Data Processing Agreement

1. Scope and roles

1.1 You are the controller of the personal data described in Annex I (“Customer Personal Data”) — mainly the feedback and survey answers your guests give through GuestSight. We process it only as your processor.

1.2 This DPA does not cover data we process as controller: your users’ account and sign-in data, billing references, the email delivery log and support correspondence. Our Privacy Policy covers those.

1.3 If this DPA and the Terms conflict on data protection, this DPA prevails.

2. Your instructions

2.1 We process Customer Personal Data only on your documented instructions, including for transfers to countries outside the EU/EEA. The Terms, this DPA, and your settings and actions in the Service (for example creating an event, deleting feedback, generating a report) are your complete instructions. You can give further instructions within the scope of the Service by email to privacy@guestsight.ai.

2.2 We don’t use Customer Personal Data for our own purposes, and we don’t use it or let it be used to train AI models.

2.3 If EU or member-state law requires us to process it otherwise, we tell you first, unless that law forbids it.

2.4 If we think an instruction breaks data-protection law, we tell you and may hold off until you confirm or change it.

3. Confidentiality

Everyone we allow to access Customer Personal Data is bound to confidentiality. Today that is only the owner of the business.

4. Security

We maintain the technical and organizational measures in Annex II (Art. 32 GDPR). We may change them over time but will not lower the overall level of protection.

5. Sub-processors

5.1 You give us general authorization to engage sub-processors. The current list (Annex III) is shown to signed-in customers in the dashboard under Settings → Account → Legal, and sent by email on request.

5.2 We email the owner of your workspace at least 30 days before we add or replace a sub-processor. You can object on reasonable data-protection grounds within that period by replying. If we can’t resolve the objection, you can end the agreement before the change takes effect, and we refund fees paid for the time after that date.

5.3 We bind every sub-processor by contract to data-protection obligations equivalent to this DPA (Art. 28(4) GDPR) and remain responsible to you for their work.

6. Helping you

6.1 If a guest or anyone else contacts us about Customer Personal Data, we forward the request to you without undue delay and don’t answer it ourselves unless you ask us to. The dashboard lets you find and delete feedback; for anything else we help on request.

6.2 We help you meet your duties on security, breach notification, data-protection impact assessments and prior consultation (Arts. 32–36 GDPR), taking into account the information available to us. This help is free unless it takes substantial effort; then we agree a fee with you first.

7. Personal data breaches

We notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data — where possible within 48 hours — with the information we have: what happened, which data and roughly how many people are affected, likely consequences and the measures taken. We send more as we learn it.

8. Deletion and return

8.1 During the agreement. Deletions you make take effect at once: “Delete forever” removes a feedback entry right away. Deleting an event or location closes its survey link at once and deletes its feedback, survey responses and reports 30 days later. Feedback exports (CSV) are deleted 7 days after they are created. Backups (point-in-time recovery) age out after 35 days, so deleted data also leaves the backups within 35 days.

8.2 Deleting your account or workspace. On request to privacy@guestsight.ai we delete it within 30 days and confirm by email.

8.3 End of the agreement. You can have your data exported as section 9 of the Terms describes. After the agreement ends, your data stays retrievable for 30 days; we then delete it and confirm by email. We keep no copies unless EU or member-state law requires us to.

9. Proof and audits

9.1 We make available the information needed to show that we meet Art. 28 GDPR — this DPA, Annex II and our sub-processors’ certifications (for example AWS’s ISO 27001 certificate and SOC reports).

9.2 If that isn’t enough, you or an auditor bound to confidentiality (not a competitor of ours) may audit us, including inspections, with at least 30 days’ notice, during business hours, without disrupting operations, and at most once a year unless there has been a breach or a supervisory authority requires it. You bear the costs of the audit.

10. Transfers outside the EU/EEA

We store Customer Personal Data in the EU (AWS, Frankfurt). Some sub-processors in Annex III process it outside the EU/EEA, in particular for AI analysis. These transfers rely on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) agreed with the sub-processor.

11. Liability, term and changes

11.1 Liability under this DPA follows section 10 of the Terms. This does not limit either party’s liability to data subjects under Art. 82 GDPR.

11.2 This DPA runs as long as we process Customer Personal Data for you, including the deletion periods in section 8.

11.3 We change this DPA in the same way as the Terms (section 11 of the Terms); sub-processor changes follow section 5.2.

11.4 German law applies; jurisdiction follows section 12 of the Terms.

Annex I — Details of the processing

Annex II — Technical and organizational measures (Art. 32 GDPR)

1. Physical security. We run no servers or premises holding customer data. All data sits in AWS data centers in the Frankfurt region, which are ISO 27001 certified and covered by AWS's SOC reports.
2. Access to systems. Customers sign in only with Google; sessions are stored server-side and can be ended at any time; session cookies are HttpOnly, Secure and SameSite=Lax. The internal admin console has its own login with bcrypt-hashed passwords, lockout after failed attempts and 24-hour sessions; its write actions are audit-logged.
3. Access to data. Every request is checked against the workspace bound to the session; all records are stored under a workspace-specific key. Each service runs with scoped AWS permissions (IAM roles). Files such as logos and exports are handed out only through short-lived signed links.
4. Minimization. Guest pages ask for no names or contact details. No IP address, device or browser data is stored with feedback or survey answers; IP addresses appear only in rate-limit counters deleted within hours.
5. Encryption. All connections use TLS (HTTPS only). Database and file storage are encrypted at rest with AWS-managed keys.
6. Transfer control. Service-to-service calls run over HTTPS and are authenticated with API keys.
7. Input control. Server logs are kept 30 days; the AI usage log (no guest text) 90 days; admin write actions are audit-logged.
8. Availability and resilience. Managed AWS services spread across several availability zones in the region; point-in-time recovery for the database (35 days); rate limits on public endpoints; alarms on errors.
9. Deletion. As section 8 of the DPA: immediate feedback deletion, 30-day event purge, 7-day export expiry, 35-day backup expiry, account deletion within 30 days of a request.
10. Sub-processors. Written data-processing terms with each. AI requests go only to zero-data-retention endpoints, with data collection for training switched off on every request.
11. Staff. One person (the owner) has access; anyone given access in future is bound to confidentiality in writing first.
12. Testing and review. Automated test suites and live checks after changes; this annex is reviewed at least once a year and whenever the system changes.

Annex III — Sub-processors

The current list of sub-processors, with what each does, which data it receives and where, is shown to customers in the dashboard under Settings → Account → Legal and sent by email on request to privacy@guestsight.ai. Changes follow section 5.2.