SCANwelcome · Legal information

Data Processing Agreement (DPA)

Proposed processor terms under Article 28 GDPR, subject to completed annexes and agreement.

Version SW-PUBLIC-2026-11-08-V2 · Effective from 8 November 2026

Draft pending legal review · not evidence of acceptance

Roles and scope

The accommodation provider is controller of guest information processed on its instructions. INITIO d.o.o. acts as processor for that information, and may separately be controller for its own account, billing and security data.

Subject and duration

Processing covers hosting, display, translation and management of digital-guide data during the service relationship, followed by contractually governed return or deletion.

Data and individuals

Data subjects can include guests, accommodation staff and contact persons. Data may include names, contact information and guide or support content. Sensitive categories are excluded unless additional safeguards are expressly agreed.

Instructions and confidentiality

Processor acts solely on documented controller instructions unless required by law; authorised personnel are bound by confidentiality. Controller remains responsible for lawful instructions.

Security, assistance and incidents

Processor implements appropriate technical and organisational measures, supports data-subject requests and compliance duties, and notifies controller of personal-data breaches without undue delay after becoming aware.

Subprocessors and transfers

Subprocessors require prior specific or general written authorisation with equivalent obligations. Actual suppliers, locations, changes and international transfer safeguards must be made available and verified before contractual use.

Return, deletion and audits

At the end of services, processor returns or deletes data at controller choice unless mandatory retention applies, supplies necessary compliance information and facilitates lawful audits subject to confidentiality and security protections.

Annexes and effectiveness

This public draft is not a completed binding DPA. Processing inventory, verified subprocessors, security controls, deletion periods, transfer arrangements and incident contacts must be completed before incorporation.