Personal data processing agreement (Annex 1 to the host terms)

Article 1 — Parties, subject matter and framework

1.1. This agreement (the "Agreement") is entered into between:

• [TO BE COMPLETED: registered company name], a [TO BE COMPLETED: legal form] with a share capital of [TO BE COMPLETED: share capital], registered with the trade and companies register under number [TO BE COMPLETED: company registration number], whose registered office is located at [TO BE COMPLETED: registered office address], hereinafter the "Processor" or "YStay";
• and the Host holding the YStay Account, hereinafter the "Controller".

1.2. The Agreement constitutes Annex 1 to the general terms of use of the YStay service (the "Host Terms") and forms an integral part of them. It is accepted by the Account Holder, who binds the Controller.

1.3. The purpose of the Agreement is to define the conditions under which YStay processes personal data on behalf of and on the instructions of the Controller, in accordance with Article 28.3 of Regulation (EU) 2016/679 (the "GDPR").

1.4. Scope. The Agreement covers only the processing for which YStay acts as a processor, described in Annex A: Guests' stay data (bookings, access, check-in and check-out, StayProof evidence, messages), long-term rental application files, and the part of the audit logs that traces operations carried out on behalf of the Controller. The processing for which YStay acts as a controller — accounts of Hosts and of their Team Members, invoicing and subscription, support requests, security audit logs, Guests' accounts, prospecting — falls under its privacy policy and not under this Agreement.

1.5. In the event of a conflict between the Agreement and the Host Terms on the processing of personal data, the Agreement prevails.

Article 2 — Definitions

The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them by Article 4 of the GDPR. The terms defined in Article 1.2 of the Host Terms (Platform, Host, Guest, Booking, StayProof, Distribution Channel, Stay Data, Team Member, Payment Provider) retain their meaning in this Agreement.

Article 3 — Term

3.1. The Agreement takes effect on the date the Host Terms are accepted and remains in force for the entire duration of the contractual relationship.

3.2. It survives the termination of the Host Terms as regards the confidentiality obligations and the return or deletion operations provided for in Article 11.

Article 4 — Nature, purposes and extent of the processing

4.1. General purpose. YStay processes the data for the sole purpose of providing the Controller with the service described in Article 4 of the Host Terms: management of Listings, Bookings, access, stays, condition report evidence, incidents, messages with Guests, rental application files, and the obligations arising from them.

4.2. Nature of the operations. Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, alignment, restriction, erasure or destruction, together with the automated analysis described in Article 4.4.

4.3. Detailed description by processing operation: see Annex A.

4.4. Processing assisted by artificial intelligence. Certain features of the service call upon an artificial intelligence model provided by a sub-processor (Annex B), described feature by feature in Annex C: data transmitted, provider, retention period at the provider, possibility of deactivation. This processing is explainable, bounded, capable of being overridden by the Controller and audited; it produces no automated decision within the meaning of Article 22 of the GDPR, grounds no sanction and does not take the place of any human assessment. The Controller remains the sole decision-maker and each feature is run at its initiative or at that of a Team Member; the settings allowing an individual feature to be deactivated from the Account are made available on [À COMPLÉTER : date de mise à disposition des réglages de désactivation par fonction].

4.5. Prohibition. YStay refrains from using the data processed on behalf of the Controller for its own purposes, in particular for prospecting, resale or model training. YStay obtains from each artificial intelligence model provider a contractual undertaking not to train its models on the data transmitted.

4.6. Rental application files: safeguards. For long-term rental application files, the Controller alone determines the documents requested from the applicant, from the exhaustive list laid down pursuant to Article 22-2 of Law No. 89-462 of 6 July 1989, as well as the applicable retention period, within the limits of Article 11.3. The automated extraction of fields is a technical means serving the Controller's review; it produces no score, no ranking of applicants and no selection recommendation.

Article 5 — Categories of data subjects and of data

5.1. Data subjects: Guests and occupants of a stay, including those who have created no account; correspondents of a Guest designated by them; applicants for a long-term rental and, where applicable, their guarantors; field operatives instructed by the Controller.

