Data Processing Agreement (DPA)

Version 2.1 · En vigueur à partir du 2 octobre 2026 · Publié le 2 octobre 2026

Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR)

ConSergio.ai — DevInterface srl Version 2.1 · Last updated: 2 October 2026 · Effective from: 2 October 2026

Language. This English text is a courtesy translation of the Italian original. In the event of any discrepancy or conflict between the two versions, the Italian version shall prevail.

This Data Processing Agreement (the “DPA”) supplements the ConSergio.ai Terms and Conditions of Service (the “Terms”) and governs the processing of personal data carried out by DevInterface on behalf of the Customer in the course of providing the Service. The DPA is deemed accepted together with the Terms upon registration or, for Customers already registered, upon acceptance of this version, and forms an integral and essential part thereof. Capitalised terms not defined in this DPA have the meaning given to them in the Terms.

This version replaces version 1.1, in force since 1 September 2026. Compared with it, it describes separately the processing connected with each function of the Service — the Concierge Module, the Reservations Module (including the Widget) and the Pre Check-in and Alloggiati Web Function — and updates the list of sub-processors.

1. Parties and roles

1.1 The Customer — the accommodation business subscribing to the Service — acts as Data Controller of the personal data of Guests, of persons making bookings and of visitors to its own website collected or generated through the Service.

1.2 DevInterface srl, VAT no. 04080300231, Via Guglielmo Marconi 20, 37012 Bussolengo (VR), Italy, acts as Data Processor, processing such data solely on behalf of and on documented instructions from the Controller.

1.3 This DPA also applies to the personal data of Staff Users processed within the platform for account and permission management, in respect of which DevInterface likewise acts as Processor.

1.4 DevInterface acts instead as an independent Data Controller — outside the scope of this DPA and as described in its Privacy Policy — in relation to: the Customer’s contact and billing data, management of the contractual relationship and service communications, security data and technical logs processed under legal obligation or legitimate interest, the measurement tools referred to in Article 4.4, and the aggregated and anonymous data referred to in Article 14.

1.5 When the Customer uses the Pre Check-in and Alloggiati Web Function, the Italian State Police (Polizia di Stato) receives Guests’ data through the Alloggiati Web service as a recipient by legal obligation and as independent controller of the related processing. It is not a sub-processor of DevInterface: DevInterface merely performs the transmission on the Customer’s instructions and using the Customer’s credentials.

2. Subject matter, nature, purpose and duration of processing

2.1 Subject matter: provision of the ConSergio.ai platform in the functions active for the Customer according to the Plan subscribed and the Account configuration:

Concierge Module (included in all Plans): the Guest-facing web app accessed via QR code, the catalogue of services and content, request management, the AI conversational assistant, messages and surveys addressed to Guests, notifications, and the management panel;
Reservations Module (included only in the “+ Reservations” Plans): management of bookings, stays, availability and rates, synchronisation with external calendars, sending of booking confirmations, and tourist tax reporting; in the Plus + Reservations and Premium + Reservations Plans it includes the Widget to be installed on the Customer’s website;
Pre Check-in and Alloggiati Web Function (which the Customer may enable on any Plan; sending invitations and reminders to Guests by e-mail requires the Reservations Module): collection of the data required for the notification under Article 109 of the Italian Consolidated Law on Public Security (T.U.L.P.S.), in-person verification, transmission to the Alloggiati Web service and retention of the related receipts.

2.2 Nature: collection, recording, organisation, structuring into fragments (chunks) and vector representations, processing by artificial intelligence models, automated translation, sending of e-mails and notifications on behalf of the Controller, transmission to public authorities on the Controller’s instructions, storage, consultation, retrieval, encryption, erasure and anonymisation.

2.3 Purpose:

Concierge Module: to enable Guests to consult the Property’s content, submit requests to staff, interact with the AI assistant, receive messages and notifications and answer surveys; to enable the Customer to manage those requests, content and statistics;
Reservations Module: to enable the Customer to record and manage bookings and stays, communicate with persons making bookings, and keep the booking and tourist tax records; through the Widget, to answer questions from visitors to the Customer’s website and collect their booking requests;
Pre Check-in and Alloggiati Web Function: to enable the Customer to fulfil its obligation to notify the State Police of the personal details of its guests and to demonstrate that it has done so.

2.4 Duration: for the entire term of the contractual relationship and for the retention periods set out in Article 12, subject to any differing legal obligations.

Processing details, broken down by function, are set out in Annex A.

