Data Processing Agreement (DPA)

1. Parties, electronic acceptance and priority

In this pre-formation version, The Artifics is the service brand; the actual service provider’s legal identity is disclosed in the account/acceptance screen and Legal Information before binding DPA acceptance is enabled. This informational version does not itself form a binding DPA or authorise personal-data processing. Data-protection contact: info@theartifics.com. The Customer is the hotel operator identified in the verified Guester customer account. An authorised representative's acceptance expressly including the Terms of Service and this DPA is tied to the hotel account, user, document version, timestamp and scope record. This document has no handwritten completion or customer signature lines. Electronic acceptance of the general contract does not remove a statutory formality applying to a particular instrument.

This DPA prevails over the Terms of Service for personal-data processing. Mandatory transfer instruments prevail for transfers they govern. The Privacy Notice describes controller activities and does not itself instruct all hotel-data processing. Acceptance by an unauthorised employee does not replace authority to represent the hotel.

2. Roles and scope

The Hotel is controller for the purposes and essential means of its guest, reservation, stay, service-communication and staff data. The Provider processes such data on documented Hotel instructions. The Provider is a separate controller for its own account, security, customer-relationship, acceptance-evidence and mandatory-record purposes. A public/competitor-review corpus compiled for its own purposes requires a separate role assessment; this DPA does not automatically supply its legal basis.

Processing is limited to selected account modules, authorised properties and enabled integrations. It may include receipt/collection, validation, organisation, storage, display, analysis, permitted disclosure, export and deletion. A free pilot does not remove data-protection obligations. Except for necessary retention and exit operations, processing is limited to the service period.

Provider processing of demonstrations/bookings, Founding sales enquiries and career applications for its own customer/candidate relationships is not automatically Hotel-data processing under this DPA. Those activities follow the relevant website Privacy Notice’s controller role and lawful conditions; submitting a form alone is not acceptance of a DPA or a PMS instruction on the Hotel’s behalf.

3. Data categories and purposes

PMS/reservation functions may involve guest names, contact information, reservation/stay dates, room/type, rate and country fields. Nationality and birth date may be processed only if the actual PMS supplies them and the purpose requires them. A country field does not always mean citizenship. A field's presence in a PMS does not itself authorise transmission of names, nationality or birth dates to AI; field, purpose and recipient require separate definition.

Review functions may use author names, text, rating, date and source/property references. Staff matching may use staff names, roles, departments and relevant review excerpts. Communications may use email addresses, subjects/bodies, correspondence history and survey links. Data subjects include account users, hotel staff, guests, agency representatives and reviewers. Information added to free text cannot be assumed outside the processing scope.

Identity-document/passport images, full payment-card/CVV information, health and other special-category data are excluded from general product scope. A necessary exception requires a separate lawful condition, restricted scope, specific security and approved instruction. Child-guest data requires the Hotel's lawful basis and additional proportionality controls; AI chat is not opened directly to children.

4. Instructions and Hotel duties

Account permissions, approved activation scope, integration authorisations and instructions through a verified support channel are recorded. The Hotel establishes lawful collection/processing conditions, guest/staff notices, required consent or other bases, source/account access authority and correct property mapping. Contract acceptance is not a guest's or employee's consent. Instructions remain limited to service purposes and applicable law.

The Provider informs the Hotel of an instruction it identifies as unlawful and suspends the affected operation pending clarification. If law requires different processing, the Hotel is informed beforehand unless prohibited. The Provider's duties are not reduced to reliance on Hotel assurances; it remains responsible for its security, subprocessor and transfer obligations.

5. Minimisation and AI processing

Only fields required for the function must be used. Identity removal, field reduction and masking are applied where practicable in AI analysis. Truncating text, using initials or removing a name does not invariably anonymise data. Raw PMS data, email histories or staff records must not be sent wholesale to a model without a defined purpose.

Cloudflare Workers AI supports review/staff functions and Google Gemini supports panel chat. Active OpenRouter routes use multiple models, which may include Google/Gemini and Anthropic/Claude models. The actual inference provider, endpoint and onward recipients are established separately from the model brand; use through OpenRouter does not mean a direct contract with the model developer. Cloudflare fallback may also operate according to the routing configuration. Each recipient, model route, account type, region, logging/retention, training use and downstream recipient condition must be assessed before personal-data use. Uncontrolled model/provider switching and fallback to an unapproved recipient are prohibited. A route lacking required conditions is suspended or restricted to content without personal data.

