Snapshot 26428
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
SuiteOp Inc
Last Updated: September 27, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written or electronic agreement between SuiteOp Inc. ("Processor") and the Customer ("Controller") (collectively, the "Parties").
This DPA applies where and only to the extent that SuiteOp processes Personal Data on behalf of the Customer in the course of providing the Service and such Personal Data is subject to Data Protection Laws of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom.
1. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person.
"Data Protection Laws" means all applicable legislation of the European Union, the European Economic Area and their member states, the UK and Switzerland, including the General Data Protection Regulation (2016/679) ("GDPR").
"Standard Contractual Clauses" or "SCCs" means the clauses annexed to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021.
2. Processing of Personal Data
2.1 Role of the Parties. The Parties acknowledge and agree that with regard to the processing of Personal Data, Customer is the Controller and SuiteOp is the Processor.
2.2 Instructions. SuiteOp shall process Personal Data only in accordance with the Customer's documented instructions, including with regard to transfers of Personal Data to a third country, unless required to do so by law.
3. Personnel
SuiteOp shall ensure that its personnel engaged in the processing of Personal Data are informed of the confidential nature of the Personal Data and have committed themselves to confidentiality.
4. Security
SuiteOp shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Annex 2.
5. Sub-processing
5.1 Authorization. Customer grants a general written authorization to SuiteOp to engage Sub-processors (listed in Annex 3) to process Personal Data on Customer's behalf.
5.2 Notification. SuiteOp shall inform the Customer of any intended changes concerning the addition or replacement of Sub-processors via email or the platform.
6. Data Subject Rights
SuiteOp shall, to the extent legally permitted, assist the Customer by appropriate technical and organizational measures for the fulfillment of the Customer's obligation to respond to requests for exercising the Data Subject's rights.
7. Personal Data Breach
SuiteOp shall notify the Customer without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach.
8. Return and Deletion
Upon termination of the Service, SuiteOp shall, at the choice of the Customer, delete or return all Personal Data to the Customer, unless applicable law requires storage of the Personal Data.
ANNEX 1: Details of Processing
1. Categories of Data Subjects
Guests of the Customer (Property Managers/Hotels).
Employees and staff of the Customer.
2. Categories of Personal Data
Contact Information: Name, email address, phone number.
Stay Details: Reservation dates, property addresses.
Verification Data (SuiteVerify): ID/Passport copies, selfies (including biometric data for identity verification).
Sensor Data (SuiteMonitor): Noise levels (decibels), temperature, CO2, humidity, and environment levels.
Transaction Data: Payment information (via Stripe) and records of purchases/upsells.
3. Nature and Purpose of Processing
Automating guest check-in and check-out workflows.
Verifying guest identity for security and safety using AI-assisted matching (e.g., matching selfies against government-issued IDs).
Monitoring property environment to prevent damage or nuisance.
Facilitating communication between hosts and guests.
ANNEX 2: Security Measures
SuiteOp implements the following technical and organizational security measures:
Technical Measures:
Encryption:
AES-256 encryption at rest for all Restricted data (Guest PII, biometric data)
TLS 1.2/1.3 for all data in transit
Access Control:
Multi-Factor Authentication (MFA) enforced for all administrative access
Google Workspace as primary identity provider with Cloudflare Zero Trust for SSO
Role-based access control (RBAC) and least-privilege principles
Mandatory use of 1Password for credential management
Infrastructure Security:
Secure cloud hosting on Google Cloud Platform (SOC 2 Type II and ISO 27001 certified) in the Customer's region (United States, European Union or Singapore); legacy platform on Bubble.io (SOC 2 Type II certified) and AWS (US regions)
Network segmentation (production, staging, development environments)
Web Application Firewall (WAF) via Cloudflare
Monitoring & Logging:
Continuous vulnerability scanning in CI/CD pipeline
Security event logging with 90-day retention minimum
Real-time alerting for security incidents
Organizational Measures:
Policies: Comprehensive Information Security Policy framework (see internal policies)
Personnel: All personnel sign confidentiality agreements and complete security training
Audits: Periodic internal security and infrastructure audits, and automated security review of every code change before release
Incident Response: Documented Incident Response Plan with 48-hour breach notification commitment
Vendor Management: All sub-processors are assessed for security and GDPR compliance
ANNEX 3: List of Sub-processors
Infrastructure & Hosting:
AWS - Cloud Infrastructure & Hosting (USA)
Bubble.io - Application Platform & Hosting (USA)
Cloudflare - Security & CDN (Global)
Google Cloud Platform - Cloud Infrastructure, Hosting & Databases (USA, EU, Singapore)
Google / Gemini AI - Cloud Storage, Analytics & AI Models (USA)
Identity Verification:
Authenticate.com - Guest Identity Verification (USA)
Chekin.io - Guest Identity Verification (EU)
Persona - Guest Identity Verification (USA)
Payment Processing:
Stripe - Payment Processing (USA)
Guesty / GuestyPay - PMS Integration & Payments (Global)
Juspay (Hyperswitch) - Payment Orchestration (Global)
Integration & Communication:
Calry - PMS Integration Middleware (Global)
Sendgrid - Email Communication (USA)
Twilio - SMS Communication (USA)
Expo - Mobile Push Notifications (USA)
Monitoring & Analytics:
Sentry - Error Monitoring (USA)
Better Stack - Log Management (EU)
PostHog - Product Analytics (USA)
Internal Tools:
1Password - Password Management (USA)
Apple - Device Management (ABM) (USA)
Note: Additional PMS providers connected via suiteop.com/integrations are considered sub-processors to the extent they process data synchronized via the SuiteOp platform. Customer will be notified via email or platform notification of any new sub-processor additions, with at least 30 days' notice to allow for objection.