Data Processing Addendum

1. Roles

The Customer is the controller of the personal data about its guests, staff and property owners that it enters into Domaniqo or connects from booking platforms. Domaniqo is the processor and processes that data only on the Customer's documented instructions, which are the Customer's use and configuration of the platform.

2. Purpose and data

Purpose: running the Customer's property operations, including bookings and stays, staff tasks, guest stay links and guest registration, owner reporting, support, security and legal compliance. Data subjects: guests, staff, property owners and the Customer's users. Data: contact details, booking and stay details, identity and registration details that guests provide where local law requires registration, staff work records and photos, and technical logs.

3. Confidentiality and security

People who process Customer data are bound by confidentiality and get access only when they need it. We apply the technical and organisational measures described on our Security page.

4. Subprocessors

We use these subprocessors to provide the service. We will update this list before a new subprocessor starts processing Customer personal data, and the Customer may object by contacting us.

• Vercel: web application hosting
• Railway: application and API hosting
• Supabase: database, authentication and file storage (Tokyo region)
• Postmark: transactional email
• Stripe: payments and billing
• Google Workspace: our business email
• Telegram, LINE and Meta (WhatsApp): messages, only for channels the Customer enables
• Microsoft Azure: identity-document scanning (Singapore region)

Services the Customer chooses to connect, such as booking platforms or Hospitable Connect for Airbnb (where available), exchange data under their own terms.

5. International transfers

Personal data may be processed outside the guest's or Customer's country, for example in Japan or the United States, with the safeguards that applicable law requires.

6. Requests from individuals

We help the Customer answer requests from individuals to access, correct or delete their data. Requests can be sent through our privacy request form.

7. Personal data breaches

We notify the Customer without undue delay after becoming aware of a personal data breach, with the information the Customer needs to meet its own legal deadlines, for example 72 hours under Thailand's PDPA.

8. Return and deletion

When the service ends, or on the Customer's request, we delete or return Customer personal data within 30 days unless the law requires us to keep it. Data received from Airbnb through Hospitable Connect (where available) is deleted within 30 days after the connection is removed.

9. Audits

On reasonable request, we provide the information needed to show that we meet this DPA.