Data Processing Agreement

Last updated: 28 October 2026 · Version 1.0

1. Parties and scope

This Data Processing Agreement (the "DPA") is entered into between:

• Teleport Dynamix, S.L., NIF B21782743, Plaza Sant Felip Neri núm. 2, Pta. 5, 46021 València, Spain ("CortoCasa", "we", the Processor); and
• the customer that has accepted the CortoCasa Terms of Service and on whose behalf a workspace is created in the Service (the "Customer", "you", the Controller).

This DPA forms part of the Terms of Service. It is accepted on the Customer's behalf by the administrator who creates the workspace, as a separate step when the workspace is created; for workspaces created before this DPA was published, by an administrator when the Service asks for it. No separate signature is required. If you need a countersigned copy for your records, write to privacy@cortocasa.com.

It applies wherever we process personal data on your behalf in providing the CortoCasa service (the "Service").

Order of precedence. Section 21.1 of the Terms of Service sets out the order of precedence for our whole document set. In summary as it affects this DPA: the Standard Contractual Clauses in Annex IV prevail over this DPA, and this DPA prevails over the Terms of Service and the Privacy Policy on the processing of personal data.

2. Definitions

"Personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in Regulation (EU) 2016/679 (the "GDPR").

"Applicable Data Protection Law" means the GDPR, Spanish Organic Law 3/2018 (LOPDGDD), Directive 2002/58/EC as implemented nationally, and any other data protection law applicable to a party.

"Customer Personal Data" means personal data that we process on your behalf under the Terms of Service, as described in Annex I.

3. Roles of the parties

You are the controller of Customer Personal Data and we are your processor. Where you are yourself a processor acting for another controller, you warrant that you have authority to instruct us as a sub-processor on that controller's behalf, and references to your obligations as controller apply to you as if you were one.

We are an independent controller for the account, billing and website data described in sections 1, 2.1 and 2.2 of our Privacy Policy. This DPA does not apply to that data.

Your responsibilities. You are responsible for the lawfulness of the data you enter, for having a valid legal basis, for providing data subjects with the information Articles 13 and 14 GDPR require, and for the accuracy and relevance of what you upload. You are responsible in particular for limiting the identity-document data you collect to what your legal obligations actually require — see section 4.3.

4. Processing instructions

4.1 Documented instructions

We process Customer Personal Data only on your documented instructions, including as regards international transfers, unless required to do otherwise by EU or Member State law — in which case we will inform you of that requirement before processing, unless the law prohibits it on important grounds of public interest.

Your instructions are: (a) this DPA, (b) the Terms of Service, (c) your configuration of and use of the Service through its interfaces and documented features — including connecting a property to an online booking platform, which instructs us to exchange availability, prices and bookings with that platform through our channel connectivity provider — and (d) any further written instruction you give us and we accept.

Those instructions include producing aggregated statistics from use of the Service under section 7.1 of the Terms of Service. We carry that out as your processor; the anonymous figures it produces are outside this DPA because they are no longer personal data.

4.2 Unlawful instructions

We will inform you without delay if, in our opinion, an instruction infringes Applicable Data Protection Law. We may suspend performance of the affected instruction until it is withdrawn, amended or confirmed, without that suspension being a breach of the Terms of Service.

4.3 Identity and travel documents — specific terms

You may use the Service to record the traveller data you are required to keep, including under Real Decreto 933/2021 in Spain. The following apply to that data:

• Data fields, not images. The Service records the required data fields without an image of the document, and does not need an image for any of its functions.
• Images are optional and off by default. Uploading document images is a feature that is switched off for every workspace until one of your administrators switches it on. Switching it on is your documented instruction to process document images; you confirm that you have a legal basis for any image you choose to upload and retain, that you have considered whether retaining it is necessary, and that you are aware the Spanish supervisory authority regards keeping copies of identity documents as excessive where recording the required data would suffice.
• Images are deleted automatically. Each image is deleted 30 days after the check-out date of the booking it belongs to, or earlier if you delete it or erase the guest. Images are never placed on a link that can be opened without signing in to the Service.
• We will not use document data for any purpose other than providing the Service, will not send it to any AI provider, and will not perform biometric or facial-recognition processing on it.
• You must not enter full payment card numbers, card verification values, or special categories of personal data under Article 9 GDPR into the Service, unless in the last case you have told us in advance and we have agreed in writing.

