Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the Property ("Data Controller") and Growth Story Company ("Data Processor", "Company") for use of HotelPilot.in (the "Service"). It sets out the terms under which the Company processes personal data on behalf of the Property in connection with the Service.

The Property acts as the Data Controller in respect of guest personal data (name, contact details, ID proof, stay history, billing information) entered into the Service. The Company acts as the Data Processor, processing such data solely on the Property's documented instructions, as provided through the ordinary functionality of the Service.

• Nature of processing: Storage, retrieval, organization, and display of guest and operational data through the Service's front desk, billing, housekeeping, KOT, banquet, reporting, and related modules.
• Categories of data subjects: Hotel guests, and the Property's own staff/users.
• Categories of personal data: Name, contact number, email, ID proof details, address, stay and billing history, and staff login credentials.
• Duration: For the term of the Property's subscription, and thereafter as set out in the Privacy Policy's data retention terms.

• Process personal data only as necessary to provide the Service and in accordance with the Property's instructions, this DPA, and applicable law.
• Ensure personnel authorized to process data are subject to confidentiality obligations.
• Implement appropriate technical and organizational security measures, including role-based access control, row-level security, encryption in transit, audit logging, rate limiting, and two-factor authentication.
• Assist the Property, where reasonably possible, in responding to data subject requests (access, correction, deletion) received from guests.
• Notify the Property without undue delay upon becoming aware of a personal data breach affecting the Property's data.
• Not engage a new sub-processor materially affecting the processing without informing the Property, except for existing infrastructure/hosting sub-processors necessary to operate the Service.

• Ensure it has a lawful basis for collecting and providing guest personal data to the Service (e.g. for hotel registration/KYC purposes as required under applicable law).
• Ensure the accuracy of data entered into the Service.
• Respond to and fulfil data subject rights requests, with reasonable technical assistance from the Company as set out above.

The Company uses reputable third-party cloud infrastructure and database hosting providers (sub-processors) to operate the Service. These sub-processors are bound by confidentiality and data protection obligations no less protective than those in this DPA.

Personal data is hosted on secure cloud infrastructure. Where data is processed or stored outside India by an infrastructure sub-processor, the Company will ensure such processing is subject to appropriate contractual and security safeguards.

In the event of a confirmed personal data breach affecting the Property's data, the Company will notify the Property promptly upon confirmation, describe the nature of the breach to the extent known, and take reasonable steps to contain and remediate the incident.

Upon termination of the Property's subscription, the Company will, upon written request, make the Property's data available for export within a reasonable period, and thereafter delete or anonymize such data in accordance with the Privacy Policy's retention terms, save where retention is required by applicable law.

Liability under this DPA is subject to the limitations set out in the Terms of Service. This DPA is governed by the laws of India, with the courts at Latur, Maharashtra having exclusive jurisdiction.

Growth Story Company
Office No. 2, Second Floor, Opposite Zudio Clothing, Hatte Corner, Ganj Golai, Latur - 413512, Maharashtra, India

Email: Consult@Growthstoryco.in
Phone: 8007444464