Data Processing Agreement

1. Roles & scope

The customer is the controller of the property and any personal data it makes available through the service; Compass is the processor and processes that data only to provide the service and only on the customer’s documented instructions (these Terms, the product configuration, and any written instruction).

2. Subject matter & duration

Processing lasts for the term of the subscription and the limited retention windows described in the Privacy Notice. The subject matter is the provision of AI-assisted pricing recommendations.

3. Nature, purpose & categories

• Purpose— generating, storing and displaying pricing recommendations and their factor breakdown.
• Data subjects— the customer’s authorised administrator users. The platform is not designed to process hotel-guest personal data.
• Categories— administrator identity and authentication metadata; property operational data (rates, availability, performance, competitor prices).

4. Compass’s obligations

• Process personal data only on the controller’s documented instructions.
• Ensure personnel authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (clause 6).
• Engage sub-processors only under clause 5 and impose equivalent data-protection terms on them.
• Assist the controller with data-subject requests and with its obligations under Articles 32–36 (security, breach notification, impact assessments), taking account of the nature of processing.
• Notify the controller without undue delay after becoming aware of a personal-data breach.
• On termination, delete or return personal data at the controller’s choice, save where storage is required by law.
• Make available the information necessary to demonstrate compliance and allow for audits.

5. Sub-processors

The controller authorises Compass to engage the sub-processors below. Compass will give advance notice of any intended change and the controller may object on reasonable data-protection grounds.

6. Security measures

• Tenant isolation enforced by application logic plus PostgreSQL row-level security.
• PMS and channel-manager credentials encrypted at rest in Supabase Vault.
• Encryption in transit (TLS) for all connections.
• Least-privilege access controls and audit logging.
• EU data residency for the primary application data store.

7. International transfers

Where personal data is transferred outside the UK/EEA (for example to a US sub-processor), the transfer is made under the UK International Data Transfer Agreement/Addendum or the EU Standard Contractual Clauses, with supplementary measures as appropriate.

8. Contact

Data protection contact: privacy@compassintelligence.co.uk. Compass Intelligence Limited, a company registered in England and Wales (company number 15428272). Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.