1. Definitions

In this Agreement, the following terms have the meanings set out below, and cognate expressions shall be construed accordingly:

"Controller" — has the meaning given in the UK GDPR.
"Data Subject" — an identified or identifiable natural person to whom Personal Data relates.
"Personal Data" — has the meaning given in the UK GDPR.
"Processing" — has the meaning given in the UK GDPR.
"Processor" — has the meaning given in the UK GDPR.
"Sub-processor" — any third party engaged by the Processor to carry out processing activities in respect of the Personal Data on behalf of the Controller.
"UK GDPR" — the UK General Data Protection Regulation (Regulation (EU) 2016/679 as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018), together with the Data Protection Act 2018.

2. Subject-matter

This Agreement governs the Processing of Personal Data by MSK on behalf of the Operator in connection with the provision of the MSK Guestbook platform and associated services ("Services") as described in the Platform Terms and the applicable subscription order.

This Agreement forms part of, and supplements, the Platform Terms. In the event of conflict between this Agreement and the Platform Terms, this Agreement shall prevail with respect to the Processing of Personal Data.

3. Nature and Purpose

MSK shall Process Personal Data only to the extent necessary to provide the Services, including but not limited to:

facilitating digital guest check-in and check-out;
managing reservations, housekeeping, maintenance and staff tasks;
enabling messaging between operators, staff, suppliers and guests;
generating reporting and operational insights for the Operator;
maintaining platform security, integrity and availability;
complying with legal obligations applicable to MSK as a data processor.

MSK shall not Process Personal Data for its own purposes or for any purpose other than those set out in this Agreement, unless required to do so by applicable law, in which case MSK shall (to the extent permitted by law) inform the Operator before such Processing.

4. Duration

This Agreement shall remain in force for the duration of the Platform Terms (including any renewal periods) and shall terminate automatically upon termination or expiry of the Platform Terms, subject to Clause 11 (Return / Deletion of Data).

5. Categories of Data Subjects

The categories of Data Subjects whose Personal Data may be Processed under this Agreement include:

Guests of the Operator's properties;
Employees, contractors and other staff of the Operator;
Suppliers and their representatives authorised to access the platform;
Property managers and administrators appointed by the Operator.

6. Types of Personal Data

The types of Personal Data Processed may include, depending on the modules and features activated by the Operator:

Identity data: full name, date of birth, nationality, document type and number;
Contact data: email address, telephone number, postal address;
Booking and reservation data: arrival and departure dates, room details, preferences;
Device and usage data: IP address, device identifiers, platform usage logs;
Communications data: messages exchanged via the platform messaging system;
Financial data: payment references (processed directly by the applicable payment processor — MSK does not store full card data);
Staff data: name, role, contact details, task and attendance records.

Special category data (as defined in Article 9 UK GDPR) should not be submitted to the platform without prior written agreement with MSK.

7. Technical & Organisational Measures

MSK shall implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction or damage, having regard to the state of the art, the costs of implementation, the nature of the data and the risk of varying likelihood and severity. These measures include, without limitation:

Encryption of Personal Data in transit (TLS 1.2+) and at rest;
Role-based access controls limiting access to Personal Data on a need-to-know basis;
Regular access reviews and automatic session expiry;
Vulnerability scanning and penetration testing;
Logging and monitoring of access to production systems;
Documented incident response and business continuity procedures;
Staff training on data protection obligations.

MSK may update these measures from time to time provided that such updates do not materially reduce the overall level of protection afforded to Personal Data.

8. Sub-processors

The Operator provides general authorisation for MSK to engage Sub-processors. MSK's current Sub-processors are listed at mskguestbook.com/legal/subprocessors.

MSK shall: (a) impose data protection obligations on each Sub-processor substantially equivalent to those set out in this Agreement; (b) remain liable to the Operator for the acts and omissions of its Sub-processors as if they were its own; and (c) notify the Operator of any intended addition or replacement of a Sub-processor at least 14 days in advance, giving the Operator the opportunity to object on reasonable grounds.

9. Data Subject Rights

MSK shall, taking into account the nature of the Processing, assist the Operator by appropriate technical and organisational measures in fulfilling the Operator's obligation to respond to requests from Data Subjects exercising their rights under UK GDPR (including rights of access, rectification, erasure, restriction, portability and objection).

MSK shall promptly notify the Operator if it receives a request from a Data Subject that relates to Personal Data Processed on behalf of the Operator. MSK shall not respond to such requests on behalf of the Operator without the Operator's prior written consent, except where legally required to do so.

10. Breach Notification

MSK shall notify the Operator without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data breach (as defined in UK GDPR) affecting Personal Data Processed under this Agreement. The notification shall include, to the extent available:

a description of the nature of the breach, including the categories and approximate number of Data Subjects and records affected;
the name and contact details of MSK's data protection contact point;
the likely consequences of the breach;
the measures taken or proposed to address the breach and to mitigate its possible adverse effects.

Where the information cannot all be provided at the same time, it may be provided in phases without undue further delay. MSK shall co-operate with the Operator to enable the Operator to meet its own regulatory notification obligations.

11. Return / Deletion of Data

Upon termination or expiry of the Platform Terms, MSK shall, at the Operator's election (notified to MSK in writing within 30 days of termination):

securely return to the Operator all Personal Data in a machine-readable format; or
securely delete or destroy all Personal Data.

MSK shall certify in writing that deletion or destruction has been completed. MSK may retain Personal Data to the extent and for the period required by applicable law, in which case it shall inform the Operator of such retention and continue to protect the data in accordance with this Agreement.

12. Governing Law

This Agreement and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any such dispute or claim, subject to the mandatory application of any applicable consumer or data protection legislation.

For enquiries regarding this Agreement, contact: privacy@mskguestbook.com.

Data Processing Agreement