Data Processing Addendum

This addendum applies when a property ("Customer") uses TravelOpen to process the personal data of its guests and staff. It forms an inseparable part of the Terms of Service.

This is the document a Customer's legal team normally asks for before signing. For a signed and stamped copy, contact business@travelopen.ai.

1. Roles of the parties

The Customer is the data controller: it decides what data is processed and for what purpose.

B.Army is the data processor: we process only on the Customer's instructions, expressed through the contract and through how the Customer configures the system.

We do not use Customer personal data for our own purposes, do not sell it, and do not use it to train AI models shared with other customers.

2. Scope of processing

Data subjects: guests, bookers, and the Customer's staff who hold accounts on the system.

Categories of data: name, nationality, date of birth, identity document number (national ID or passport), email, phone number, address, booking and stay history, payment information excluding full card numbers, and guest correspondence.

Purpose: hotel operations — taking bookings, check-in and check-out, channel synchronisation, invoicing, guest care, reporting to the Customer, and statutory guest-registration obligations.

Duration: for the term of the contract plus 30 days after termination.

3. Our obligations

We undertake to:

1. Process personal data only on the Customer's documented instructions, unless required otherwise by law — in which case we notify the Customer before processing, unless the law prohibits that notice.
2. Apply appropriate technical and organisational measures: encryption in transit and at rest, role-based access control, complete audit logging, and regular backups.
3. Bind every member of staff with access to personal data to a duty of confidentiality.
4. Assist the Customer in responding to data subject requests within 72 hours of receiving the request from the Customer.
5. Assist the Customer in preparing its personal data processing impact assessment dossier under Decree 13/2023/ND-CP, by supplying a technical description of the data flows in the system.
6. Notify the Customer within 24 hours of becoming aware of a personal data breach, including scope and remediation, so the Customer can meet its own notification deadlines with the authorities.
7. Delete or return the data at the end of the contract, at the Customer's choice.

4. Customer obligations

The Customer warrants that it has a valid legal basis to collect the data and to transfer it to us for processing, including obtaining data subject consent where the law requires it.

The Customer is responsible for configuring the scope of AI agent activity in line with its own internal policy, and for reviewing the audit log periodically.

5. Sub-processors

We use the following sub-processors, each bound to equivalent data protection obligations:

Before adding or replacing a sub-processor we give the Customer at least 30 days' notice. The Customer may object in writing; if the parties cannot agree a solution, the Customer may terminate without penalty.

6. Cross-border transfers

Transfers of Vietnamese citizens' personal data outside Vietnam are carried out under Decree 13/2023/ND-CP. We prepare and retain the required cross-border transfer impact assessment dossier and provide a copy to the Customer on request.

7. Demonstrating compliance

On reasonable request, and no more than once every 12 months unless there has been a security incident, we provide the Customer with documentation of our security measures, our access-control configuration, and an extract of the audit log relating to the Customer's data.

8. Contact

For any personal data protection matter: support@travelopen.ai.