3. Categories of data subjects and personal data

3.1 Data minimisation. The Service is designed so that each function processes only the data it needs. The data of the different functions are kept separate: in particular, the identity data collected by the Pre Check-in Function are not used by any other function and are never transmitted to the artificial intelligence model provider. No payment instrument data of Guests or of persons making bookings is processed by the Service, in any of its functions.

3.2 Concierge Module (all Plans).

Data subjects: Guests of the Property who access the web app; the Customer’s Staff Users.

No identifying data is required from the Guest in order to access the web app: no registration or login is required. The following are processed:

room identifier, QR code access token and any stay access code, the latter stored in non-reversible form;
content of requests submitted to staff and of the notes staff attach to them;
content of messages exchanged with the AI assistant and the language detected for each message;
Guest name, stay period, number of occupants and language, only where entered by the Customer’s Staff Users or, with the Reservations Module, taken from the booking;
stay context used by the AI assistant to answer consistently (the Guest’s name and the requests already submitted during the stay);
messages published by the Customer for Guests and the related delivery and read information;
answers to satisfaction surveys, where enabled by the Customer: ratings, free-text comments and follow-up questions;
push notification subscriptions of the Guest’s browser: technical delivery address and keys supplied by the browser, language, and the room and stay concerned;
charges posted by staff to the room account (item, date, quantity, amount, note);
technical and connection data (IP address, user agent, timestamp, security logs);
for Staff Users: name, e-mail address, role and permissions, language, credentials in non-reversible form, push notification subscriptions, logs of actions performed with the related IP address.

3.3 Reservations Module (“+ Reservations” Plans).

Data subjects: persons making bookings and Guests under the bookings; visitors to the Customer’s website who use the Widget.

For bookings, the following are processed:

data of the person making the booking: first name, last name, e-mail address, telephone number, language;
stay data for each room: Guest name, number of adults and children, arrival and departure dates, expected arrival time, check-in date and time and status of the stay;
booking channel, booking code and any reference from the external channel;
financial data: rates applied, price items, extras, adjustments and the reason for them, amounts due;
number of persons exempt from the tourist tax, without the reason for the exemption: the Service records the fact and not the reason, and therefore processes no health data on this account;
internal notes entered by staff and the reason for any cancellation; for requests sent through the Widget, the visitor’s message and the website it was sent from;
delivery outcome of the confirmation e-mails sent to the person making the booking on the Customer’s behalf (sent, not delivered, marked as spam);
events imported from the external calendars configured by the Customer (for example those of online booking portals): stay dates and event title, which may contain a name if so filled in at source. No other data is imported.

The Reservations Module does not process identity document data (except as provided in Article 3.4), dates of birth, postal addresses, citizenship, billing data of the person making the booking or payment instrument data.

For the Widget (Plus + Reservations and Premium + Reservations Plans only), the following are processed:

for the chat: content of the visitor’s messages, language, the website the conversation came from, and a random session identifier, stored in the session storage of the visitor’s browser only after the first answer. The visitor is not identified and no data is required in order to chat;
for the booking request form: first name, last name, e-mail address, telephone number (optional), free-text message, dates, number of persons and rooms, room type chosen. Submission requires the visitor to declare that they have read the Customer’s privacy notice; the declaration is not recorded by the Service. Each request is recorded as an unconfirmed booking of the web channel and is subject to the rules of this Article;
to protect the form from automated submissions: technical browser signals and IP address, verified through the Cloudflare service listed in Annex B;
where the Customer enables the reading of its website, the text of the site’s public pages, used only for the Widget’s answers and never for those addressed to Guests in their rooms. The Service does not look for personal data there: if the Customer’s website publishes any, it is processed in the same way as the rest of the text.

3.4 Pre Check-in and Alloggiati Web Function (enabled by the Customer).

Data subjects: Guests subject to the notification under Article 109 T.U.L.P.S., minors included; persons making bookings who receive the invitation; Guests who give the optional consent described below.

The following are processed. Personal details and document data are encrypted field by field:

for each Guest: last name, first name, sex, date of birth, place of birth (municipality or country) and citizenship, encrypted; role in the party (single guest, head of family, family member, group leader, group member), arrival date and number of nights, not encrypted;
only for the single guest, the head of family and the group leader: type, number and place of issue of the identity document, encrypted;
the booking e-mail address, to send the personal link to the form, no more than two automatic reminders and any re-sending ordered by staff (Reservations Module only);
the outcome of the in-person verification (date and time, operator, outcome and coded reason for a negative outcome, names of the fields corrected but not their values);
the log of transmissions to the Alloggiati Web service, with the outcome and the error codes returned by the portal; the text of any rejection is stored encrypted together with the identity data and erased with it;
the receipts issued by the Alloggiati Web portal, encrypted and in the form in which the portal issues them;
the Customer’s access credentials to the Alloggiati Web service, encrypted;
acknowledgement of the notice given to Guests by the person completing the online form (version, language, date and time);
where the Guest gives it through a separate, optional checkbox, the consent to receive promotional communications from the Customer: e-mail address, language, version of the text accepted, date given and any withdrawal.

