Data Processing Agreement

This agreement governs how Apartop processes, on behalf of its customers, the personal data of guests, staff, owners and other people that customers manage with Apartop. It complies with Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 of Spanish Organic Law 3/2018 (LOPDGDD), and includes annexes for the other countries where Apartop is used.

The account holder accepts it in the app (when creating the account, on the “Today” card or in Settings › Privacy and data). Apartop records the accepted version, the date and time, the user and the IP address, and the account holder can download it as a PDF with the account details. This English version is a translation: the Spanish version prevails.

Parties

• Controller (the “Customer”): the natural or legal person holding the Apartop account who accepts this agreement (host, owner, agency or property manager, community, complex or reception), identified by the name or company name and tax ID recorded in the acceptance.
• Processor (“Apartop”): GLENLAKE SOFT SL, tax ID B13872437, registered office at Calle Haya 9, Portal 1, 5.º A, 41927 Mairena del Aljarafe (Sevilla), España, operator of https://apartop.com. Data protection contact: hola@apartop.com.

Where the Customer uses Apartop to manage third parties' accommodation (for example, an agency managing its owners' properties), the Customer acts towards Apartop as controller or as processor for those third parties; in the latter case Apartop is a sub-processor and the Customer warrants that it has its controller's authorisation for this engagement.

1. Subject matter and relationship with the terms of use

1.1. Apartop provides the Customer with software for managing holiday accommodation (web application and mobile apps). To do so it processes personal data for which the Customer is the controller. This agreement sets out the terms of that processing.

1.2. This agreement forms part of the terms of use. On data protection matters it prevails over them. The country annexes prevail over the body of the agreement in what they regulate for their jurisdiction.

1.3. This agreement does not cover processing that Apartop carries out as controller: account and user data (name, email, sign-in), billing of the subscription, security of the service and support. That processing is governed by the privacy policy.

2. Duration

2.1. The agreement applies from its acceptance and for as long as the Customer has the account, and afterwards for the time needed to return and delete the data under clause 13.

2.2. The confidentiality and security obligations remain in force for as long as Apartop retains any Customer data.

3. Nature and purpose of the processing

3.1. Nature: collection (by the Customer, its staff or the data subjects themselves through Apartop's forms, such as online check-in), recording, organisation, structuring, storage, consultation, adaptation, use, disclosure by transmission when the Customer so instructs, alignment, restriction, erasure and destruction.

3.2. Purpose: to provide the Customer with the Apartop features it chooses to use, including:

• management of properties, calendars and bookings (including those imported via iCal or by email from platforms such as Airbnb, Booking or VRBO) and direct bookings;
• online guest check-in, reading of the identity document, signature and preparation of the guest registers required by the country of the property (for example SES.Hospedajes in Spain, Alloggiati Web in Italy, the fiche individuelle de police in France, the Meldeschein in Germany, KBS in Turkey, FNRH in Brazil or TM.30 in Thailand) and, where the Customer so instructs and the feature exists, their submission to the authority;
• messages and emails to guests, the property guide, surveys, extras and deposits;
• organisation of cleaning, maintenance and office staff, their notifications and payments;
• invoices, expenses, tourist tax, statistics, statements and contracts with owners, and communications with neighbours and residents in communities and complexes;
• copies of files in the Customer's Google Drive, if connected, and any other integrations the Customer activates.

3.3. Apartop does not use the data for its own purposes: it does not sell or disclose it, or use it for advertising or to train artificial intelligence models. It may only derive aggregated, anonymous information about the operation of the service (for example, the number of bookings or emails sent) to maintain and improve it.

4. Types of personal data

Depending on the features the Customer uses and the country of each property:

• Identification and contact data: first and last name, email, telephone, language, country of residence, address.
• Identity document and guest register data: document type, number and support number, issuing country and dates, nationality, date and place of birth, sex, relationship of minors to the accompanying adult and any other data required by the country's rules (for example, booking payment details in Spain, CPF or purpose of travel in Brazil, or entry details in Thailand).
• Images: photos of the identity document when the guest uploads them, digitised handwritten signature, photos of the property, cleanings, inspections, incidents and works (in which people may appear incidentally).
• Booking and stay data: dates, number of guests, amounts, channel, messages, arrival time, extras, deposits and surveys.
• Staff data: name, contact details, language, tasks, hours, payments and, if they link it, their Telegram user.
• Owners, clients and suppliers: name or company name, tax ID, contact details, bank account, signed contracts, statements and invoices.
• Neighbours and residents of communities and complexes: name, unit, contact details, notices, parcels, incidents, lost property and votes.