Hotel data is not allocated to the Provider's independent general-model training, advertising profiles or another hotel's analysis. Where a third-party AI service's general terms would permit such use, personal data is not sent until appropriate terms/settings are established. Zero retention, no-training or regional-processing claims are limited to the actual service/account and verified configuration to which they apply.

OpenAI or other AI providers may be evaluated in the future. OpenAI is not identified as a confirmed active recipient in this version; it is an example of a future candidate. Flexible model selection is not unlimited advance permission to send personal data to an undisclosed recipient. Before a new recipient is used, this DPA’s subprocessor notice/objection process and requirements for data scope, actual endpoint/country, contractual terms, transfers and technical controls must be satisfied, and the relevant list updated. Evaluation or testing without personal data is separate from live personal-data transfers.

6. Authorised people and confidentiality

People accessing data for the Provider or subprocessors must be subject to confidentiality obligations; access is limited to their tasks and necessity. Shared accounts, passwords/API secrets in open support messages and cross-hotel viewing permissions are prohibited. Access is reviewed when people join, change duties or leave. Confidentiality continues after service termination for as long as the data requires protection.

7. Technical and organisational measures

The Provider establishes security proportionate to the nature, scope, context and risks of processing. It maintains an up-to-date record covering property/customer separation, least privilege, secure transmission, administrative-access controls, secret handling, updates/vulnerabilities, backup/recovery, incident response and deletion. The scope of those measures is available for reasonable Hotel review. Non-existent MFA, at-rest encryption or certifications must not be presented as implemented.

New sensitive fields, external actions or AI routes require reassessment. Unknown safeguards cannot be bypassed by assigning all risk to the Hotel. An affected field/function remains disabled until required controls are available. The Hotel manages its own user permissions, devices, PMS and email-account security.

A Tier, ISO or similar assessment relating to a data centre or infrastructure provider is limited to the verified facility, certification scope and validity period. It is not represented as certification of Guester’s application, the entire processing chain or the service level. Private cloud and cluster architecture alone do not promise uninterrupted service, a particular backup/recovery period or that all data remains in Türkiye; applicable concrete controls are documented separately.

The scope of 24/7 support for critical failures and incidents is set out in the Support and Service Level Agreement (SLA). This support schedule does not guarantee permanent resolution or disaster recovery within a particular number of minutes/hours, or a specific availability percentage. DPA incident-notification and assistance obligations are not postponed because of the support calendar.

8. Subprocessors

The Subprocessors and Data Flows document (version 3.3, 13 October 2026) forms part of this DPA for the disclosed data routes. The table below summarises that document. The Hotel generally authorises necessary disclosed subprocessors only within the selected modules, properties, activation scope and this DPA’s limits. Listing a service does not activate a conditional route for every Hotel or cure incomplete processing/transfer requirements. Confirmed recipient and use, appropriate processing terms, a valid transfer condition and technical controls are required. The role of a service contracted directly by the Hotel is separately established; a Provider-selected service cannot escape responsibility merely by being called an integration.

A new/replacement subprocessor is notified with reasonable detail at least thirty days before receiving Hotel data; the Hotel may raise a reasoned data-protection objection within fifteen days. An emergency security change requires immediate information, narrow scope and an appropriate alternative; urgency does not remove transfer requirements. The parties consider an alternative or disabling the affected function. An unresolved material objection permits termination of the affected service without penalty. The Provider binds subprocessors through written contracts imposing at least equivalent relevant data-protection obligations and retains its contractual responsibility.

On small screens, scroll horizontally to view the full table.

Headquarters countries are not a complete list of data-centre or remote-access countries. A row may identify a directly contracted subprocessor, model route or infrastructure chain; actual roles are established separately. No row means that every PMS field is sent to every provider, zero retention applies or required transfer instruments are complete. Specific data fields and additional recipients selected directly by the Hotel are described in the detailed list and activation scope. Private cloud alone does not guarantee customer-dedicated physical hardware, a particular isolation level, an availability percentage or certification. The name of the physical data centre alone does not determine its operator’s access to data or contractual role.

9. International transfers

Primary servers in Türkiye do not remove the international nature of Cloudflare TLS/AI, Google, OpenRouter, Channex and other external routes. Headquarters, processing/storage and remote-access countries are separately assessed. Regular transfers require an applicable adequacy or appropriate-safeguard mechanism under Article 9 of Law No. 6698; occasional-transfer exceptions are not a general solution for routine SaaS flows.