The Function does not process images or copies of identity documents, does not allow files to be uploaded, and uses no optical character recognition, biometrics or video verification. The token of the link sent to the Guest is stored only in non-reversible form.

3.5 Special categories of data (Article 9 GDPR). The Service neither requires nor is intended to collect special categories of data. The Customer acknowledges, however, that given the nature of the hospitality context a Guest, a person making a booking or a visitor may spontaneously communicate, in chat, in a request or in the message of a booking request, information falling within special categories — by way of example: food allergies and intolerances, needs related to health conditions or disability, requests for medical or pharmaceutical assistance, religious dietary requirements. The Parties acknowledge that:

DevInterface neither solicits nor structures the collection of such data and does not use it for purposes beyond generating the response and transmitting the request to staff;
the Customer, as Controller, must identify an appropriate legal basis and adequately inform its Guests, persons making bookings and visitors;
the Customer undertakes to instruct its Staff Users not to deliberately enter special category data into free-text fields of the platform, including booking and charge notes;
such data is subject to the same security measures and erasure periods provided for in this DPA for the field in which it was entered.

3.6 Minors. The Customer acknowledges that access via the QR code placed in the room is by its nature available to anyone present in the room, including minors, and that the Widget is accessible to anyone visiting the Customer’s website. The Concierge Module and the Widget collect no identifying data and do not profile users. The Pre Check-in Function, by contrast, processes the data of minor guests as required by law, on the same terms as other Guests. The Customer must take this into account in its own privacy notice and risk assessment.

3.7 Criminal data. The Customer undertakes not to use the Service to process data relating to criminal convictions and offences (Article 10 GDPR). The transmission of guests’ personal details to the State Police does not in itself entail the processing of such data by the Service.

4. Documented instructions of the Controller

4.1 DevInterface processes personal data solely on the documented instructions of the Controller, consisting of the Terms, this DPA and the configurations set by the Customer within its Account, including:

for the Concierge Module: the enabling of external source search, the content uploaded for the AI assistant, the association of stays with rooms, the validity window of access codes after check-out, the messages and surveys enabled, the retention period within the Plan ceiling, and Staff User management;
for the Reservations Module: the entry and confirmation of bookings, the sending of confirmations to persons making bookings, the external calendars connected, the retention period of the records (Article 12.3), the enabling of the Widget and its request form, any authorised websites, the address of the Customer’s privacy notice and the reading of the website;
for the Pre Check-in and Alloggiati Web Function: its enabling, how far in advance invitations are sent, the Alloggiati Web credentials, the outcome of in-person verifications and the order to transmit to the portal.

4.2 DevInterface shall inform the Customer without delay if it considers that an instruction infringes the GDPR or other applicable data protection provisions.

4.3 DevInterface does not use the personal data processed on behalf of the Controller for its own purposes, nor for training artificial intelligence models, save as stated in Article 4.4.

4.4 Measurement of the Service. The pages of the Guest-facing web app load the Google Tag Manager container, which entails the transmission to Google of the IP address and technical browser data. The tools measuring the use of the Service that it contains, of which DevInterface is independent controller, are activated only with prior consent collected through the cookie management banner, as described in its Privacy Policy. These tools record browsing data (pages visited, device, referrer) and do not receive the content of requests, conversations or stays. They are not loaded on the pre check-in form, nor inside the Widget installed on the Customer’s website.

5. Obligations of the Processor

DevInterface undertakes to:

process data only for the stated purposes and in accordance with the Controller’s documented instructions;
ensure that persons authorised to process the data are bound by appropriate confidentiality obligations and are adequately trained;
adopt and maintain the technical and organisational measures required by Article 32 GDPR, described in Annex C;
assist the Controller, through appropriate technical and organisational measures, in responding to data subject requests (Articles 15-22 GDPR);
assist the Controller in complying with Articles 32-36 GDPR (security, breach notification, impact assessment, prior consultation);
make available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and allow audits pursuant to Article 15;
ensure strict logical isolation of data between the different Properties hosted on the platform;
access the Customer’s Account only to provide support, solve technical problems or protect the security of the platform, with the access recorded in the action log and shown in the panel;
exclude its support staff, through the application, from access to the identity data of the Pre Check-in Function, including when operating on the Customer’s Account.