Special categories and data of minors. Apartop does not need special categories of data (Art. 9 GDPR) and the Customer must not enter them unless required by law. If a country's rules provide for them (for example, voluntary fields of Brazil's FNRH), the Customer decides whether to collect them and Apartop processes them only for that purpose. Guest registers include data of minors, which Apartop processes with the same measures and only to fulfil that obligation of the Customer.

5. Categories of data subjects

• Guests and their companions, including minors, and people who book or make enquiries.
• The Customer's staff and collaborators: cleaning, maintenance, reception, managers and office.
• The Customer's owners, agency clients, suppliers and contractors.
• Neighbours, residents and owners in communities and complexes.
• Other users the Customer invites to its account.

6. Apartop's obligations as processor

Apartop undertakes to:

1. Process the data only on the Customer's documented instructions, including with regard to international transfers. Documented instructions are this agreement and the Customer's configuration and use of the application (for example, enabling online check-in, connecting a calendar, submitting a guest register or deleting a guest). If Apartop is required by Union or Member State law to carry out other processing, it will inform the Customer beforehand, unless that law prohibits it.
2. Inform the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
3. Ensure confidentiality: persons authorised by Apartop to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and only access the data where necessary to provide the service, resolve an incident or handle a request from the Customer.
4. Implement the security measures in clause 8 (Art. 32 GDPR).
5. Respect the conditions for engaging sub-processors in clause 9.
6. Assist the Customer in responding to data subjects' rights (clause 10) and in meeting its obligations on security, breach notification, impact assessment and prior consultation (clauses 11 and 12), taking into account the nature of the processing and the information available to it.
7. Return or delete the data at the end of the service (clause 13).
8. Make available to the Customer all information necessary to demonstrate compliance with this agreement and allow for audits (clause 14).
9. Keep a record of the processing activities carried out on behalf of the Customer (Art. 30(2) GDPR).
10. Not disclose the data to third parties, except to authorised sub-processors, to recipients designated by the Customer's instructions (clause 7.3) or where required by law.

7. The Customer's obligations

7.1. The Customer, as controller, warrants that:

• it has a legal basis to process the data it enters or collects with Apartop and to entrust its processing to Apartop;
• it informs data subjects about the processing (for example, with the online check-in information, which it can adapt) and responds to their rights;
• the data is accurate and limited to what is necessary, and it does not enter special categories of data unless required by law;
• its instructions comply with the law applicable in the country of each property and of the data subjects;
• it carries out the impact assessments, registrations, records and notifications that fall to it as controller (for example, Quebec's privacy impact assessment or the notification of standard contracts in Turkey; see the annexes).

7.2. The Customer is responsible for the credentials it stores in Apartop (for example, those for SES.Hospedajes or its locks) and for managing the users and permissions of its account.

7.3. Recipients chosen by the Customer. Where the Customer instructs disclosure of data to third parties it chooses (authorities to which it submits guest registers, booking platforms, smart locks, its own Google Drive, the AI assistants it connects to its account, its owners or its staff), those third parties are not Apartop's sub-processors: they are independent controllers or the Customer's own providers, and the Customer decides whether it has a basis to disclose the data to them.

8. Security measures

Taking into account the state of the art, costs and risks, Apartop implements the following technical and organisational measures, which it may improve without reducing the level of protection:

• Location: the database and files are hosted by Supabase in the European Union region of Ireland (eu-west-1), with the provider's backups in the same region.
• Account separation and access control: every row of data belongs to an account and the database enforces row-level security (PostgreSQL Row Level Security), so each query runs with the user's session and only sees that user's accounts. Within each account there are roles (account holder, manager, cleaning, maintenance) and permissions by module and by property.
• Authentication: sign-in through identity providers using OAuth (Google); Apartop does not store user passwords. Sessions expire, and links for guests, staff and owners are personal and hard to guess.
• Encryption: all communications are encrypted (HTTPS/TLS). The database provider encrypts data at rest. Third-party credentials stored by the Customer (Google Drive tokens, passwords for guest registration services, lock access) are additionally encrypted with AES-GCM using a key that is not stored in the database. For AI assistant tokens only a hash is stored.
• Identity documents, photos and signatures: in private storage, accessible only through signed temporary links and only to managers with permission. The MRZ of the document is read on the guest's own device. Identity data is deleted automatically when the legal retention period of the guest register of the property's country expires (for example, 3 years from check-out in Spain under Royal Decree 933/2021; elsewhere, the period set by that country's regulatory module in Apartop).
• Data minimisation: the check-in form only asks for the data required by the rules of the property's country, and only from the people those rules apply to. Full-size photos can move to the Customer's Google Drive; Apartop keeps a thumbnail.
• Network and infrastructure: the application runs on Cloudflare, with protection against denial-of-service attacks and abusive traffic, and no self-managed servers.
• Traceability: account change history (who changed what and when, without passwords or credentials) for 180 days, and a log of AI assistant queries and changes for one year.
• Development and operations: automated tests, security review of changes, protection against request forgery and SSRF, secrets kept out of the code, production access limited to those who need it, and error logging without guest data where possible.
• Continuity: the database provider's backups, and the Customer can download all its data at any time (Settings › Privacy and data).

