Data Processing Agreement.

1. Roles

Your business (the customer) is the controller of the personal data in its workspace. Floodlight New Marketing Ltd, registered in England and Wales under company number 08613994, is the processor. This agreement meets Article 28 of the UK General Data Protection Regulation.

2. What we process

• Purpose: providing Short Stay Control to your business, as described in the Terms and Conditions.
• Duration: for as long as the subscription runs, then the 30-day export period in section 10 (or, if the workspace is closed during a free trial, 7 days with no export).
• Types of data: names, contact details, booking and stay details, payment amounts, receipts, documents and anything else your business connects or uploads.
• People concerned: your guests, team members, suppliers, property owners and other contacts.

3. Your instructions

We process the data only on your documented instructions: these terms, how your business uses and configures the service, and anything else you ask in writing. We tell you if we think an instruction breaks data protection law. We do not use your data for our own purposes.

4. Confidentiality

Everyone we allow to process your data is bound by a duty of confidentiality.

5. Security

• The service runs on servers in the United Kingdom and every connection is encrypted.
• Passwords are stored hashed, and connection keys you save are stored encrypted.
• Access inside a workspace follows the roles your administrators give, and changes are recorded in an audit trail.
• Backups are taken regularly and overwritten within 14 days.

6. Our suppliers

You give general authorisation for the suppliers on our supplier list at shortstaycontrol.com/subprocessors/. Each is bound by written terms giving your data the same protection as this agreement, and we stay responsible to you for their work.

We email your billing contact at least 30 days before adding a new supplier. You can object in that time. If we cannot resolve the objection, you can cancel before the change and we refund fees already paid for the period after it.

7. Transfers outside the UK

We transfer your data outside the UK only with a safeguard UK data protection law accepts, such as the UK Addendum to the standard contractual clauses.

8. Helping you

We help you answer requests from people using their data protection rights, carry out data protection impact assessments, and deal with the Information Commissioner's Office (ICO), taking into account what we can reasonably do.

9. Personal data breaches

We tell you without undue delay, and within 48 hours of becoming aware, of any breach affecting your data. We give you the information you need to meet your own reporting duties, and we take steps to contain it.

10. When the subscription ends

Your administrators can export the workspace data for 30 days after the subscription ends. We then delete it, unless the law requires us to keep it. Backup copies are overwritten within 14 days after that. If you close your workspace during a free trial, it is deleted within 7 days and no export is provided. Closing the workspace is the customer's instruction to us to delete it.

11. Audits

We give you the information you reasonably need to show we meet this agreement. If that is not enough, you may audit us once a year with 30 days' notice, at your own cost, under a confidentiality agreement, or sooner if a regulator requires it or after a breach.

12. Liability and law

Liability under this agreement follows the limits in the Terms and Conditions. This agreement is governed by the law of England and Wales. If it conflicts with the Terms and Conditions on data protection, this agreement prevails.