Data Processing Addendum
This addendum applies whenever a hotel (the Controller) uses SMRTROOM, operated by Arya Monte Company, Budva, Montenegro (the Processor), to process personal data of its guests and staff. It is written to meet Article 28 of the EU General Data Protection Regulation and the equivalent rules of the Montenegrin Law on Personal Data Protection. Hotels that need a signed copy can request one at info@smrtroom.com.
1. Subject matter and duration
The Processor hosts and processes the Controller's reservation, room and finance data for the purpose of providing the SMRTROOM service, for as long as the Controller holds an account plus the deletion period in section 9.
2. Nature and purpose of processing
Storage, retrieval, display, modification and backup of data entered by the Controller through the web application or the API; generation of reports; transmission to third-party tools (e.g. an MCP client) only where the Controller has connected such a tool with its own API key.
3. Categories of data and data subjects
- Data subjects: the Controller's guests and prospective guests; the Controller's staff who use the account.
- Guest data: name, stay dates, number of guests, price and payment status, booking reference and channel, status (confirmed / checked-in / cancelled…), free-text notes which may include contact details or identity-document numbers if the Controller enters them.
- Staff data: e-mail address, IP address and browser information in the audit log.
- No special categories of data are required by the service; the Controller must not enter such data in free-text fields.
4. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are: the Terms of Service, this addendum, and the actions the Controller performs in the application or through the API. The Processor will inform the Controller if it believes an instruction infringes data-protection law.
5. Confidentiality
Persons authorised by the Processor to access personal data are bound by confidentiality. Access to production data is limited to what is needed to operate and support the service.
6. Security measures
- Encryption in transit (TLS 1.2+, HSTS) and at rest (Google Cloud default encryption).
- Tenant isolation: database security rules and API keys bound to a single hotel; server-side validation of every write.
- Authentication through Firebase Authentication; per-integration API keys that can be revoked individually; rate limiting.
- Audit log of changes to reservations and rooms.
- Daily automated database exports retained for 30 days, plus 7-day point-in-time recovery of the database.
- Dependency and vulnerability monitoring of the application's source code.
7. Sub-processors
The Controller authorises the sub-processors listed in section 4 of the Privacy Policy (Google, Vercel, and Telegram for support notifications). Tools the Controller connects itself through an API key are not sub-processors of the Processor. The Processor will notify the Controller by e-mail at least 14 days before adding or replacing a sub-processor; the Controller may object within that period, in which case it may terminate the service and export its data.
8. Assistance
Taking into account the nature of the processing, the Processor assists the Controller in responding to data-subject requests (access, rectification, erasure, portability) by providing the relevant data or deleting it on request, and in meeting its obligations regarding security, breach notification and impact assessments, to the extent the information is available to the Processor.
9. Deletion and return
At the end of the service the Processor returns the Controller's data in a machine-readable format on request and deletes it within 30 days of a verified request, unless retention is required by law. Backup copies are overwritten on their normal rolling schedule.
10. Breach notification
The Processor notifies the Controller without undue delay, and at the latest within 72 hours, after becoming aware of a personal-data breach affecting the Controller's data, with the information reasonably available at that time.
11. Audit
On reasonable written request, at most once a year unless required by a supervisory authority, the Processor will provide the information necessary to demonstrate compliance with this addendum, including a description of the security measures and the list of sub-processors, and will allow an audit by the Controller or an independent auditor bound by confidentiality, at the Controller's cost and with at least 30 days' notice.
12. International transfers
The database and its backups are stored in the European Union (Google Cloud europe-west1, Belgium). The API runs on Google Cloud in the United States (us-central1) and the website is served through Vercel's global network. Transfers from the EEA to the United States are covered by the EU Standard Contractual Clauses contained in Google's and Vercel's data-processing terms and, where applicable, the EU-US Data Privacy Framework.
13. Liability and precedence
The liability provisions of the Terms of Service apply to this addendum. In case of conflict between this addendum and the Terms, this addendum prevails for matters of personal-data protection.