6. Multi-tenant isolation

6.1 The platform is multi-tenant. DevInterface ensures that each Property’s data is isolated through application-level scoping across all domain entities, and that such isolation extends to the semantic search used by the AI assistant and the Widget, whose queries are mandatorily filtered by Property.

6.2 The effectiveness of isolation is verified through dedicated automated tests, run continuously as part of the release process.

6.3 Under no circumstances may one Property’s content, conversations or bookings be retrieved or used to generate responses for the Guests or visitors of another Property.

6.4 Within the same Property, only the content that the Customer marks as public may be used by the Widget; the content intended for Guests in their rooms and the text of the Customer’s website remain separate as stated in Article 3.3.

7. Artificial intelligence

7.1 The AI assistant and the Widget generate responses from content provided by the Customer and, for the in-room assistant where enabled by the Customer, from external sources. The model provider receives the data subject’s message, the previous messages of the same conversation, the content retrieved and, for the in-room assistant, the stay context referred to in Article 3.2.

7.2 DevInterface undertakes to use the provider’s configurations and contractual options that exclude the use of transmitted data for model training and that minimise data retention on the provider’s side.

7.3 Before transmission to third-party providers, the Service removes e-mail addresses and sequences of six or more digits (such as telephone, card or document numbers) from the data subject’s text. The Customer acknowledges that this reduces risk but is not a guarantee: names, postal addresses and alphanumeric codes cannot be reliably recognised and may be transmitted if the data subject writes them spontaneously. The full text remains stored in the Service for consultation by staff.

7.4 The data of the Pre Check-in Function and the contact details of persons making bookings recorded in the Reservations Module are never transmitted to the model provider.

7.5 Generated responses do not produce legal effects or similarly significantly affect data subjects within the meaning of Article 22 GDPR: the assistant provides information and forwards requests, whose handling and assessment remain the responsibility of the Customer’s staff. A booking request sent through the Widget is not a confirmed booking.

7.6 DevInterface adopts containment measures against attempts to manipulate the model’s instructions (prompt injection) contained in retrieved content and in conversations. From external sources the model receives only structured fields, such as the name, address and type of places.

7.7 External sources. When the Customer enables external source search, DevInterface sends to the source (currently Google’s place search service) only the informational query required, formulated by the model and stripped of the data referred to in Article 7.3, together with the Property’s position and the language of the conversation. The external sources actually used are logged for verification purposes. The Widget does not use external sources.

7-bis. Pre Check-in and Alloggiati Web Function: obligations of the Controller

7-bis.1 The Customer remains the only party required to make the notification under Article 109 T.U.L.P.S. and is answerable for it to the authority. In particular, the Customer:

carries out the in-person verification that the Guest matches the original identity document, as required by the legislation in force; the Service does not allow a Guest’s data to be transmitted without a positive outcome recorded by a Staff User;
does not keep, upload to the Service or send through its channels copies or images of identity documents;
complies with the notification deadlines set by law, including where automatic transmission fails, if necessary by means of the file for manual upload made available by the Service;
safeguards its Alloggiati Web access credentials and promptly notifies DevInterface of any compromise.

7-bis.2 DevInterface does not guarantee the availability of the Alloggiati Web service or the acceptance of records by the portal. A transmission whose outcome is uncertain is not repeated automatically and is referred to the Customer’s staff for verification, in order to avoid duplicate notifications.

7-bis.3 The Parties acknowledge that the Alloggiati Web receipt and the transmission log, kept as proof of compliance, are documents distinct from the identity data, which are instead erased within the periods set out in Article 12.4.

8. Sub-processors

8.1 The Controller grants general authorisation for the use of the sub-processors listed in Annex B. DevInterface imposes on them, by contract, data protection obligations equivalent to those of this DPA and remains fully liable to the Controller for their performance.

8.2 DevInterface shall notify the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance. The Customer may object on reasonable grounds within that period; in the event of a well-founded objection that cannot be resolved, the Customer may withdraw from the Service with a pro-rata refund of unused fees.

8.3 Components not entrusted to third parties. The vector index used by the AI assistant and the Widget is self-hosted on the Processor’s own infrastructure within the European Union: its processing does not involve an additional sub-processor.

