Data Processing Addendum (Hosts)

v1.0 · 2026-08-23

This Addendum governs the processing of personal data between Zonbook and the host. It forms part of the Host Agreement and applies alongside the Privacy Policy. It is governed by Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).

1. The role of each party

The relationship is not uniform: each processing activity has its own regime.

  • Independent controllers. For most processing, Zonbook and the host act as independent controllers, each for its own purposes: Zonbook operates the marketplace, accounts, payments and security; the host runs its accommodation and its relationship with the guest. Neither party processes on the other's behalf in this area.

  • Zonbook as processor. For the traveller data collected for the accommodation registration duty (clause 3), the legal obligation to register and report is the host's: Zonbook collects, stores and makes that data available on the host's behalf and acts as processor.

  • The host as controller. Data the host processes by its own means outside the platform (its CRM, smart lock, camera, copies of documents) is entirely its own responsibility.

2. Subject matter, duration and categories

  • Subject matter and nature: collection, recording, storage, consultation and disclosure of the data needed to manage bookings and comply with traveller registration.

  • Duration: for as long as the Host Agreement is in force and for the legally required retention periods afterwards.

  • Categories of data subjects: guests, accompanying travellers and contact persons the host adds.

  • Categories of data: identification and contact details; booking and stay data; identity-document details, nationality and date of birth where traveller registration requires them; messaging communications; billing data. Special categories of data under Article 9 GDPR must not be entered into the platform.

3. The traveller registration regime

Where accommodation registration rules apply, Zonbook processes traveller data on the host's documented instructions, which are given by the host's use of the corresponding platform features and its account configuration. Zonbook will:

  • process that data only to collect it, retain it and make it available to the host and, where provided for, transmit it to the competent authority;

  • not use it for its own purposes;

  • inform the host without delay if, in its view, an instruction infringes data-protection law.

The host is responsible for determining which data its territory requires and for the accuracy of what is reported.

4. Confidentiality

Each party ensures that persons authorised to process the data have committed to confidentiality or are under a statutory duty of confidentiality, and that access is limited to what their role requires. The host is responsible for managing the access it grants within its organisation.

5. Security

Zonbook applies technical and organisational measures appropriate to the risk, including: encryption in transit, access control by role and by organisation, strengthened authentication for operator accounts, audit logging of sensitive actions, segregation of data by organisation, backups and their periodic verification, and vulnerability management.

The host undertakes to protect its credentials, revoke access for departing staff, and not extract guest data from the platform beyond what is needed to provide the accommodation.

6. Personal data breaches

Zonbook will notify the host without undue delay after becoming aware of any breach affecting data processed on its behalf, with the information available so the host can meet its own notification obligations. Each party notifies the supervisory authority and, where applicable, data subjects, for the processing for which it is controller.

7. Data subject rights

Requests for access, rectification, erasure, restriction, portability or objection are handled by whichever party is controller for the processing concerned. Each party will reasonably assist the other on receiving a request the other must handle, and will forward it without delay. Zonbook provides the host with the features needed to handle requests concerning its own bookings' data.

8. Sub-processors

Zonbook has general authorisation to engage sub-processors to provide the service, in the following categories: cloud hosting and infrastructure, object storage, payment processing, email delivery, SMS delivery, messaging and notifications, observability and technical logging, and support. The current list of sub-processors and their locations is available at [TODO: sub-processor list URL] or on request to [email protected].

Zonbook imposes on each sub-processor data-protection obligations equivalent to those in this Addendum and remains responsible for their performance. Zonbook will inform the host of the addition or replacement of a sub-processor at least 30 days in advance; the host may object on reasonable data-protection grounds within that period and, if the objection cannot be resolved, terminate the Agreement without penalty as regards the affected service.

9. International transfers

Data is generally processed within the European Economic Area. Where a sub-processor processes data outside the EEA, the transfer relies on an adequacy decision or on standard contractual clauses, together with any supplementary measures required.

10. Deletion and return

On termination of the Agreement, Zonbook will delete or return to the host the data processed on its behalf, other than data whose retention is required by a legal obligation — notably tax retention periods and those of traveller registration — which will be retained under restriction until they expire. The host may export its bookings' data from the portal before closing its account.

11. Audit

Zonbook will make available to the host the information necessary to demonstrate compliance with this Addendum. The host may request, on reasonable notice and not more than once a year unless required by an authority, a proportionate audit, which may be satisfied by providing existing reports or certifications.

12. Liability

Each party is answerable to data subjects and authorities for the processing for which it is controller. The host's breach of its data-protection obligations, including the use of guest data for unauthorised purposes, is governed by clause 12 of the Host Agreement.

13. Contact

Questions about this Addendum: [email protected]