4.4 Statutory retention obligations

Where a record forms part of a statutory register you are required to keep — such as the traveller register under Real Decreto 933/2021, which in Spain must be kept for three years from the end of the stay — retaining it for the full period is your responsibility as controller, and takes precedence over a data subject's erasure request under Article 17(3)(b) GDPR. You are responsible for not deleting such records before their retention period expires.

To help you meet that obligation and Article 32 LOPDGDD together, the Service's guest erasure tool lets you block the register fields instead of deleting them. Blocked data is withdrawn from the Service's screens, can be opened only by an administrator who records the authority's request it is needed for, and is destroyed automatically on the date you set — by default three years after the end of the stay. Choosing between erasure and blocking, and the date, is your decision as controller.

5. Duration

This DPA takes effect when it is accepted for your workspace under section 1 and continues for as long as we process Customer Personal Data on your behalf. Sections 6, 11, 12, 13, 16 and Annex IV survive its termination for as long as we hold any Customer Personal Data.

6. Confidentiality

We ensure that every person authorised to process Customer Personal Data is bound by an appropriate obligation of confidentiality — contractual or statutory — that survives the end of their engagement. Access is granted on a least-privilege basis and only to personnel who need it to perform their role, and is withdrawn promptly when the need ends.

7. Security

We implement and maintain the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons.

We may update the measures in Annex II from time to time, provided the level of protection is not materially reduced. We will publish material changes at least 30 days in advance.

You are responsible for your own side of security: choosing appropriate roles for your team, keeping credentials secure, removing access for departed staff, and deciding what you keep in the Service and for how long.

8. Sub-processors

8.1 General authorisation

You give us general written authorisation to engage sub-processors. Those engaged are listed in Annex III to this DPA, which is the authoritative list and is published with it.

8.2 Changes and your right to object

Before a new or replacement sub-processor begins processing Customer Personal Data, we will give you at least 30 days' notice by email and in Annex III. The period runs to the start of processing, not to the point at which we contract with or evaluate a provider.

Where a provider has to be replaced urgently — for example on that provider's failure, withdrawal of its service, or a security incident — we will give as much notice as the circumstances allow, tell you why the normal period could not be met, and your right to object under this section is unaffected.

You may object on reasonable, documented data-protection grounds within that period. We will work with you in good faith to find a solution — a configuration change, an alternative provider, or the disabling of the affected feature. If none is workable, you may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for the unused period. Termination on this basis is your sole remedy for an objection.

8.3 Our responsibility

We impose on every sub-processor, by written contract, data protection obligations no less protective than those in this DPA. We remain fully liable to you for the performance of each sub-processor's obligations, as Article 28(4) GDPR requires. Where a sub-processor engages its own sub-processors, the same requirement flows down the chain.

Where a sub-processor holds a copy of Customer Personal Data that the Service cannot delete or anonymise directly — at present, bookings held by our channel connectivity provider, which deletes them itself 180 days after check-out — we pass your erasure instruction on to that sub-processor ourselves when you erase the guest in the Service, follow it up until it is carried out, and confirm the outcome to you on request.

9. Assistance with data subject rights

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures — principally the Service's own search, correction, deletion and guest erasure functions, and the exports we provide on request — in fulfilling your obligation to respond to requests under Chapter III GDPR.

Deletion and guest erasure remain available in the Service, and exports remain available on request, even when a workspace is read-only following cancellation or non-payment, for the period described in section 12 of this DPA, so that ending a subscription does not prevent you from honouring an erasure or access request.

If a data subject contacts us directly about Customer Personal Data, we will not respond substantively. We will forward the request to you within 3 working days and tell the data subject we have done so. Where you need help beyond the Service's own functions, we will provide reasonable assistance; we may charge for assistance that is disproportionate in scope, at our then-current rates, after telling you in advance. Exports under section 12 are always free of charge.

10. Assistance with impact assessments and prior consultation

Taking into account the nature of processing and the information available to us, we provide reasonable assistance with your obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation with a supervisory authority.

On request we provide the information about the Service that you need for an impact assessment: the description of the processing in Annex I, the measures in Annex II, and the sub-processor and transfer information in Annex III. Whether an impact assessment under Article 35 GDPR is required for your use of the Service, and what it must contain, is for you to determine as controller.

11. Personal data breaches

We notify you of a personal data breach affecting Customer Personal Data without undue delay and in any event within 72 hours of becoming aware of it.

The notification will describe, so far as known at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information. We will not delay the first notification in order to complete our investigation, and we will provide updates as more becomes known.

