WelcomeYOU Data Processing Agreement

Last updated: 3 November 2026

1. Parties and scope

This Data Processing Agreement (“DPA”) forms part of the WelcomeYOU service agreement between the host/subscriber (“Controller”) and Svein Olav Steinmo, operating as Sentimo, Bergsfjordveien 1990, 9385 Skaland, Norway (“Processor”). Contact: support@welcomeyou.no.

This DPA applies when the Processor processes personal data on behalf of the host, particularly guest and booking information. We are an independent controller for our own account, billing, security, and customer-support purposes, which are covered by the Privacy Policy.

This DPA applies while the service agreement is active and thereafter for as long as personal data is processed on the Controller's behalf. In the event of a conflict relating to such processing, this DPA prevails over the general Terms of Service.

2. Instructions and responsibilities

The Processor processes personal data only on documented instructions from the Controller. Account use, booking entry, feature activation, and sharing settings are documented instructions together with this DPA. Processing required by applicable law may occur, with advance notice where legally permitted.

The Controller determines purposes and legal bases, provides appropriate information to guests, ensures data accuracy and minimization, and shares Guest Links and calendar URLs responsibly. Special-category data should not be entered unless the parties have specifically agreed appropriate handling.

The Processor will promptly notify the Controller if, in our opinion, an instruction infringes applicable data-protection law.

3. Confidentiality and security

The Processor ensures that persons authorized to handle personal data are bound by confidentiality. We implement appropriate technical and organizational measures under GDPR Article 32, based on risk, including authentication, separation of host data through access controls, protected server communications, secure handling of secret links/tokens, operational logging, and restricted provider access. No online service can guarantee absolute security.

4. Subprocessors

The Controller grants general authorization for necessary subprocessors. Principal providers used for the relevant processing include Supabase (database, files, authentication, functions), Vercel (hosting and technical operation), OpenAI (translation of host-provided content), and relevant browser-push or other providers where those functions are enabled. Resend is used for new-account operational notifications, primarily as part of our own handling of account information. Stripe handles payment information in its payment role and is not generally a subprocessor for guest-booking data.

We impose relevant privacy and confidentiality obligations on subprocessors through applicable provider agreements. For material planned changes to subprocessors handling guest data, we will notify hosts in an appropriate manner in advance, allowing them to raise a reasoned objection. If an objection cannot be resolved, the host may terminate the service under the agreement. Third-party providers do not become parties to this DPA.

5. International transfers

Where personal data is transferred outside the EEA, the Processor will use a valid transfer mechanism under GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses with necessary supplementary safeguards. Information about relevant providers is available on request.

6. Assistance and incidents

Taking account of the nature of processing, the Processor will reasonably assist the Controller in responding to data-subject requests for access, rectification, erasure, and other GDPR rights. We will also provide appropriate assistance with security assessments, data-protection impact assessments, and prior consultation when required.

Where a personal-data breach affects data processed on behalf of the Controller, we will notify the Controller without undue delay after becoming aware of the breach, supplying available information and appropriate assistance. The Controller remains responsible for its own regulatory and data-subject notifications when required.

7. Information and audits

We will make information necessary to demonstrate compliance with GDPR Article 28 available to the Controller and allow reasonable, proportionate audits, including inspections where required. Audits must protect other customers' confidentiality and security and minimize operational disruption. Relevant independent assurance documentation may be used where sufficient.

8. End of processing and deletion

Before account deletion, the Controller may contact us to arrange a feasible export of its data. Account deletion removes active guest and booking records belonging to that account. Information may remain temporarily in backups and logs under applicable retention arrangements; such data will not be repurposed and will be deleted according to those arrangements unless continued retention is required by law. We will provide reasonable assistance with export or deletion upon request where technically feasible and lawful.

Annex A – Description of processing

Purpose: manage guest stays, display relevant guest information through Kiosk and Guest Link, import calendars, provide translations, and operate the service.

Data subjects: guests and contact persons mentioned in host-provided content.

Data types: guest names, country, language, guest counts, stay dates/times, booking status/source, external references, content, and technical access/usage data relating to bookings and screens. No Article 9 special-category data is ordinarily intended.

Processing activities: collection, storage, structuring, access-controlled display, translation, sharing under host instructions, backups, and deletion.

Duration: while the host account is used and for subsequent limited technical retention periods.

Instructions: host actions and settings within the service and this DPA.

Annex B – Security measures

Measures include authentication and authorization, role-based access separation between host accounts, protected server access and secret tokens for shared displays, encrypted transport, operational logging, backup arrangements at infrastructure providers, and incident-handling procedures. Measures are reviewed and adjusted to risk and provider capabilities.

Contact: support@welcomeyou.no