Data Processing Addendum

Operated by Flats Bratislava s. r. o. · Last updated 29 September 2026

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Flats Bratislava s. r. o. (“Processor”) and the customer (“Controller”). It applies when we process personal data on the Controller’s behalf, for example guest data, under Article 28 GDPR.

1. Roles

The Controller decides the purposes and means of processing guest and reservation personal data. relax.host acts as Processor and processes that data only on documented instructions.

2. Scope of processing

• Subject matter: provision of the relax.host platform.
• Duration: the term of the agreement plus the retention period.
• Nature and purpose: hosting, messaging, access management, pricing and accounting automation.
• Data subjects: the Controller’s guests, teammates and contacts.
• Types of data: names, contact details, reservation and message content, access codes.

3. Processor obligations

We:

• process data only on the Controller’s instructions
• ensure confidentiality
• apply appropriate technical and organisational measures
• help with data subject requests and breach notification
• delete or return the data when the engagement ends

4. Sub-processors

The Controller authorises us to use vetted sub-processors, listed on request. We impose equivalent data protection obligations on them and remain responsible for their performance. We give notice of intended changes so the Controller can object.

5. International transfers

Primary processing takes place in the EU. Any transfer outside the EEA relies on an adequacy decision or on Standard Contractual Clauses.

6. Breach notification

We notify the Controller without undue delay after we become aware of a personal data breach affecting the Controller’s data. We include the information reasonably available to help the Controller meet its own obligations.

7. Audits

On reasonable request and under confidentiality terms, we make available the information needed to demonstrate compliance with Article 28 and allow for audits.

8. Signature

Business customers who need a countersigned DPA can request one at [email protected].