9. Sub-processors

9.1. General authorisation. The Customer authorises Apartop to engage the sub-processors listed below. Apartop imposes on each of them, by contract, data protection obligations equivalent to those in this agreement and remains liable to the Customer for their performance.

9.2. Changes. Apartop will give at least 30 days' notice of any addition or replacement of a sub-processor, by email to the account holder and on this page. The Customer may object on reasonable data protection grounds by writing to hola@apartop.com within that period. If no solution is found, the Customer may close the account before the change takes effect and Apartop will refund the prepaid, unused part of its subscription. In urgent cases (for example, replacing a provider for security reasons) the notice period may be shorter and notice will be given as soon as possible.

9.3. List of sub-processors (as of 12 October 2026):

9.4. Providers that do not process data on the Customer's behalf. Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, LLC, USA) collects the subscription to Apartop and only processes the Customer's billing data, as Apartop's provider in its capacity as controller; it receives no guest data. Google, when the Customer signs in with its Google account or connects its Google Drive, processes the data under the Customer's own agreement with Google: Apartop only accesses the files the application itself creates in that Drive (drive.file scope).

10. Data subjects' rights

10.1. If a data subject contacts Apartop to exercise their rights (access, rectification, erasure, objection, restriction, portability or others recognised by the applicable law) over data for which the Customer is controller, Apartop will forward the request to the Customer within 5 business days and will not respond to the data subject except to refer them to the Customer or with the Customer's authorisation.

10.2. Apartop provides tools for the Customer to handle rights itself: view, correct, export and delete guest, booking, staff and owner data, and download all account data. If the Customer needs further help, Apartop will provide it within a reasonable time.

11. Security breaches

11.1. Apartop will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of it, of any personal data breach affecting data for which the Customer is controller, by email to the account holder and, where possible, by a notice in the application.

11.2. The notification will include, to the extent known (and otherwise as soon as it becomes known): the nature of the breach, the categories and approximate number of data subjects and records concerned, the contact point for more information, the likely consequences and the measures taken or proposed to address the breach and mitigate its effects.

11.3. It is for the Customer, as controller, to notify the supervisory authority and data subjects where required (in the EU, within 72 hours under Art. 33 GDPR; in other countries, within the periods of their annexes). Apartop will help with the information it has. Apartop documents all security breaches, including those not notified.

12. Impact assessments and prior consultations

Apartop will assist the Customer, where appropriate, in carrying out data protection impact assessments and prior consultations with the supervisory authority, providing the information on the processing, data location, sub-processors and security measures contained in this agreement and any other information it reasonably requests.

13. End of the service: return and deletion

13.1. The Customer can download all its data at any time, in commonly used formats (JSON and CSV), from Settings › Privacy and data, including before closing the account.

13.2. When the Customer deletes the account it has 14 days to cancel the deletion. After that period, Apartop deletes all data for which the Customer is controller, unless Union or Member State law requires it to retain it. The provider's backups are overwritten in their ordinary cycle and, in the meantime, are used only to restore the service. Files in the Customer's Google Drive remain in its Drive.

13.3. Retention of data that the law requires the Customer to keep (for example, the guest register or invoices) is the Customer's responsibility: it must download them before deleting the account.

14. Information and audits

14.1. Apartop will make available to the Customer the information necessary to demonstrate compliance with this agreement (this document, the description of the security measures, the list of sub-processors and the certifications or reports of its providers that it can share) and will answer the Customer's reasonable questionnaires.

14.2. If that information is not sufficient, the Customer may carry out, itself or through an independent auditor bound by confidentiality, one audit per year with 30 days' notice, during business hours, without affecting the security or data of other customers and at its own cost. It may also do so when required by a supervisory authority or after a security breach affecting it.

