Data processing agreement

‍

This Data Processing Agreement (“DPA”) is incorporated into, and is subject to the terms and conditions of the askwhisper.com Terms of Services (available at: https://askwhisper.com/terms/) or other agreement between askwhisper.com and Customer governing Customer’s use of the Services (the “Agreement”).

‍

1 – Definitions

‍

"Data Protection Laws" means, where applicable: (i) the General Data Protection Regulation ("GDPR"); (ii) national implementations of the GDPR in the European Union ("EU") and European Economic Area ("EEA"); (iii) the Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 ("UK Data Protection Law"); (iv) EU ePrivacy Directive 2002/58/EC; as amended by Directive 2009/136/EC; and (v) Swiss Federal Data Protection Act on 19 June 1992 and its Ordinance ("Swiss DPA").

"Model Clauses" means the standard contractual clauses for the transfer of Personal Data to third countries adopted under the GDPR, and as may be amended or superseded from time to time.

"Personal Data" means any information relating to an identified or identifiable individual where such information is contained in Customer Content.

"Personal Data Breach" means a breach of security that has resulted in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed by askwhisper.com and/or its Sub-Processors in connection with the provision of the Services.

"Restricted Transfer" means a transfer of Personal Data to a Third Country."Sub-Processor" means any Data Processor engaged by askwhisper.com to assist in fulfilling askwhisper.com's obligations under the Agreement.

"Third Country" means (a) to the extent the GDPR applies to the processing of Personal Data by askwhisper.com, a country outside of the EEA which is not subject to an adequacy decision by the European Commission; (b) to the extent the UK Data Protection Law applies to the processing of Personal Data by askwhisper.com, country which is not subject to an adequacy decision pursuant to Section 17A of the United Kingdom Data Protection Act 2018; and (c) to the extent the Swiss DPA applies to the processing of Personal Data by askwhisper.com, a country outside the EEA and/or Switzerland not subject to an adequacy decision by the Swiss Federal Data Protection and Information Commissioner ("FDPIC").

"UK Addendum" means the International Data Transfer Addendum issued by the Information Commissioner's Office under s.119(A) of the UK Data Protection Act 2018, as may be amended or superseded from time to time.The terms "Data Controller", "data subject", "Data Processor" and "processing" will have the meaning given to them under Data Protection Laws and "process", "processes" and "processed" will be interpreted accordingly. Any other terms not expressly defined here have the same meanings as in the Agreement.

‍

‍

‍

2 – Purpose and Scope

  1. This DPA governs the processing of Personal Data by askwhisper.com as a Data Processor on behalf of Customer, the Data Controller.
  2. The purpose of this DPA is to ensure compliance with Data Protection Laws as they may be amended, replaced or supplemented from time to time.
  3. The details of the processing operations, in particular the categories of Personal Data, the categories of data subjects, and the purposes for which Personal Data is processed by askwhisper.com, are specified in Annex 1.

‍

‍

3 – Processing by askwhisper.com

  1. askwhisper.com will process Personal Data only on documented instructions from Customer, unless required to do so by local law to which askwhisper.com is subject, such as EU or EU Member State law. In this case, askwhisper.com will inform Customer of that legal requirement before processing, unless the law prohibits this.
  2. askwhisper.com will process the Personal Data only for the specific processing purpose(s) as included in Annex 1, unless it receives further written instructions from Customer.
  3. askwhisper.com will immediately inform Customer if, in askwhisper.com's opinion, instructions given by Customer infringe Data Protection Laws.

‍

4 – Assistance to Customer

  1. Data Subject Request. askwhisper.com will promptly notify Customer of any request it receives from a data subject under Data Protection Laws ("Data Subject Request"). askwhisper.com will not respond to any Data Subject Request itself, unless authorized to do so by Customer. askwhisper.com will assist Customer in fulfilling its obligations to respond to data subjects' requests to exercise their rights, taking into account the nature of the processing.
  2. Data Protection Impact Assessment. askwhisper.com will assist the Customer with Customer's obligation under Data Protection Laws to carry out a data protection impact assessment related to Customer's use of the Services, taking into account the nature of processing and the information available to askwhisper.com.
  3. Consultations by supervisory authorities. askwhisper.com will assist the Customer in the cooperation or prior consultation with a supervisory authority, taking into account the nature of processing and the information available to askwhisper.com.

‍

5 – Confidentiality

‍

askwhisper.com will grant its personnel access to the Personal Data only to the extent strictly necessary for implementing, managing and monitoring of the Agreement. askwhisper.com will ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

‍

‍

‍

6 – Security

‍

askwhisper.com will at least implement the technical and organizational measures listed at https://askwhisper.com/security/ ("Security Measures") to ensure the security of the Personal Data. This includes protecting the data against a Personal Data Breach. In assessing the appropriate level of security, the parties will take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects. askwhisper.com may implement alternative adequate Security Measures from time-to-time while making sure the security level of the defined measures is not reduced.