8.4 The following are not sub-processors under this DPA:

the payment services provider used to bill for the Service, which processes no data of Guests, persons making bookings or visitors, but only the Customer’s data, as set out in the Privacy Policy;
the place search service used as an external source, to which no personal data is sent (Article 7.7);
the push notification services operated by browser vendors, which receive the content of notifications in encrypted form that they cannot read;
the State Police as operator of Alloggiati Web (Article 1.5).

9. Transfers to third countries

9.1 Primary data and backups are hosted in the European Union.

9.2 The processing entrusted to the sub-processors established in the United States listed in Annex B involves a transfer to a third country, or the possibility of access from a third country: processing by the artificial intelligence model provider, the sending of e-mails on the Customer’s behalf, and network and anti-automation protection services. These transfers are subject to appropriate safeguards under Chapter V GDPR (Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework).

9.3 DevInterface carries out and keeps up to date an assessment of the adequacy of the safeguards applied to transfers and makes a copy available to the Controller on request.

10. Security of processing

DevInterface adopts and maintains technical and organisational measures appropriate to the risk, described in Annex C, in accordance with Article 32 GDPR. The measures may be updated over time, provided that the overall level of security is not reduced.

11. Personal data breaches

11.1 In the event of a personal data breach, DevInterface shall notify the Controller without undue delay and in any event within 48 hours of becoming aware of it.

11.2 The notification shall contain, to the extent available: the nature of the breach, the function of the Service affected, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address and mitigate the breach, and a contact point for further information.

11.3 DevInterface shall cooperate with the Controller and provide reasonable assistance to enable it to meet its obligations to notify the Supervisory Authority and communicate with data subjects under Articles 33 and 34 GDPR. The decision on notification remains with the Controller.

11.4 DevInterface shall not make any communication to third parties concerning a breach relating to the Customer without the Customer’s prior agreement, save where required by law.

12. Retention, erasure and return of data

12.1 Common rules. Once the applicable retention window has elapsed, data is erased or anonymised; only aggregated information not attributable to identifiable persons continues to feed statistics. Erasure of content or data propagates to derived representations, including stored translations and the vector representations used by the AI assistant and the Widget.

12.2 Concierge Module.

The history of conversations, requests, message deliveries and free-text survey comments is retained for the period determined by the Plan subscribed (30, 365 or 730 days), which is a maximum ceiling that the Controller may reduce through the Account settings but not extend.
Regardless of the Plan, when the stay ends the name associated with the room is erased and any access code is revoked, after a technical window required for operational handling (by default 3 hours after check-out, configurable by the Controller).
On a move to a Plan with a shorter retention window, the new window applies after a grace period of 30 days.

12.3 Reservations Module.

Contact details and notes — the e-mail address and telephone number of the person making the booking, internal notes, the title of events imported from external calendars and the reason for cancellation — are erased 12 months after the last departure under the booking, as they are not needed for any accounting obligation.
The records — bookings with the name of the booking holder, stays, nights, amounts and tourist tax declarations — are retained for the number of years configured by the Controller, not less than 5, counted from the end of the calendar year of check-out, in view of the tax assessment periods and the retention of tourist tax documentation. The Controller may extend this period up to 20 years, but not reduce it below 5.
Widget conversations are retained for 90 days or for the shorter period provided by the Plan. Booking requests sent through the Widget follow the rules for bookings.

12.4 Pre Check-in and Alloggiati Web Function. Guests’ identity data are erased automatically:

within 2 hours of the record being acquired by Alloggiati Web, or of staff confirming that it has been uploaded manually;
within 25 hours of the cancellation of the booking, the Guest’s failure to arrive or a negative outcome of the in-person verification;
within 3 days of the departure date, if the form was left incomplete.

Deletion of the stay by staff erases them immediately. The data of a Guest whose transmission has an uncertain outcome, or who has been verified but not transmitted, are not erased automatically: they are reported to the Controller in the monthly report so that it can decide. Links to the form are deleted on expiry or after use.

The following are retained for the duration of the records referred to in Article 12.3: the transmission log and the verification outcomes, which do not contain identity data; the Alloggiati Web receipts, encrypted and in the form in which the portal issues them; the role in the party, the arrival date and the number of nights, stripped of identity data. The log of access to identity data is retained for 12 months. The optional promotional consent is retained until withdrawn; the withdrawal is recorded and retained, with the encrypted e-mail address, until the closure of the Account, as proof that the data subject’s wishes have been respected.

