as the Controller of their personal data. Hotel Partners may contact the Processor at contact@chatotelle.com to facilitate such requests.

21. Personal Data Breach Notification

In the event of a Breach, the Processor shall notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware. Notification shall include: - The nature of the Breach - Categories and approximate number of affected data subjects - Likely consequences of the Breach - Measures taken or proposed to address the Breach

22. Data Protection Impact Assessment

Where the Controller identifies a processing activity that may present elevated risk to data subjects, the Processor shall provide reasonable assistance including relevant technical documentation and information about processing activities to support the Controller's assessment.

23. Data Retention & Deletion

Personal data is retained for as long as necessary to provide the Service — specifically, to allow the Service to recognize returning guests and personalize future interactions based on their history and preferences. This is a bounded, purpose-linked retention period, not an indefinite one: it ends at account termination. Upon termination of the Terms of Service, all associated guest records, conversation history, tickets, and linked operational data are permanently deleted in cascade within 30 days, subject to legal or regulatory obligations.

AI usage logs are retained for up to 12 months for billing verification purposes. The Processor may retain aggregated and anonymized data derived from operational activity for internal analytics. Such data shall not contain Personal Data and shall not be attributable to any individual.

Passport numbers, expiry dates, nationality, and issuing country collected for international flight bookings are retained for no longer than 12 months after the travel date, unless a longer period is required by applicable law, airline, or immigration retention rules, and are deleted thereafter.

24. Audit Rights

The Processor shall, upon request, make available reasonable information necessary to demonstrate compliance with this DPA. This may include relevant certifications, security documentation, or third-party audit summaries, subject to confidentiality and security constraints.

Audits may be initiated by the Controller once per calendar year under normal circumstances, or at any time upon documented suspicion of a Breach or material non-compliance. The Controller shall bear the costs of audits unless a material breach of this DPA is confirmed.

25. Liability

The Processor's total liability under this DPA, whether arising from contract, tort, or otherwise, shall not exceed the total amount paid by the Controller in the three months preceding the claim, consistent with the limitation set out in the Terms of Service.

The Processor shall not be liable for: - Errors or inaccuracies in AI-generated responses that do not constitute a Breach as defined in Section 2 - Indirect, incidental, or consequential damages - Breaches caused by Subprocessors where the Processor exercised reasonable care in their selection and monitoring

26. Confidentiality

Each party shall keep this DPA and all information received about the other party in connection with it strictly confidential. Neither party shall disclose such information without prior written consent of the other, except where required by law or where the information is already in the public domain.

27. Governing Law

This DPA shall be governed by the laws of the State of Wyoming, United States, consistent with the Terms of Service.

28. Contact

For any data protection inquiries, contact contact@chatotelle.com.