Data Processing Agreement (DPA)

Preamble

This Data Processing Agreement (DPA) governs the processing of personal data by Stellar Tourism Innovations GmbH ("Xentra", "Processor") on behalf of the Customer ("Controller").

Xentra provides a SaaS platform for managing short-term rentals, within which personal data of guests and contacts of the Customer is processed.

§1 Subject and Duration

The Processor processes personal data on behalf of the Controller in the context of the following services:

• Booking management and guest check-in
• Guest communication (SMS, email, messaging)
• Smart lock and access management
• AI-assisted text generation and analysis
• Payment processing (via Stripe)
• Identity verification and registration

§2 Categories of Data Subjects and Data

Data subjects

• Guests / travelers of the Controller
• Contacts and business partners of the Controller
• Owners and managers of the properties administered by the controller
• Employees and service providers of the controller with access to the platform

Data categories

• Master data (name, address, date of birth)
• Contact data (email, phone)
• Booking data (arrival, departure, price, apartment)
• Identity documents (for check-in with ID verification)
• Payment data (processed by Stripe)
• Communication content (messages, emails)
• Access data for properties (access codes, key assignments) and access logs
• Signatures, uploaded ID images and task photos
• Voice messages and transcripts generated from them
• Scheduling, working time and remuneration data of the controller's service providers

§3 Obligations of the Processor

• Processing data exclusively based on documented instructions of the Controller
• Ensuring confidentiality of all persons entrusted with data processing
• Taking all necessary technical and organizational measures pursuant to Art. 32 GDPR
• Supporting the Controller in fulfilling obligations towards data subjects
• Immediate notification of the Controller in case of data breaches

§4 Sub-processors

The Controller agrees to the use of the following sub-processors:

For sub-processors located outside the EEA, Standard Contractual Clauses (SCC) of the European Commission have been agreed.

The processor may engage additional sub-processors or replace existing ones. It announces this in text form at least four weeks in advance. Within that period the controller may object to a new sub-processor on important data protection grounds; if the affected function then cannot be provided, the controller may terminate the corresponding part of the service. The current version of this table is authoritative.

To handle support requests and remedy malfunctions, the processor's staff may access the controller's account. Such access only takes place for a specific occasion. Screen and audio recordings are only created at the controller's instigation or with their participation.

§5 Technical and Organizational Measures

The Processor has implemented the following measures:

• Encryption of all data in transit (TLS 1.2+) and at rest (AES-256)
• Row-Level Security (RLS) — each user can only see their own data
• Removal or pseudonymisation of personal details before transmission to AI services, where the feature allows it; for translations, e-mail addresses, phone numbers, links and known names are replaced by placeholders
• Audit logging of all AI processing operations (without PII in logs)
• Multi-factor authentication for administrative access
• Regular security reviews and updates
• API key encryption with pgcrypto for all external integrations

§6 Deletion and Return

After the contractual relationship ends, the processor deletes the controller's personal data unless a statutory retention obligation applies. Certain data sets are subject to their own periods already during the term: support recordings are deleted after 30 days, and technical access and interface logs after 7 to 30 days.

The Controller may request the export of their data in machine-readable format at any time.

§7 Audit Rights

The Controller has the right to verify compliance with this DPA through appropriate measures, including inspections.

The Processor shall provide the Controller with all necessary information to demonstrate compliance upon request.

§8 Contact

For questions regarding data processing, please contact:

Stellar Tourism Innovations GmbH
Torstrasse 105-107
10119 Berlin
E-Mail: hello@support.myxentra.com