15. International transfers

15.1. The data is hosted in the European Union. Apartop only transfers data outside the European Economic Area to the sub-processors in clause 9 and with one of the safeguards in Chapter V GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework for certified companies) or the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, with any supplementary measures needed.

15.2. Where the Customer is outside the European Economic Area, the transfer of data from its country to Apartop and its hosting in the EU are also governed by the annex for its country.

16. Liability

Each party is liable for its obligations under Article 82 GDPR and the applicable law. Otherwise, the liability clause of the terms of use applies, to the extent permitted by law. If Apartop itself determines the purposes and means of any processing, it will be considered a controller for that processing.

17. Changes to the agreement

17.1. Apartop may update this agreement to reflect legal changes, new features or sub-processors (with the notice in clause 9.2) or guidance from authorities. Each version has a number and a date. New versions are communicated by email and in the application, and the account holder is asked to accept them again.

17.2. Until the Customer accepts the new version, the previous one continues to apply, except for changes required by law. If the Customer does not agree with the new version, it may close the account.

18. Governing law and jurisdiction

This agreement is governed by Spanish law and the GDPR, without prejudice to the mandatory data protection rules of the Customer's country set out in the annexes. Disputes will be resolved under the jurisdiction clause of the terms of use, without prejudice to the powers of supervisory authorities.

Annex: countries other than Spain

These annexes apply where the Customer, its properties or the data subjects are subject to the data protection law of each country. They supplement the body of the agreement and prevail over it in what they regulate. Where an annex refers to an authority's standard clauses, those clauses are incorporated as published by the authority and prevail in case of conflict.

A. European Union and European Economic Area (France, Italy, Germany and others)

The body of the agreement complies with Article 28 GDPR in every Member State, and its electronic acceptance meets the written form requirement of Article 28(9). The competent supervisory authority for the Customer is the one of its establishment (for example, the CNIL in France, the Garante in Italy or the Land authority in Germany). For Germany, this agreement is the data processing agreement (Auftragsverarbeitungsvertrag) under Article 28 GDPR.

B. United Kingdom

• Where the processing is subject to the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), references to the GDPR are to the UK GDPR, and the supervisory authority is the Information Commissioner's Office (ICO).
• The transfer of the Customer's data from the United Kingdom to Apartop (Spain) is covered by the Data Protection Act 2018 (Schedule 21), which treats transfers to European Economic Area states as approved; no other instrument is needed.
• For onward transfers to sub-processors in countries without UK adequacy, the ICO's International Data Transfer Addendum to the EU standard contractual clauses applies or, for certified companies, the UK Extension to the EU-U.S. Data Privacy Framework. For the purposes of the Addendum: the parties are those of this agreement; the clauses are those of Decision (EU) 2021/914 in the relevant module; the annex information is that of this agreement; and either party may end it under section 19 of the Addendum.

C. Switzerland

Where the processing is subject to the Federal Act on Data Protection (FADP, in force since 1 September 2023), references to the GDPR are to the FADP and the authority is the Federal Data Protection and Information Commissioner (FDPIC). Switzerland recognises EEA states as providing adequate protection. Onward transfers use the EU standard contractual clauses with the adaptations recognised by the FDPIC or, for certified companies, the Swiss-U.S. Data Privacy Framework.

D. Canada and Quebec

• Canada (PIPEDA and provincial laws): the Customer remains accountable for the information it entrusts to Apartop as a service provider; this agreement is the contractual means of ensuring a comparable level of protection. Apartop will notify the Customer of any security breach within the periods in clause 11 so that it can assess whether there is a real risk of significant harm, report it and keep the breach record required by law.
• Quebec (Act respecting the protection of personal information in the private sector, as amended by Law 25): this agreement is the written contract with the service provider. Apartop will use the information only to perform the mandate, apply the security measures in clause 8, not retain it when the contract ends (clause 13), notify the Customer's person in charge of the protection of personal information without delay of any confidentiality incident or attempted incident, and allow the verifications in clause 14.
• Communication outside Quebec and privacy impact assessment (PIA): Apartop stores the data outside Quebec, in the European Union (Ireland). Before communicating personal information outside Quebec, the Customer must carry out a privacy impact assessment taking into account the sensitivity of the information, the purpose, the protection measures (including contractual ones) and the legal framework of the destination. To help, Apartop provides this information: data location and sub-processors (clause 9), security measures (clause 8), purposes (clause 3) and the legal framework at destination (the GDPR, with independent supervisory authorities and effective rights of access, rectification, erasure and redress). Apartop will answer any additional questions the Customer needs for its assessment.

