Data Processing Agreement
1. Parties
Controller: the host who holds the ArriveCasa account ("Host"). Processor: Lidus Mila Group SL, Spain ("ArriveCasa").
2. Subject matter, nature and purpose
ArriveCasa processes guest registration data on the Host's behalf to let the Host collect, review, correct, store and export the details needed to register guests and meet the Host's reporting and record-keeping duties under the law of the country where the property is located.
3. Duration
Processing continues for as long as the Host's account is active, and ends as described in section 11.
4. Types of personal data and data subjects
| Data subjects | Personal data |
|---|---|
| Guests of the Host (including minors registered by an adult) | Given names, surname, date of birth, nationality, travel document type and number, home address, purpose of stay, stay dates, party size |
| Host and the Host's staff | Email address, hashed password, login session, property details (see the Privacy Policy) |
No special categories of data are intended to be processed. Photographs of travel documents are read on the guest's own device and are not transmitted to ArriveCasa.
5. The Host's instructions
ArriveCasa will process personal data only on the Host's documented instructions, which are these terms and the Host's use of the service's features, unless the law requires otherwise. If we believe an instruction breaches data protection law, we will tell the Host.
6. Confidentiality
ArriveCasa ensures that people authorised to process the data are bound by confidentiality.
7. Security
ArriveCasa applies appropriate technical and organisational measures, including: encrypted connections (HTTPS); hashed passwords; rate limiting of sign-in and submission endpoints; access controls so that guest data can be read only by the owning Host and each guest can reach only their own check-in; input filtering; and separation of guest submission from data access. We review these measures as the service develops.
8. Sub-processors
The Host gives ArriveCasa general authorisation to use the sub-processors below. We will bind each to data protection obligations no less protective than these, remain responsible for them, and give hosts reasonable notice of additions or replacements so they can object.
| Sub-processor | Purpose |
|---|---|
| Vercel Inc. | Application hosting and content delivery |
| Redis Ltd. (Redis Cloud) | Database hosting |
| Resend (Plus Five Five, Inc.) | Transactional email (for example email confirmation), once enabled |
9. International transfers
Where a sub-processor processes personal data outside the European Economic Area, ArriveCasa ensures an appropriate transfer mechanism is in place, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
10. Helping the Host
- Data subject requests: if a guest contacts us about their data, we will pass the request to the Host without undue delay and will not respond ourselves except to say we have done so. We will help the Host respond within the legal deadlines, for example by supplying, correcting or deleting data.
- Personal data breaches: we will notify the Host without undue delay after becoming aware of a breach affecting their data, with the information we have to help the Host meet its own notification duties.
- Impact assessments and consultations: we will give reasonable help where the Host needs it.
11. Deletion and return
When the Host closes the account, or on the Host's request, ArriveCasa will delete or return the Host's personal data, and delete existing copies unless the law requires us to keep them. The Host can export guest data, and delete bookings, properties or the whole account, from the dashboard at any time. The Host is responsible for keeping any records it must retain by law.
12. Audits and information
ArriveCasa will make available the information reasonably necessary to show it complies with this agreement and will allow and contribute to audits, including inspections, by the Host or an auditor the Host appoints, on reasonable notice, during business hours, and subject to confidentiality.
13. The Host's responsibilities
The Host is responsible for having a lawful basis for collecting guest data, for giving guests the notices the law requires, and for the accuracy and lawful use of the data it exports or reports.
14. Liability and governing law
Liability under this agreement is subject to the limits in the Terms of Service, to the extent the law allows. This agreement is governed by the same law as the Terms.
15. Contact
Lidus Mila Group SL, Spain — casamilocasa@gmail.com.