DPA

1. Subject matter and parties

This Data Processing Agreement (hereinafter the “DPA”) is a standard document applicable to all customers of Arhon Concept AG that have subscribed to the Arhon® software. It is entered into between:

This DPA is annexed to the main agreement relating to the Arhon® software and forms an integral part thereof, together with the General Terms and Conditions of Sale and Use (“GTC”) and the SLA. In the event of any conflict, this DPA prevails on all matters relating to the processing of personal data.

2. Definitions

3. Nature, purposes and duration of the processing

3.1 Nature of the processing

In connection with the provision of the Arhon® software, Arhon Concept AG carries out the following operations on behalf of the Customer:

• Hosting and storage of the data on the infrastructure operated by 2le
• Access to the data for technical support and maintenance purposes
• Backup and restoration of the data
• Provision of the application features (PMS, invoicing, reporting, etc.)
• Transfer of data between the software modules and authorised partner services

3.2 Purposes of the processing

3.3 Categories of data processed

Payment card data is neither entered nor stored in the Arhon® software. It is collected and stored by PCI Proxy, a tokenisation solution operated by Datatrans AG (Kreuzbühlstrasse 26, 8008 Zurich, Switzerland — Planet group), in conjunction with the payment service provider with which the Customer contracts directly (Worldline/Saferpay, Nexi/Datatrans or Computop). The Arhon® software handles only aliases (tokens) and transaction references.

3.4 Duration of the processing

Arhon Concept AG processes the data for the term of the main agreement.

Downloading and backing up its data is the Customer’s responsibility. Throughout the term of the agreement, and thereafter during the read-only access maintained for 30 days after its end, the Customer downloads the data itself from the software, in CSV, Excel and PDF formats, free of charge.

Upon expiry or termination of the agreement, the Customer may also request in writing, within three months, a full export of its data performed by Arhon, which is delivered within 30 days of the request in CSV or XML format. Any extraction performed by Arhon at the Customer’s request is a chargeable service, invoiced at the rate then in force, including where it is required by applicable regulations or in connection with an audit or request from the tax authorities, another authority or legal proceedings.

At the end of this three-month period, Arhon securely deletes the data, subject to the retention periods imposed by applicable law. Backup copies are purged at the end of their rotation cycle, no later than 90 days after that date.

The applicable retention periods are those set out in Article 15 of the General Terms and Conditions of Sale and Use and, for guest registration and check-in data, including identity documents where recorded, those provided for by the regulations applicable to the Customer’s establishment: federal, cantonal or municipal in Switzerland, national or local in France and Italy, as specified in the country annex to the general terms and conditions. This DPA does not set any retention period of its own.

Compliance with these periods, their configuration in the software and the corresponding purge are the responsibility of the Customer in its capacity as controller.

4. Obligations of Arhon Concept AG

4.1 Documented instructions

Arhon Concept AG processes personal data only on the documented instructions of the Customer, as expressed in the main agreement, the configuration of the Software and this DPA. Where Arhon is required to carry out processing under a legal obligation, it informs the Customer beforehand, unless the law prohibits this.

If, in the opinion of Arhon Concept AG, an instruction from the Customer infringes applicable data protection law, Arhon informs the Customer immediately and may suspend the execution of that instruction until it is confirmed or amended in writing.

4.2 Confidentiality

Arhon Concept AG ensures that persons authorised to process the data have committed themselves to confidentiality. Access is strictly limited to staff who need it to perform their duties.

4.3 Data security

In accordance with Article 32 GDPR and Article 8 revFADP, Arhon Concept AG implements the following technical and organisational measures, which reflect the state of the art as at the date of this version:

4.4 Sub-processing

The Customer authorises Arhon Concept AG to engage the following sub-processor:

Partners with which the Customer contracts directly, in particular online booking platforms and payment service providers, act on their own behalf or on behalf of the Customer. They are not sub-processors of Arhon Concept AG.

Arhon Concept AG undertakes to impose equivalent data protection obligations on any sub-processor and remains fully liable to the Customer, within the limits set out in Article 13 of the GTC.

In the event that a sub-processor is added or replaced, Arhon informs the Customer at least 30 days in advance. The Customer may object in writing within that period, on reasonable and documented data protection grounds. The parties then seek a solution within a reasonable time; failing agreement, the Customer may terminate the main agreement with effect from the scheduled date of the change, without compensation on either side and without reimbursement of fees already due. If no objection is raised within that period, the change is deemed accepted.

4.5 Assistance to the Customer

Arhon Concept AG assists the Customer in:

• Responding to requests from data subjects exercising their rights
• Notifying data breaches to the supervisory authority within the required time limits
• Carrying out data protection impact assessments (DPIAs) where necessary
• Providing the information needed to demonstrate compliance with GDPR obligations

Requests for assistance must be sent to support@arhon.ch. Arhon responds to and takes charge of them within 2 to 3 business days of the date of the request; full execution of a request takes place within the time limits set out in Article 7 for requests from data subjects and, for other requests, within a reasonable time communicated to the Customer when the request is taken in charge.