We assist you in meeting your own obligations under Articles 33 and 34 GDPR, including by providing information you need for a notification to a supervisory authority or to affected individuals. Notifying the supervisory authority and data subjects remains your decision and your responsibility as controller.

Our notification is not an acknowledgement of fault or liability.

12. Deletion and return of data

On termination of the Service, and at your choice, we delete or return all Customer Personal Data, and delete existing copies, unless EU or Member State law requires us to keep it.

In practice this works as follows:

• Export. We provide an export of your data on request at any time during the subscription and throughout the read-only period that follows it, free of charge, in a structured, commonly used, machine-readable format — normally within 5 working days and in any event within 30 days of the request. See section 18 of the Terms of Service.
• Deletion when a subscription ends. When a paid period ends without renewal, the workspace becomes read-only for 90 days and is then deleted with all Customer Personal Data in it. We notify your administrators when it becomes read-only, and again at least 14 days and 3 days before the deletion date.
• Deletion on request. An administrator may ask us to delete the workspace at any point, from the Service or by writing to support@cortocasa.com, and we will do so without undue delay and in any event within one month.
• Erasure of a guest. When you erase a guest in the Service, the data identifying them is deleted at once, or blocked under section 4.4 if you choose. Copies held by a sub-processor are dealt with under section 8.3.
• Backups. Encrypted backups are held on a rolling 7-day window in the same region, so deleted data may persist in backups for up to seven days before ageing out.
• Statutory registers. Where you are required to keep records for a statutory retention period, requesting an export before deletion is your responsibility — see section 4.4.

On request, we will confirm deletion in writing.

13. Audit and information

We make available to you the information necessary to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

In the first instance we satisfy this by providing, on request: this DPA and its annexes; our security documentation; responses to a reasonable security questionnaire; and any third-party audit report or certification we hold.

Where that is genuinely insufficient to demonstrate compliance, you may conduct an on-site or remote audit, subject to: reasonable prior notice of at least 30 days; no more than once in any 12-month period, except following a personal data breach affecting your data or where a supervisory authority requires it; conduct during business hours in a way that does not unreasonably disrupt our operations; an auditor who is not our competitor and who is bound by confidentiality; and scope limited to systems and records relating to the processing of your data — never to another customer's data. You bear the cost of the audit unless it reveals a material breach of this DPA, in which case we bear the reasonable cost of the audit and of remediation.

14. International transfers

Customer Personal Data in the Service is stored in the European Union (AWS eu-west-1, Ireland). Bookings exchanged with connected booking platforms are also held by our channel connectivity provider, a company established in the United Kingdom, on infrastructure in the European Union.

Where providing the Service involves transferring Customer Personal Data outside the EEA, we do so only with an appropriate safeguard under Chapter V GDPR. The current transfers, recipients and safeguards are set out in Annex III, and the Standard Contractual Clauses in Annex IV apply where they are the safeguard relied on.

Before a restricted transfer begins we assess whether the law and practice of the destination country prevent the recipient from meeting its obligations, and we document that assessment. On request we give you a summary of the assessment and of any supplementary measures applied, so far as we may do so without disclosing confidential or security-sensitive information. Where we conclude that a transfer can no longer be adequately protected, we will tell you and, if no additional measures suffice, suspend it.

Where you are established outside the EEA, your own access to Customer Personal Data from your country is itself a restricted transfer. Module Four of the Standard Contractual Clauses in Annex IV applies to that flow.

15. Government and law-enforcement access

If we receive a request from a public authority for Customer Personal Data, we will:

• verify that the request is valid, that the authority has jurisdiction, and that its scope is proportionate, and challenge or seek to narrow it where it is not;
• redirect the authority to you as controller wherever the law permits;
• notify you before disclosing, unless legally prohibited — in which case we will use reasonable efforts to obtain a waiver and will tell you as soon as the prohibition lifts;
• disclose only the minimum data legally required, never in bulk.

We will not disclose Customer Personal Data to an authority of a third country unless the request is based on an international agreement in force, such as a mutual legal assistance treaty, or another lawful basis under Article 48 GDPR. The same principle applies to non-personal data under Article 32 of Regulation (EU) 2023/2854.

16. Liability

The limitations and exclusions of liability in section 12 of the Terms of Service — including the enhanced cap for data protection and confidentiality claims — apply to claims between the parties under this DPA.

