GDPR Documentation

1. Data Processing Agreement (DPA)

1.1 Parties

This Data Processing Agreement (hereinafter "DPA") is entered into between the business operator using the Resovu system (hereinafter "Controller") and Lubomír Unar, ID 05000386 (hereinafter "Processor"). The DPA is an integral part of the Resovu Terms of Service.

1.2 Subject and Duration of Processing

The Processor processes personal data of the Controller's customers for the purpose of providing the booking system. Processing takes place for the duration of the service agreement. Categories of data subjects: the Controller's customers making bookings, for accommodation also accompanying guests and, for children's activities, their legal guardians. Categories of data: name, surname, email, phone, booking and stay data, optional custom fields, loyalty points, reviews and receipts issued to customers. For accommodation, depending on the Controller's settings, also guest registration data (date and place of birth, sex, nationality, address, type and number of identity document, visa, purpose of stay) and, with the guest's consent, a reference to the payment card saved with Stripe (identifier, brand, last four digits) and the consent record.

1.3 Obligations of the Processor

The Processor undertakes to: process personal data only on the basis of documented instructions from the Controller; ensure that persons authorized to process data are bound by confidentiality; implement all measures required by Art. 32 GDPR; comply with the conditions for engaging sub-processors; assist the Controller in fulfilling obligations under Art. 32 to 36 GDPR; delete or return all personal data upon termination of the agreement; provide the Controller with all information necessary to demonstrate compliance.

1.4 Controller's Instructions

The Controller issues a general instruction to the Processor to process personal data to the extent necessary for providing the Resovu service. The Controller may issue further instructions through the system administration settings. The Processor shall immediately inform the Controller if it believes an instruction violates the GDPR.

1.5 Sub-processors

The Controller grants the Processor general consent to engage sub-processors listed in the Sub-processor List section. The Processor shall inform the Controller of any intended changes regarding the addition or replacement of sub-processors. The Controller may object to such changes within 30 days. Where the Controller connects its own SMS provider account (e.g. BulkGate or seven.io), the Processor transmits the phone number and the reminder text to that provider on the Controller's instruction; that provider is the Controller's processor under a contract concluded with the Controller and is not a sub-processor of the Processor. The same applies to other services that the Controller connects itself (booking portals via iCal calendar, PriceLabs, webhooks, Zapier): the Processor transmits data to them on the Controller's instruction and they are not its sub-processors.

1.6 Security Measures

The Processor implements appropriate technical and organizational measures: AES-256-GCM encryption for sensitive fields; HTTPS/TLS for all data transfer; tenant data isolation using Row Level Security; role-based access control (RBAC); IP address hashing; automatic deletion of personal data after the retention period; security headers (CSP, HSTS, X-Frame-Options); rate limiting for abuse protection.

1.7 Breach Notification

The Processor shall notify the Controller of any personal data breach without undue delay after becoming aware of it, no later than 48 hours. The notification shall include: a description of the nature of the breach, the categories and approximate number of affected data subjects, the likely consequences, and the measures taken.

1.8 Assistance with Data Subject Rights

The Processor shall assist the Controller in fulfilling the obligation to respond to data subject requests to exercise their rights under Chapter III of the GDPR. The system enables: customer data export (Art. 20), data anonymization/erasure (Art. 17), overview of processed data (Art. 15).

1.9 Audit

The Processor shall allow and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller. The Processor shall provide the Controller with all information necessary to demonstrate compliance with the obligations set out in Art. 28 GDPR. An audit may be conducted once a year with 30 days' notice.

1.10 Processing Duration and Erasure

Upon termination of the service, the Processor shall delete all personal data within 30 days, unless EU or member state law requires their retention. The Controller may export all data before termination using the GDPR export function in the system administration.

2. Record of Processing Activities (ROPA)

Records pursuant to Art. 30 GDPR on processing activities carried out through the Resovu system.

3. Personal Data Breach Notification Procedure

3.1 Detection and Reporting

Resovu implements monitoring systems for detecting security incidents. Every employee or collaborator is obligated to immediately report any suspicion of a data security breach to the company management.

3.2 Severity Assessment

Upon detecting an incident, the responsible person shall immediately assess: the scope of affected data, the number of affected data subjects, the likely impact on the rights and freedoms of data subjects, whether the data was encrypted, whether the impact can be mitigated.

3.3 Notification to Supervisory Authority

If the breach is likely to pose a risk to the rights and freedoms of natural persons, Resovu shall notify the relevant supervisory authority within 72 hours of discovery. The notification shall include: a description of the nature of the breach, DPO contact details, a description of the likely consequences, a description of the measures taken. Supervisory authorities: ÚOOÚ — www.uoou.cz (Czech Republic), ÚOOU SR — www.dataprotection.gov.sk (Slovakia), BfDI — www.bfdi.bund.de (Germany), UODO — www.uodo.gov.pl (Poland), NAIH — www.naih.hu (Hungary), AEPD — www.aepd.es (Spain), Datatilsynet — www.datatilsynet.no (Norway); CNIL — www.cnil.fr (France).

3.4 Notification to Data Subjects

If the breach is likely to pose a high risk to the rights and freedoms of natural persons, Resovu shall inform the affected data subjects without undue delay. The notification shall be made in clear language and shall include recommendations for mitigating the impact.

3.5 Documentation

All security incidents are recorded in an internal register, including: date of discovery, description of the incident, affected data and subjects, measures taken, decisions on notification to authorities and subjects, investigation results.

3.6 Incident Reporting Contact

Report security incidents to: security@resovu.com. Include "Security Incident" in the subject line. Provide as much information as possible about the nature and scope of the incident.

4. Sub-processor List