4.6 Notification of data breaches

In the event of a personal data breach, Arhon Concept AG informs the Customer without undue delay after becoming aware of it, and in any event within a time frame that allows the Customer to meet its own notification obligations, at the latest within 48 hours. The notification specifies the nature of the breach, the categories and approximate number of data records and persons concerned, the likely consequences and the measures taken or proposed. Where this information cannot be provided at once, it is provided in phases without further undue delay.

5. Obligations of the Customer

As controller, the Customer undertakes to:

• Provide Arhon Concept AG with lawful and documented instructions
• Ensure that the collection of data processed via Arhon® is lawful
• Inform data subjects in accordance with Articles 13 and 14 GDPR
• Handle requests from data subjects exercising their rights
• Notify Arhon without delay of any change to its instructions regarding the processing
• Not use Arhon® to process special categories of data or sensitive personal data without the prior written consent of Arhon Concept AG

5.1 Duty to inform — Article 13(2)(c) GDPR

Pursuant to Article 13(2)(c) GDPR, the Customer, as controller, is required to inform its customers (the data subjects) of the existence of their rights over their personal data at the time the data is collected.

This information must explicitly mention the following rights:

• Right of access to personal data (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure (“right to be forgotten”) (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)

This obligation rests solely with the Customer. It must be fulfilled through a privacy policy accessible to data subjects, typically:

• On the establishment’s website (“Privacy policy” or “Data protection” page)
• In the online booking forms
• At the establishment’s reception (notice or document handed over at check-in)

6. International data transfers

The data is hosted in France by 2le on OVH infrastructure. No transfer to a third country outside the European Union or Switzerland takes place without appropriate safeguards.

Switzerland benefits from an adequacy decision of the European Commission. Transfers between Switzerland and the European Union therefore take place without any additional mechanism.

7. Rights of data subjects

Arhon Concept AG responds to any request for assistance from the Customer within 2 to 3 business days of the date of the request (Article 4.5). The time limits below are the time limits for full execution of the request.

8. Audit and demonstration of compliance

• Arhon Concept AG keeps a record of the processing activities carried out on behalf of the Customer
• The Customer may request a compliance audit by an independent auditor, subject to 30 days’ notice
• The annual audit reports on the 2le infrastructure are provided to the Customer on request
• Arhon undertakes to implement any corrective measure identified during an audit within a reasonable time

Verification is first carried out on the basis of documents, by questionnaire or by providing the certificates and reports available to Arhon. An on-site audit takes place only if these prove insufficient, during business hours, without disrupting operations and while respecting the confidentiality of other customers.

The costs of an audit requested by the Customer are borne by the Customer, unless the audit reveals a proven breach by Arhon Concept AG.

9. Term and end of the DPA

This DPA takes effect on the date of acceptance of the main agreement, the offer or the order form incorporating the GTC, and remains applicable throughout the contractual relationship and, solely for those obligations which must survive its end, until the data has been returned or deleted in accordance with this DPA and Article 15 of the GTC.

Upon termination of the DPA, Arhon Concept AG undertakes to enable the return of the data to the Customer under the conditions and within the time limits set out in Article 3.4 of this DPA and Article 15 of the General Terms and Conditions of Sale and Use, then to securely delete all personal data, and to provide a written certificate of deletion on request.

10. General provisions

• Governing law: this DPA is governed by Swiss law. The GDPR applies to processing falling within its material and territorial scope, in particular pursuant to its Articles 2 and 3, irrespective of the nationality of the data subjects
• Jurisdiction: the competent courts of Lucerne (Canton of Lucerne, Switzerland), in accordance with Article 20 of the GTC, subject to any mandatory places of jurisdiction
• This DPA prevails over any conflicting provision of the main agreement relating to data processing
• Order of precedence: the General Terms and Conditions of Sale and Use form the foundation; this DPA prevails over them for the processing of personal data; the service level agreement (SLA) prevails for availability and service levels; the annex specific to the Customer’s country of establishment prevails solely for the provisions it covers
• Should any provision be held invalid, the remaining provisions remain valid
• Any amendment to this DPA follows the procedure set out in the preamble to the GTC. It is notified to the Customer in writing, by email or within the Software at least 30 days before it takes effect. Adjustments strictly necessary to comply with a law, a regulation, a decision of an authority, or a documented security or certification requirement may take effect immediately. For any other significant amendment unfavourable to the Customer, the Customer may object under the conditions set out in the preamble to the GTC.
• Languages: available in French, German and English — the French version is authoritative

11. Contact — Data protection

For any questions relating to this DPA or to the processing of personal data:

Arhon Concept AG
Kriens, Canton of Lucerne, Switzerland
Email: support@arhon.ch
Telephone: +41 61 222 21 59

12. Acceptance and enforceability

This DPA is a public document applicable to all customers of Arhon Concept AG. It is binding upon signature or acceptance of the main licence agreement for the Arhon® software, without any separate signature being required.

The Customer acknowledges having read this Data Processing Agreement and accepts its provisions by subscribing to the Arhon® software. Any change to the DPA follows the amendment procedure set out in the preamble to the General Terms and Conditions of Sale and Use.