12.5 Security logs. The log of staff actions follows the retention of the Plan’s history; entries documenting an erasure are retained as long as the records referred to in Article 12.3, and those concerning pre check-in data for 12 months (Article 12.4). The IP address associated with those entries is removed after 90 days.

12.6 Upon termination of the contractual relationship, which for the purposes of this Article coincides with the closure of the Account under Article 16.7 of the Terms, DevInterface shall, at the Controller’s choice, erase or return the personal data processed on its behalf. The end of a Property’s subscription, without closure of the Account, does not entail the erasure of data, which remains retained in accordance with this Article. Once the closure has been scheduled, the Controller has at least 30 days to request return or to export data using the functions available in the panel; after that period the data is erased, unless retention is required by Union or Member State law. For the documents that the Controller is required by law to retain, the Service makes available:

the booking archive in CSV format, which can be exported from the panel and is referred to in the notice of the forthcoming erasure; if the Plan no longer includes the Reservations Module, DevInterface provides it on request;
the archive of Alloggiati Web receipts and logs (receipts, transmissions, verifications and erasures). As long as that archive contains documents still subject to the retention obligation and has not been downloaded by the Controller since they were created, the erasure of the Account is suspended, unless the Controller expressly waives it and DevInterface records the waiver.

12.7 Backups. Database backups are kept in the European Union in 7 rotating daily copies: erased data remains in backups for no more than 7 days, during which it remains protected by the security measures set out in Annex C and is not subject to any active processing. In the event of a restore, the erasures due are carried out again by the automated procedures.

13. Assistance to the Controller and data subject rights

13.1 Taking into account the nature of the processing, DevInterface assists the Controller through appropriate technical and organisational measures in responding to requests to exercise data subject rights.

13.2 Requests from Guests, persons making bookings and visitors are normally addressed to the Customer, as Controller. Should a request reach DevInterface directly, DevInterface shall not act on it independently and shall forward it to the Customer without delay, unless otherwise instructed in writing.

13.3 The Service provides the Controller with functions to export data, to delete stays and bookings that were never confirmed, and to record the withdrawal of promotional consents. For requests that the panel does not allow the Controller to handle directly, in particular access to and erasure of the conversations, requests and survey answers of an individual data subject, DevInterface shall act on the Controller’s written instructions, in time to allow it to meet the deadlines in Article 12 GDPR. The Controller acknowledges that data needed to comply with legal obligations — identity data until their transmission to Alloggiati Web, and the receipt and records for the period referred to in Article 12 — may be retained even following an erasure request, within the limits of Article 17(3) GDPR.

13.4 DevInterface provides the Controller with the information necessary to carry out any data protection impact assessment (DPIA) and prior consultation. The Customer acknowledges that, given the use of artificial intelligence systems in the hospitality context and, where enabled, the systematic processing of identity data, including that of minors, through the Pre Check-in Function, a DPIA may be advisable and that the related assessment is the Controller’s responsibility.

14. Aggregated and anonymous data

DevInterface may process, as independent controller, data that has been aggregated and irreversibly anonymised — not attributable to the Customer, Guests, persons making bookings or visitors — for the purposes of improving the Service, cost monitoring, internal statistics and benchmarking. Such data does not constitute personal data and falls outside the scope of this DPA. The data of the Pre Check-in Function are not used for this purpose.

15. Audits

15.1 DevInterface makes available to the Controller the information necessary to demonstrate compliance with the obligations of Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or by an auditor mandated by it and bound by confidentiality obligations.

15.2 Audits shall be carried out with at least 30 days’ prior written notice, during normal business hours, no more than once per calendar year — save in the case of an established data breach or a specific request from a supervisory authority — and in a manner that does not compromise the security, confidentiality and operational continuity of the platform’s other customers.

15.3 DevInterface may fulfil its obligations under this Article by providing documentation, completed questionnaires or independent audit reports, where suitable to meet the request.

15.4 Audit costs beyond the provision of documentation shall be borne by the Controller, unless the audit establishes a material breach by DevInterface.

16. Liability

The limitations of liability set out in the Terms also apply to this DPA, to the extent permitted by applicable law and without prejudice to Article 82 GDPR as regards liability towards data subjects.

17. Term, amendments and governing law

17.1 This DPA remains in force for the entire duration of the processing carried out on behalf of the Controller and terminates upon completion of the operations referred to in Article 12.6.

17.2 DevInterface may update this DPA to reflect regulatory changes, measures of supervisory authorities or the evolution of the Service, giving the Customer reasonable notice and, for the addition or replacement of sub-processors, the notice referred to in Article 8.2.

