This agreement explains how StaySphere ("we") handles personal data on behalf of a hotel using online StaySphere ("the hotel", "you"). It forms part of our Terms of Service.
It is written to meet:
- India's Digital Personal Data Protection Act, 2023 (the "DPDP Act");
- the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL").
Offline StaySphere is not covered, because hotel data stays on the hotel's own computer and we do not process it.
1. Roles
You decide why and how your guests' and staff's personal data is used, so you are responsible for it: the Data Fiduciary (India) or Controller (UAE). We process it only to run StaySphere for you, as your Data Processor.
2. What we process
| Purpose | Hosting and running StaySphere for your property: reservations, check-in and check-out, billing, payments, housekeeping, reports, backups and support. |
|---|---|
| People | Your guests (including people staying with them), your staff users, your agents and business contacts. |
| Data |
|
| Duration | While your online account is active, plus the export and deletion period in section 10. |
3. Your instructions
- We process your data only on your documented instructions. Your instructions are the way you set up and use StaySphere, these terms, and any written instructions you give us.
- We will not use your data for our own purposes, sell it, or use it for advertising.
- If the law requires us to process it in another way (for example a court order), we will tell you first, unless the law forbids that.
- If we think an instruction breaks the DPDP Act or the UAE PDPL, we will tell you.
4. Confidentiality
Only people who need access to provide or support the service can reach your data, and they are bound to keep it confidential.
5. Security
We keep appropriate technical and organisational measures in place, including:
- encrypted connections (HTTPS) for all access;
- passwords stored hashed, never in readable form;
- a forced password change for default passwords;
- limits on repeated failed logins;
- role-based access for your staff, and an audit log of important actions;
- a separate database for each hotel, so one hotel's data is kept apart from another's;
- regular backups, and restricted access to our servers;
- prompt security updates.
6. Sub-processors
We use these sub-processors to host online StaySphere:
| Sub-processor | Service | Location |
|---|---|---|
| Amazon Web Services (AWS) | Servers, storage and backups | India (Mumbai). UAE region on request. |
- We will tell you at least 30 days before adding or replacing a sub-processor, so you can object.
- Each sub-processor is bound to protect your data at least as well as this agreement requires.
- Services you switch on yourself are your own choice and are not our sub-processors:
- Cloud Backup to your Google Drive;
- email through your own mail server;
- channel managers;
- WhatsApp sharing.
7. Where data is stored and transfers
- Hotels in India: data is stored in India.
- Hotels in the UAE:
- Data is stored in India unless you ask for UAE hosting. Storing it in India is a transfer of personal data outside the UAE. This agreement provides the contractual safeguards for that transfer under the UAE PDPL.
- If you need your data to stay in the UAE, we will host your account in a UAE region.
- Hotels in a UAE free zone with its own data law (such as DIFC or ADGM): tell us. We will agree any extra terms that law requires.
8. Helping with guest requests
- Guests may ask to access, correct, erase or move their data. You can handle most of these directly in StaySphere: edit or remove guest records, and export reports.
- If we receive a request directly, we will pass it to you and not answer it ourselves, unless you ask us to.
- We will give you reasonable help with requests, and with any data protection assessment you need to carry out.
9. Data breaches
- If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and in any case within 48 hours.
- We will tell you what happened, what data and people are affected, and what we are doing about it.
- We will help you inform the Data Protection Board of India or the UAE Data Office, and affected people, where the law requires.
10. Deletion at the end
- When your online account ends, you can export your data for 30 days.
- We then delete it from our servers. Copies in backups are deleted within a further 35 days.
- We keep data longer only if the law requires it, and keep it protected while we do.
- On request, we will confirm the deletion in writing.
11. Information and audits
- We will give you the information you reasonably need to show that this agreement is being followed.
- If an authority or a serious concern requires it, we will allow a reasonable audit or inspection. You give reasonable notice, it happens during business hours, and it is limited to what is necessary.
12. Your responsibilities
- Collect guest data lawfully, with any notices or consent required.
- Collect only what you need.
- Manage your staff logins and roles.
- Respond to your guests' requests, with our help.
13. General
- Liability under this agreement follows the limits in our Terms of Service, except where the law does not allow it.
- This agreement follows the governing law and courts set out in the Terms for your country.
- If this agreement and the Terms conflict on data protection, this agreement wins.
Questions about this agreement:
StaySphere support
sales@stayspheres.in
+971 52 793 6638 (phone / WhatsApp)