‍

‍

‍

7 – Personal Data Breach

  1. In the event of a Personal Data Breach affecting Customer's Personal Data, askwhisper.com will notify Customer without undue delay after askwhisper.com has become aware of the Personal Data Breach. Such notification will contain, at least:
    1. a description of the nature of the Personal Data Breach;
    2. communicate the contact point where more information about the Personal Data Breach can be obtained;
    3. its likely consequences of the Personal Data breach; and
    4. the measures taken or proposed to be taken to address the Personal Data Breach, including to mitigate its possible adverse effects.
  2. When it is not possible for askwhisper.com to provide all this information at the same time, the initial notification will contain the information available at that time. Any further information will, as it becomes available, subsequently be provided without undue delay. askwhisper.com will also take appropriate and reasonable steps to contain, investigate, and mitigate any Personal Data Breach.

‍

8 – Documentation and Compliance

  1. askwhisper.com will promptly and adequately handle any inquiries from Customer about the processing of Personal Data in accordance with this DPA.
  2. askwhisper.com will make available to Customer all information necessary to demonstrate compliance with the obligations under this DPA or applicable Data Protection Laws. At Customer's request, askwhisper.com will also permit and contribute to audits of the processing activities covered by this DPA, at reasonable intervals or if there are indications of non-compliance.
  3. Customer may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of askwhisper.com if mutually agreed and with reasonable notice.

‍

9 – Use of Sub-Processors

  1. askwhisper.com has Customer's general authorization for the engagement of Sub-Processors listed at https://askwhisper.com/subprocessors/. At least 5 days prior to authorizing any new Sub-Processor to process Personal Data, askwhisper.com will provide written notice to Customer (via email) to enable Customer to object to such changes. When Customer objects, the parties will discuss Customer's concerns in good faith with the intention to achieve a commercially reasonable solution. If the parties are not able to find a solution, askwhisper.com and Customer each have the right to terminate the Agreement, including any related Order, without liability to either party.
  2. Where askwhisper.com engages a Sub-Processor, it will do so by way of a contract which imposes on the Sub-Processor, in substance, the same data protection obligations as the ones imposed on askwhisper.com in accordance with this DPA. askwhisper.com will ensure that the Sub-Processor complies with the obligations to which askwhisper.com is subject pursuant to this DPA and applicable Data Protection Laws.
  3. askwhisper.com will remain fully responsible to Customer for the performance of the Sub-Processor's obligations in accordance with its contract with askwhisper.com.

‍

10 – International Data Transfers

  1. Any transfer of Personal Data to a Third Country or to an international organization by askwhisper.com will be done only on the basis of documented instructions from Customer or in order to fulfill a specific requirement under local law to which askwhisper.com is subject and will take place in compliance with Data Protection Law. askwhisper.com may transfer Personal Data to its Sub-Processors located in a Third Country, subject to the notification requirements of Section 9.
  2. Customer agrees that where askwhisper.com engages a Sub-Processor for carrying out specific processing activities under the Agreement and those activities involve a transfer of Personal Data to any Third Country, askwhisper.com and the Sub-Processor can ensure compliance with Data Protection Laws by using the Model Clauses and, where relevant, the UK Addendum, provided the conditions for the use of those Model Clauses are met.

‍

‍

11 – Termination and Deletion

‍

When the Agreement is terminated, askwhisper.com will delete all Personal Data processed on behalf of Customer or, if requested by Customer, return all Personal Data to Customer and delete existing copies unless Data Protection Laws require storage of the Personal Data. Until the data is deleted or returned, askwhisper.com will continue to ensure compliance with this DPA.

‍

‍

‍

Annex 1 – Data Processing Details

‍

Nature of processing: askwhisper.com processes Personal Data to provide, maintain, support, and improve the Services.Purpose(s) for which the Personal Data is processed: askwhisper.com will process Personal Data as necessary to provide the Services in accordance with the Agreement and as further instructed by Customer when using the Services. Categories of data subjects

  1. Guests of Customer
  2. The individual making a booking other than the Guest
  3. Hotel employees
  4. Individuals authorized to use the askwhisper.com platform
  5. Any other individual communicating with Customer via askwhisper.com's Services

‍Categories of Personal Data processed

  1. Communication content: which may include Personal Data or other personalized characteristics, depending on the communication content as determined by you as the Customer or as voluntarily provided by the guest when communicating with Customer via the Services
  2. Traffic data: which may include Personal Data metrics about the duration and timing of a conversation with Guests
  3. Guest data: such as phone number, first name, last name, email address, profile image, and details around the Guest's stay depending on Customer's use of the Services, such as: reservation details (e.g. room number), and specific Guests booking details and requests
  4. End User account data: first name, last name, email address, log-in details
  5. Technical data: askwhisper.com may process technical data in relation to provide and manage the askwhisper.com Services, such as: IP address, device type, user agent, operating system, browser type, timestamp of visit, UUID, cookies, UserID (where applicable).

‍Special Categories of Personal Data

  1. ‍The parties do not plan to process special categories of Personal Data.

‍Duration of the processing

  1. ‍Subject to Section 11 of the DPA, askwhisper.com will process Personal Data for as long as Services are provided under the Agreement.

‍