Data Processing Agreement for Nova Booking

This Data Processing Agreement ("DPA") is between you, the hotel or property using Nova Booking (the "Customer"), and Nova Booking ("we," "us," or "our"). It forms part of our Terms of Service. By creating an account or using our property management system, you agree to this DPA.

1. Roles

You are the controller of guest personal data that you collect through bookings, your website, or your staff.
Nova Booking is the processor. We process that data only to provide the Software (bookings, guest records, payments, and related services) and only on your instructions, including those given through your use of the Software.
This DPA applies especially when you or your guests are in the EU, EEA, or United Kingdom. It also applies as a standard processing agreement for all customers.

2. Data we process

We process personal data you enter or that guests submit through the Software, including:

Guest first name, last name, email, and phone number
Optional guest details such as country, state or province, and comments
Booking, stay, and payment-related records needed to run the reservation
Your hotel account information (name, email, phone, property address) as needed to operate your account

We do not decide why you collect guest data. You are responsible for telling guests how their data is used and for having a lawful basis to collect it (for example, to complete a booking).

3. Our obligations

We will process personal data only to provide the Software, as described in this DPA, our Terms of Service, and our Privacy Policy, or as required by law.
We will keep personal data confidential and limit access to staff and subprocessors who need it to operate the service.
We use reasonable technical and organizational measures to protect personal data, including SSL/TLS encryption in transit and access controls on our systems. No method of storage or transmission is 100% secure.
If we are legally required to process data in a way that goes beyond your instructions, we will tell you unless the law prohibits that notice.

4. Subprocessors

You authorize us to use subprocessors to host and operate the Software. Current subprocessors include:

SmarterASP.net — hosting, databases, and related infrastructure
Stripe — payment processing
Email service providers (for example Gmail) — transactional email
Channex.io — channel manager services, where you use that integration

We will use subprocessors under written terms that require appropriate confidentiality and data protection. If we add a material new subprocessor, we will update this DPA or our Privacy Policy. Continued use of the Software after that update constitutes acceptance. You may object by cancelling your account.

5. Location and international transfers

Personal data, including guest data, is stored on SmarterASP.net cloud infrastructure. Datacenters may be located in the United States. The specific location is determined by SmarterASP.net.
Where that storage is a transfer of EU, EEA, or UK personal data outside those regions, you instruct us to make that transfer so we can provide the Software.
We rely on SmarterASP.net’s GDPR-related terms and safeguards for hosting. Other subprocessors process data under their own privacy terms in the countries where they operate.

6. Guest and customer rights

You are responsible for responding to requests from guests or authorities about personal data (access, correction, deletion, export, or restriction).
The Software lets you view, update, and delete guest records in the ordinary course of use. If you cannot complete a request yourself, contact us at info@novabooking.ca and we will provide reasonable assistance.
If a guest or authority contacts us directly about data you control, we will redirect them to you where we can, unless we are legally required to respond ourselves.

7. Security incidents and deletion

If we become aware of a security incident affecting personal data we process for you, we will notify you without undue delay and give you information we reasonably have so you can meet your own notice duties.
When you cancel your account, we will delete your data in accordance with our data retention practices, except data we must keep by law or that remains on isolated backups until those backups expire.

8. Your responsibilities

You must not use the Software to collect personal data you are not allowed to collect.
You must not sell guest personal data, or share it with any third party, except where the law requires it.
You are responsible for your staff’s use of the Software and for keeping your account credentials secure.

9. Changes

We may update this DPA when we change subprocessors, hosting, or legal requirements. Changes take effect when posted. Continued use of the Software after a change constitutes acceptance. If you do not agree, you may cancel your account.

10. Contact

Questions about this DPA: info@novabooking.ca

Related documents: Terms of Service and Privacy Policy.