5.2. Categories of data:

• Identity and contact details: surname, first name, email address, telephone number, language, billing address of the Guest as attached to the Booking.
• Stay data: dates, number of adult, child and infant occupants, arrival notes, amount and price breakdown, status, channel of origin, public booking token, certificate of insurance and its status where the Controller requests it.
• Payment data: references of the transactions at the Payment Provider, status of a security deposit. Card details are never collected or stored by YStay: they are entered directly with the Payment Provider.
• Access data: codes or access rights associated with a stay, time stamps of issue, transmission and revocation.
• Check-in and check-out data: information collected at the arrival and departure steps.
• StayProof evidence: inspection answers, photographs, digitised handwritten signature of the Guest, time stamps, grounds for validation or rejection, result of the discrepancy analysis, cryptographic hash of the file.
• Messages: messages between the Controller and the Guest, attachments.
• Rental application files (long-term rentals): identity, contact details, employment situation, employer, income, supporting documents, text extracted and fields extracted from those documents, status and reference with the public file verification service.
• Audit logs (sub-processed part): identifier of the actor, action, subject, context, time stamp.

5.3. Special categories. The service is not intended to process data falling under Article 9 of the GDPR, and the Controller refrains from requesting any. The Controller acknowledges that a supporting document filed by a data subject may incidentally contain such data, that it is for the Controller to assess its lawfulness and, where applicable, to delete it without delay.

Article 6 — Documented instructions of the Controller

6.1. YStay processes the data only on the documented instructions of the Controller. The following constitute such instructions: the Host Terms and this Agreement; the configuration of the Account and of the features carried out by the Controller or its Team Members, including the use of the features assisted by artificial intelligence and the choice of the modifiable retention periods; the normal use of the Platform's features; and any additional written instruction sent to privacy@ystay.app and accepted by YStay.

6.2. YStay informs the Controller immediately if an instruction appears to it to constitute an infringement of the GDPR or of another provision of Union or Member State law relating to data protection, and may suspend the performance of the instruction concerned until it is confirmed or corrected.

6.3. If YStay is required to carry out a transfer or a disclosure under Union or Member State law, it informs the Controller before the processing, unless it is legally prohibited from doing so on important grounds of public interest.

6.4. The Controller warrants that it has a legal basis for the processing entrusted, that it has informed the data subjects and, where required, obtained their consent. YStay makes available to it a standard information notice in the booking journey (Article 9.4 of the Host Terms).

Article 7 — Confidentiality and commitment of personnel

7.1. YStay ensures that the persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.2. Access to the data is limited to the members of staff who need it in order to perform the service. YStay's staff access the Controller's Account, including by acting in the interface in its place, only at the request of the Controller or of a Team Member, in order to handle a report or for the security of the Platform, in read-only mode by default, with logging of the operator, of the reason and of the time stamp, visible to the Controller in its audit log. The messages between the Controller and its Guests are private correspondence: YStay takes cognisance of them only in the same cases and within the same limits (Article 3.6 of the Host Terms). Any consultation by YStay's staff of a message or support thread is logged.

7.3. YStay raises its staff's awareness of the applicable requirements as regards data protection and the use of artificial intelligence systems (Article 4 of Regulation (EU) 2024/1689).

Article 8 — Security of processing (Article 32)

YStay implements the technical and organisational measures described below, assessed having regard to the state of the art, the costs, the nature of the processing and the risks. This description reflects the state of the service at the date of the Agreement; it may change, without the overall level of security being reduced.

8.1. Segregation by account. All business data is attached to a host Account, and every query is scoped to that Account; authorisation rules are applied on each access.

8.2. Encryption. The exchanges between the Platform's surfaces and the servers are encrypted in transit. The database backups are encrypted (AES-256). Encryption at rest of the database volumes and of the object storage of the documents is being rolled out; YStay undertakes to bring it into service on [À COMPLÉTER : date d'entrée en service du chiffrement des volumes]. Until that date, this data is protected by the segregation of Article 8.1, the infrastructure access restrictions of Article 8.10 and the serving of documents through signed addresses under Article 8.3.