E. Brazil

• Under the General Data Protection Law (Law 13,709/2018, LGPD), the Customer is the controller and Apartop the operator, which processes the data in accordance with the controller's instructions (Art. 39) and with the security measures of Art. 46. In the FNRH, where the Ministry of Tourism acts as controller and the accommodation as operator, Apartop acts on behalf of the Customer.
• International transfer: the data is hosted outside Brazil (European Union). The transfer relies on the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024), which are incorporated into this agreement without changes, with the Customer as exporter and Apartop as importer, and prevail over it for transfers from Brazil.
• Incidents: Apartop will notify the Customer under clause 11 so that it can report to the ANPD and data subjects, within the 3 business days of Resolution CD/ANPD No. 15/2024, incidents that may entail relevant risk or harm.
• Sensitive data the FNRH may ask for (for example, race or colour, or disability) is voluntary for the guest; the Customer decides whether to collect it and Apartop does not use it for anything else.

F. Mexico

• Under the Federal Law on the Protection of Personal Data Held by Private Parties (DOF 20-03-2025), the Customer is the controller (responsable) and Apartop the processor (encargado). This agreement is the legal instrument evidencing the relationship.
• Apartop processes the data only in accordance with the Customer's instructions, does not use it for other purposes, applies the security measures of clause 8, keeps it confidential, deletes it at the end of the relationship unless legally required to keep it, and only discloses it to the sub-processors in clause 9, under the same obligations.
• Communications between the Customer and Apartop as processor do not require data subjects' consent or inclusion in the privacy notice as transfers. The Customer must have its own privacy notice and respond to ARCO rights; Apartop will help under clause 10.
• Apartop will notify the Customer of security breaches under clause 11 so that it can inform data subjects immediately where their rights are significantly affected.

G. Turkey

• Under Law No. 6698 on the Protection of Personal Data (KVKK), the Customer is the data controller (veri sorumlusu) and Apartop the data processor (veri işleyen). Apartop applies the security measures of clause 8 and acknowledges the joint liability for data security provided for in Art. 12.
• Transfer abroad: the data is hosted outside Turkey (European Union). The transfer relies on the controller-to-processor standard contract approved by the Personal Data Protection Authority (KVKK), which is used without changes and in its Turkish text, and which Apartop will sign at the Customer's request. The Customer, as exporter, must notify it to the Authority within 5 business days of signature (Art. 9 KVKK).
• The Customer must register with VERBİS where applicable and inform data subjects. Apartop will notify the Customer of security breaches under clause 11 so that it can notify the Authority and data subjects within the period the Authority sets.

H. Thailand

• Under the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the Customer is the data controller and Apartop the data processor. Apartop processes the data only on the Customer's instructions, applies the security measures of clause 8, notifies it of security breaches under clause 11 and keeps records of processing activities (section 40).
• Transfer abroad: the data is hosted outside Thailand (European Union). The transfer relies on the appropriate safeguards of section 29 and the Personal Data Protection Committee (PDPC) notification on international transfers (in force since 24 March 2024), which accepts standard contractual clauses with the content required by the PDPC; for this purpose the parties apply the clauses of this agreement and, where needed, the standard contractual clauses of Decision (EU) 2021/914.
• The Customer must notify security breaches to the PDPC within 72 hours of becoming aware of them where required; that is why Apartop notifies it within 48 hours at most.

I. United States

• Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA, Cal. Civ. Code § 1798.100 et seq.), or equivalent privacy laws of other states apply to the Customer, Apartop acts as its “service provider” or “processor”, and processes personal information only for the limited and specified business purposes of this agreement: providing the Apartop service described in clause 3.
• Apartop does not sell or share personal information; does not retain, use or disclose it for any other purpose, including any commercial purpose other than the specified business purposes, or outside the direct business relationship with the Customer; and does not combine it with personal information it receives from other persons or collects on its own, except as permitted by the regulations.
• Apartop complies with the obligations the CCPA imposes on service providers and provides the same level of privacy protection as required by the CCPA. Apartop will notify the Customer if it determines that it can no longer meet those obligations.
• The Customer may take reasonable and appropriate steps to ensure that Apartop uses the personal information consistently with its obligations (clause 14) and, upon notice, to stop and remediate any unauthorised use.
• Apartop will help the Customer respond to consumer requests (clause 10) and only engages subcontractors under a written contract imposing the same restrictions (clause 9). Apartop certifies that it understands these restrictions and will comply with them.

Version history

• Version 1.0 (12 October 2026): first version.

Privacy · Terms · Data processing · hola@apartop.com