Where official Turkish standard contracts are required, the appropriate document and annexes reflect the actual exporter/importer roles; prescribed text is preserved, authorised parties sign and notification within five business days following the final signature is completed. Checkbox acceptance of this DPA does not replace that instrument's form or notification. GDPR/UK instruments alone do not establish all Turkish requirements. Without a valid mechanism, the affected personal-data transfer does not proceed; suspension or an alternative is assessed as required by law.

10. Breach and incident support

Once aware of a breach affecting Hotel data, the Provider informs the Hotel's recorded authorised contact without undue delay. It shares known scope, data/subject categories, likely consequences, measures taken and a contact, then supplies updates. Initial notice is not delayed until the investigation finishes. Reasonable assistance, incident records and evidence preservation support the Hotel's regulator/data-subject notifications. Legal deadlines are not extended by support hours or commercial response targets.

The Hotel manages its controller notification decisions and deadlines; the Provider's own statutory duties remain. Not every system error is a personal-data breach, but incidents must be assessed. Cross-hotel access, wrong-property actions and disclosed active secrets require immediate restriction of the affected access/action.

11. Rights and meaningful human review

The Provider promptly refers Hotel-data requests to the Hotel and does not disclose guest data to a requester/third party without authorised instructions. It provides technically practicable, risk-proportionate assistance with search, access, correction, deletion and recipient notification, cooperating to meet the Hotel's deadlines. Where necessary, assistance also covers risk assessments and competent-authority investigations.

Staff matching, sentiment analysis and recommendations are not conclusive identity/performance determinations. Significant employment, pay or disciplinary decisions are not based solely on automated scores; the Hotel supplies meaningful human review, correction and challenge channels. The Provider helps validate records/outputs. Sending replies, rates or reservation actions requires separate action permission; the DPA is not an unrestricted external-action authorisation.

12. Retention, return and deletion

Lifecycles for live systems, raw PMS/review files, temporary queues/caches, provider logs, acceptance/security records and backups are documented by data class. Periods are limited by purpose, lawful Hotel instructions, mandatory duties and concrete risk; one indefinite period for all data is unacceptable. Return format, accessible scope, deletion schedule and backup cycle must be disclosed to the Hotel before the relevant function opens. Unverified periods and instant deletion for every record are not promised.

On termination, the Provider returns data in a usable format or deletes it according to the Hotel's selection and lawful instructions, including existing copies. Legally required records are segregated with stated scope and reason, and are not reused for service purposes. Backups are unavailable for new use and disposed of through the documented cycle; deletion instructions are reapplied upon restoration. On request, verifiable confirmation covers completed actions and remaining legal exceptions. Independently controlled records remain subject to their own lawful conditions; that distinction does not allow arbitrary retention of Hotel data.

13. Applicable US state rules

Where CCPA or another US state privacy law governs Hotel-data processing, the Provider complies with its applicable service-provider/processor duties and required protection level. Specific business purposes are, according to selected modules, reservation/PMS reporting, review/communication analysis, staff-review matching, authorised channel/message operations and service security. This DPA does not authorise independent use outside those purposes.

Except where the law permits, the Provider must not sell/share Hotel data, retain/use/disclose it outside the specified purposes or direct service relationship, or combine it with personal data obtained from another customer or independent interaction. It assists with rights requests, risk/security and applicable automated-decision duties, and notifies the Hotel upon determining it can no longer comply. The Hotel may take reasonable steps to verify compliance and stop/remediate unauthorised use; subprocessor contracts impose equivalent restrictions. This classification does not automatically make every website activity service-provider processing.

14. Verification, changes and termination

The Provider supplies reasonable compliance information. Documentary and remote review are prioritised for ordinary assessments; where necessary, it allows and cooperates with reasonable, proportionate assessments by the Hotel or an appropriately qualified independent assessor subject to confidentiality, reasonable notice and protection of other customers’ data. Reasonable or periodic compliance assessments required by applicable law are not contingent on prior proof of a serious risk. Where the Provider arranges an appropriate independent assessment, the relevant report is supplied upon reasonable request. Statutory authority and urgent real-breach investigation cannot be obstructed. Needless repetition and trade-secret disclosure are avoided; cost arrangements cannot nullify legal rights.

Material changes to purposes, fields or recipients are disclosed in advance and implemented only after required instructions/acceptance and transfer steps. Incorporating a new company does not itself change the Provider under this DPA; legally required assignment, customer agreement and privacy updates must occur. Confidentiality, return/deletion, incident support and mandatory records survive for as long as needed. Liability follows the Terms of Service's data/confidentiality provisions, subject to mandatory law and transfer instruments.