17.3 This DPA is governed by Italian law; the Court of Verona has exclusive jurisdiction over any dispute.

17.4 In the event of conflict between this DPA and the Terms on matters of personal data protection, this DPA shall prevail.

Annex A — Processing details

Common elements

Item	Content
Controller	The Customer (accommodation business)
Processor	DevInterface srl
Subject matter	Provision of the ConSergio.ai platform in the functions active for the Customer
Duration	Term of the contract + retention periods (Article 12)
Payment data	None — the Service does not collect payments from Guests or persons making bookings
Staff Users	Name, e-mail, role and permissions, language, credentials in non-reversible form, push subscriptions, action logs

A.1 — Concierge Module (all Plans)

Item	Content
Purpose	Content consultation, request management, AI conversational assistance, messages and surveys, notifications, automated translation, statistics
Data subjects	Guests of the Property; Staff Users
Categories of data	Room identifier and token; access code in non-reversible form; request content and notes; chat messages and language; Guest name, period and occupants if entered by staff or taken from the booking; stay context for the AI; message deliveries; survey answers; push subscriptions; room charges; technical and connection data
Special categories	Not requested; possible spontaneous disclosure (Article 3.5)
Retention	30 / 365 / 730 days according to the Plan, reducible; name and access code removed at the end of the stay (Article 12.2)
Transfers outside the EU	AI model provider; network services (Annex B)

A.2 — Reservations Module (“+ Reservations” Plans)

Item	Content
Purpose	Management of bookings and stays, confirmations to persons making bookings, calendar synchronisation, records and tourist tax; through the Widget, answers to visitors and booking requests
Data subjects	Persons making bookings and Guests under the bookings; visitors to the Customer’s website
Categories of data	First name, last name, e-mail, telephone and language of the person making the booking; Guest name, adults, children, dates and times per room; channel and external references; price items and adjustments; number of persons exempt from the tax (without reason); internal notes; delivery outcome of confirmations; imported events (dates and title). Widget: messages, language, originating website and session identifier; booking request form data; anti-automation signals and IP; text of the website’s public pages, if enabled
Data excluded	Identity documents, dates of birth, addresses, citizenship, payment data
Retention	Contact details and notes: 12 months from the last departure. Records: at least 5 years from the end of the year of check-out, extendable by the Controller. Widget chat: 90 days (Article 12.3)
Transfers outside the EU	AI model provider (Widget chat only); e-mail delivery; network and anti-automation services (Annex B)

A.3 — Pre Check-in and Alloggiati Web Function (can be enabled on all Plans)

Item	Content
Purpose	Compliance with the notification obligation under Article 109 T.U.L.P.S. and proof of compliance
Legal basis for the Controller	Legal obligation (Article 6(1)(c) GDPR); consent for optional promotional communications (Article 6(1)(a) GDPR)
Data subjects	Guests staying at the Property, minors included; persons making bookings who receive the invitation
Categories of data	Last name, first name, sex, date and place of birth, citizenship, role in the party, arrival and nights; identity document (type, number, place of issue) only for single guest, head of family and group leader; booking e-mail for the invitation; outcome of the in-person verification; transmission log; receipts; the Customer’s Alloggiati Web credentials; acknowledgement of the notice; optional promotional consent
Data excluded	Images or copies of documents, biometric data, video verification
Recipients	Italian State Police through Alloggiati Web (Article 1.5)
Retention	Identity data: within 2 hours of the record being acquired; within 25 hours of cancellation, no-show or negative outcome; within 3 days of departure if incomplete. Receipts, transmissions and outcomes: as the records. Access logs: 12 months. Promotional consent: until withdrawn, and the withdrawal until the closure of the Account (Article 12.4)
Transfers outside the EU	Only e-mail delivery of invitations and network services; no transmission to the AI model provider

Annex B — List of sub-processors

Sub-processor	Activity	Functions concerned	Processing location	Transfer safeguards
Contabo GmbH	Hosting of the application infrastructure, the database and the vector index	All	Germany (EU)	Not applicable (EU)
Amazon Web Services (S3)	Storage of files, images and documents uploaded by the Customer; storage of backups, encrypted at rest by the provider	All	Italy — Europe (Milan) region, eu-south-1	Not applicable (EU)
OpenAI	Generating responses of the assistant and the Widget, creating embeddings, translating content at staff’s request, generating survey questions	Concierge; Widget	USA	SCCs and, where applicable, EU-US Data Privacy Framework
Postmark (ActiveCampaign group)	Sending e-mails on the Customer’s behalf: booking confirmations and receipts, notifications to staff and, from a dedicated server with open and click tracking disabled, pre check-in invitations and reminders	Reservations; Pre check-in	USA	SCCs and, where applicable, EU-US Data Privacy Framework
Cloudflare, Inc.	Content delivery and protection of traffic to the platform (IP addresses and connection data of all users); anti-automation verification of the Widget booking request form	All; Widget	Global network, headquartered in the USA	SCCs and, where applicable, EU-US Data Privacy Framework