Nothing in this DPA or in the Terms of Service limits either party's liability to a data subject under Article 82 GDPR, or a supervisory authority's power to impose an administrative fine. A claim between us under Article 82(5) GDPR for a share of compensation paid to a data subject falls under the enhanced cap in section 12 of the Terms of Service, except where the same loss is recoverable under section 19 of the Terms of Service.

17. General

• Changes. We may update this DPA to reflect changes in law, in the Service or in our sub-processors, on at least 30 days' notice where the change is material, or on as much notice as the circumstances allow where the law requires the change sooner. Where a change materially and adversely affects you and you do not accept it, you may terminate as provided in section 15 of the Terms of Service. Previous versions are archived at cortocasa.com/legal/archive/.
• Governing law and jurisdiction. As set out in section 14 of the Terms of Service: Spanish law and the exclusive jurisdiction of the courts of València. The Standard Contractual Clauses in Annex IV are governed as stated in them and in Annex IV.3.
• Severability. If a provision is invalid or unenforceable, it is modified to the minimum extent necessary or severed, and the rest continues in force.
• Notices. To us: privacy@cortocasa.com. To you: the email address on your account.

Annex I — Description of the processing

This Annex follows the structure of Annex I to the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).

I.A — Parties

Data exporter (Controller): the Customer, as identified in its CortoCasa workspace. Contact: the email address of the workspace's administrators. Activities relevant to the transfer: use of the Service to run short-term rental operations. Role: Controller.

Data importer (Processor): Teleport Dynamix, S.L., NIF B21782743, Plaza Sant Felip Neri núm. 2, Pta. 5, 46021 València, Spain. Contact: privacy@cortocasa.com. Activities relevant to the transfer: provision of the CortoCasa short-term rental operations service. Role: Processor.

I.B — Description of the transfer

Categories of data subjects

• Guests of the Customer's properties, including in some cases accompanying minors
• The Customer's staff and collaborators (managers, cleaners, administrators)
• Technical contacts and service providers recorded against a property (for example maintenance contractors)

Categories of personal data

Sensitive data. The Service is not intended for special categories of personal data under Article 9 GDPR, and the Customer is contractually required not to enter it without prior written agreement (section 4.3).

Identity document data is not a special category of personal data under Article 9 GDPR. The restrictions that apply to it are set out in section 4.3, and the measures applying to it in Annex II.

Frequency of the transfer: continuous, for the duration of the Customer's subscription.

Nature of the processing: collection, recording, organisation, structuring, storage, retrieval, consultation, use, disclosure by transmission to sub-processors and to the booking platforms the Customer connects, restriction (blocking), erasure and destruction — by automated means, for the purpose of operating the Service.

Purpose: provision of short-term rental operations software, comprising bookings and calendar, connections to online booking platforms, key handover tracking, cleaning and maintenance ticketing, cash reconciliation, guest communication and guest kits, reporting, and an AI assistant.

Retention: as configured by the Customer while the workspace is active, subject to the automatic deletion of document images under section 4.3 and of blocked register data under section 4.4; on termination, a read-only period of 90 days followed by deletion, as described in section 12 of this DPA and section 6 of the Privacy Policy.

Sub-processor transfers: subject matter, nature, duration and recipients as set out in Annex III.

I.C — Competent supervisory authority

The Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain — as the authority of the Member State in which the Processor is established.

Where the Customer is established in another Member State, that Customer's own lead supervisory authority is competent in respect of its processing as controller.

Annex II — Technical and organisational measures

These are the measures we apply under Article 32 GDPR. We may update them under section 7, provided the level of protection is not materially reduced.

II.1 Encryption

• All traffic between you and the Service is encrypted in transit over HTTPS.
• HTTP Strict Transport Security is enforced on the application (max-age=31536000; includeSubDomains).
• Data is encrypted at rest in the database and in object storage.
• Identity documents are held in private storage, not on a publicly reachable path. They are shown only to signed-in users with the right role, through links that expire within an hour, and are never included in messages or other links that can be opened without signing in.
• Passwords are stored hashed, never in plaintext or reversibly encrypted. New passwords are checked against known breached passwords using a range query that never sends the password or its full hash.

II.2 Access control

• Each customer's workspace is logically separated from every other customer's, and that separation is enforced at database level.
• Role-based access control operates within each workspace across the roles the customer assigns.
• Blocked traveller-register data is accessible only to the workspace's administrators, only with a recorded reason, and every access is logged.
• Access by our own personnel is least-privilege, limited to named individuals, and revoked promptly on role change or departure.
• Everyone with access is bound by confidentiality obligations that survive the end of their engagement.

II.3 Integrity and change control

• Application and security events are logged and retained for as long as needed to detect and investigate security incidents.
• Deletion cascades through related records and removes the associated files from storage.
• Guest erasures, openings of blocked data and their automatic destruction are recorded in a log that holds no personal data of the guest.
• Changes to production go through version control and code review.
• Security-relevant HTTP response headers are set on the application.
• Bot management and abuse protection operate at the network edge before traffic reaches the application.
• The application is excluded from search indexing.

II.4 Availability and resilience

• Encrypted backups are taken daily and retained on a rolling 7-day window in the same region.
• Backups are held within the EU, in the same region as the primary data.
• The Service runs on managed infrastructure with provider-level redundancy.

II.5 Guest-kit links

Guest kits are opened by the guest from a link, without an account or password, so that a guest does not have to register to receive arrival information.

• The link address includes a randomly generated identifier that is not derived from any booking, guest or property detail.
• Guest-kit pages are excluded from search indexing and set no analytics or advertising storage.
• You decide what a guest kit contains and to whom, and by what channel, its link is sent.

II.6 AI processing

• We do not send identity documents to an AI provider.
• Customer data is not used to train models, and our agreement with the AI provider does not permit it.

II.7 Product analytics

• Analytics and session recording in the application run only for users who consent to them.
• Session recordings mask the whole screen, so no text from the workspace is captured; analytics receive page templates and a pseudonymous user identifier, not record content.

II.8 Governance

• We maintain a record of processing activities under Article 30(2) GDPR.
• We assess each restricted transfer before it begins and keep that assessment under review.
• We operate an incident response procedure supporting the notification commitment in section 11.
• We assess our sub-processors before engaging them and keep their engagement under review.
• We operate written procedures for exports, deletion of workspaces and passing erasure instructions to sub-processors.
• Data protection enquiries reach a named point of contact at privacy@cortocasa.com.

Annex III — Sub-processors

Current as at 28 October 2026. This Annex is the authoritative list. Changes are notified at least 30 days in advance under section 8.2.

Chain of engagement. Not every party here is contracted by us directly. Supabase is provisioned through Lovable Cloud, Cloudflare sits in front of the application as part of that hosting arrangement, and requests to OpenAI are routed through the Lovable AI gateway. Channex uses its own sub-processors for hosting, email delivery, error monitoring and network security, listed in its data processing agreement, which we provide on request. Where a party is engaged by another rather than by us, the obligations reach it through that party's contract, as section 8.3 requires. We remain responsible to you for every party in the chain regardless.

Not a sub-processor. Paddle.com acts as Merchant of Record and is an independent controller of the payment data it collects. It is not our sub-processor and does not process Customer Personal Data on our behalf. See section 4.1 of the Privacy Policy.

Not a sub-processor: booking platforms. Booking.com, Airbnb and the other platforms you connect are your own counterparties, not ours. You instruct us to exchange data with them; what they do with it is governed by your agreement with each of them.

Outside this Annex. Hostinger hosts our marketing website; Resend sends billing notifications to your administrators; Google Analytics, Microsoft Clarity and Google Ads measure use of our website and application with the user's consent. The data involved is our own controller data, not Customer Personal Data, so it falls outside this DPA under section 3. These providers are listed in section 4 of the Privacy Policy.

Not engaged. We do not use the WhatsApp Business API and we do not transmit guest data to Meta. Guest-kit links and messages are shared by opening WhatsApp on the sender's own device.

Annex IV — Standard Contractual Clauses

IV.1 Incorporation

Where a transfer of Customer Personal Data is a restricted transfer under Chapter V GDPR and no adequacy decision applies, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 are incorporated into this DPA by reference and form an integral part of it.

IV.2 Which module applies

IV.3 Selected options and specifications

For every module incorporated:

IV.4 Transfer impact assessments

For each restricted transfer we carry out and document an assessment of whether the law and practice of the destination country prevent the importer from meeting its obligations, and of any supplementary measures required, as Clause 14 of the Standard Contractual Clauses requires. The assessment is kept under review and is revisited whenever we become aware of a relevant change in law or practice, and it is made available to the competent supervisory authority on request. What we provide to you is set out in section 14.

IV.5 Other jurisdictions

The United Kingdom and Switzerland are outside the scope of this version as customer jurisdictions. If we begin offering the Service to customers established there, this Annex will be extended with the UK International Data Transfer Addendum and the Swiss adaptations respectively, on notice under section 17.