Notes. The vector index is self-hosted on the infrastructure above and does not involve an additional sub-processor (Article 8.3). For the reasons given in Article 8.4, the following do not appear in this list: the payment services provider, the place search service used as an external source, browser push notification services, and the State Police as operator of Alloggiati Web. Any future adoption of a dedicated automated translation or e-mail delivery provider will be notified in accordance with the procedure in Article 8.2.

The up-to-date list of sub-processors is available on request and published at the address indicated in the Privacy Policy.

Data minimisation and protection by design - Guest access to the web app without registration, login or provision of identifying data. - Non-sequential, unpredictable room access tokens, which the Customer can regenerate if compromised; stay access codes, where enabled by the Customer, stored in non-reversible form. - No processing of payment data of Guests or persons making bookings. - Automatic removal of e-mail addresses and sequences of six or more digits from text sent to third-party providers. - Pre check-in: no upload of files or images; document requested only for the roles for which the legislation requires it; data not required by the record format removed before saving; no transmission to the portal without a positive in-person verification. - Automatic erasure according to the deadlines in Article 12, performed by scheduled procedures that log each erasure without recording its content.

Encryption and data protection - Encryption of data in transit via TLS. - Application-level field encryption for pre check-in personal details and document data, for the text of Alloggiati Web rejections, for the related receipts, for the Customer’s credentials to third-party services, for the Property’s Wi-Fi credentials, for external calendar addresses and for the e-mail address of the promotional consent; user credentials stored in non-reversible form. - Pre check-in link tokens stored only as a cryptographic fingerprint, with expiry and lock-out after 10 wrong attempts. - Application secrets managed outside the source code.

Access control and isolation - Strict logical isolation between Properties, with mandatory application-level scoping extended to semantic search. - Dedicated automated tests verifying isolation, run continuously. - Differentiated role and permission system for Staff Users, with access to pre check-in data limited to owners, Property managers and reception Users not restricted to specific departments. - Access by DevInterface staff to the Customer’s Account recorded in the action log and shown in the panel. - DevInterface support staff excluded, through the application, from access to identity data, including read access and including when operating on the Customer’s Account; technical access to the infrastructure is reserved to system administrators. - Segregation of development, test and production environments.

Traceability - Log of sensitive actions (configuration changes, exports, erasures, access by DevInterface staff), including reads and modifications of pre check-in data made from the panel, without recording the values. - Technical logs of transmissions to Alloggiati Web limited to the form of the communication, with Guests’ values masked. - Parameters containing personal data filtered from application logs; for pre check-in data, automated checks preventing it from entering URLs, logs, processing queues and error messages. - Logging of the external sources actually used in responses.

Protection of public endpoints - Rate limiting on the public endpoints of the Widget and the pre check-in form and, in the web app, on the chat, on access code attempts and on notification subscriptions. - Anti-automation verification, honeypot field and minimum completion time on the Widget booking request form. - Checking of the origin of Widget calls against the websites authorised by the Customer, where specified. - Containment measures against attempts to manipulate the AI model’s instructions.

Continuity and resilience - Daily backups in the European Union, in 7 rotating copies, and restore procedures. - Service availability monitoring and incident management. - Controlled degradation if the AI provider is unavailable, maintaining essential functions. - Transmissions to Alloggiati Web with an uncertain outcome not repeated automatically, to avoid duplicate notifications.

Organisational measures - Confidentiality obligations for persons authorised to process data. - Administrative access restricted to strictly necessary personnel. - Documented procedure for managing incidents and data breaches. - Automated test coverage of domain logic, tenant isolation, confidentiality of pre check-in data and payment flows; controlled release process.

Digital acceptance

This document is deemed accepted by the Customer when the Account owner ticks the relevant checkbox, during registration for the Service or, for Customers already registered, in the management panel. The user identifier, document version, date and time, IP address and user agent of the acceptance are recorded. On request, DevInterface will provide a copy of this DPA in a form suitable for signature.

DevInterface srl — ConSergio.ai Data Processing Agreement — Version 2.1