8.3. Private documents and media. Evidential documents and media are stored in a private area, served by means of time-limited signed addresses, never through a public address. The source, the automated extraction, the derivatives and the review items are kept separately.

8.4. Authentication. Password authentication, with two-factor authentication available and required for certain sensitive operations. Revocation of sessions and of tokens.

8.5. Traceability and integrity of evidence. The sensitive transitions (booking, lock access, check-in and check-out, incidents, signature, documents, consultation of a support thread by staff) are logged with the actor, the action, the subject and the time stamp. The logs are kept for thirty-six (36) months. The computation, on the closing of a StayProof condition report, of a cryptographic hash of the evidence file recorded in the audit log comes into service on [À COMPLÉTER : date de mise en service en production].

8.6. Minimisation in the logs. The audit logs and the application logs carry no document content and no directly identifying data; certain sensitive values are replaced there by a non-reversible cryptographic hash.

8.7. Secrets in the queue. Deferred jobs that carry an access code are encrypted in the queue.

8.8. Backups and continuity. Regular backups of the database allowing a point-in-time restoration, with periodic restoration tests. An erasure register is kept so that a restoration does not reintroduce data already erased; it is exported before any restoration operation.

8.9. Attachments. The type of a file that is uploaded is determined by its binary signature and not by its extension; files are served as downloads and never displayed inline from the origin of the programming interface; their number and their size are capped. No antivirus scanning is carried out on the files uploaded; this limitation is brought to the Controller's attention, and it is for the Controller not to open a file of unknown origin without precautions.

8.10. Development and operations. Separate environments, code reviews, automated tests of the critical path, restrictions on access to the infrastructure, and removal of directly identifying data in the copies of data intended for non-production environments.

8.11. Incidents. Internal procedures for detecting, characterising and handling security incidents, and switches allowing an automated erasure operation to be suspended.

Article 9 — Sub-processors

9.1. The Controller authorises YStay to use the sub-processors listed in Annex B, under the general authorisation provided for in Article 28.2 of the GDPR.

9.2. YStay informs the Controller, by email and by an update of Annex B published on its site, of any addition or replacement of a sub-processor, at least thirty (30) days before that sub-processor processes any data. The Controller may, within fifteen (15) days of that information, raise an objection on reasoned grounds relating to data protection. YStay then proposes a solution (retention of the previous sub-processor, deactivation of the feature concerned or another measure); failing an acceptable solution within thirty (30) days of the objection, the Controller may terminate the Host Terms without penalty, the sums paid in advance for the subsequent period being refunded to it pro rata.

9.3. YStay imposes on each sub-processor, by contract, data protection obligations no less protective than those of this Agreement, and remains fully liable to the Controller for that sub-processor's performance of its obligations.

9.4. Annex B states, for each sub-processor, its role, the contracting entity, its location and the safeguard framing any transfer outside the European Union.

Article 10 — Assistance to the Controller

10.1 Rights of data subjects

10.1.1. YStay makes available to the Controller the consultation, export, rectification and deletion features necessary for it to respond itself to requests to exercise rights (Articles 15 to 22 of the GDPR).

10.1.2. If a data subject contacts YStay directly about processing falling under this Agreement, YStay refrains from responding on the merits, directs the person to the Controller and informs the latter without undue delay.

10.1.3. Where the Platform's features are not sufficient, YStay provides the Controller with reasonable assistance, taking into account the nature of the processing and the information available to it. Assistance manifestly exceeding the normal use of the service may be charged at the rate stated on the Pricing page, after a quotation accepted by the Controller.

10.2 Personal data breaches

10.2.1. YStay notifies the Controller of any data breach affecting the processing under this Agreement, without undue delay and at the latest forty-eight (48) hours after becoming aware of it, by email to the address of the Account Holder.

10.2.2. The notification describes, to the extent of the information available: the nature of the breach, the categories and approximate number of data subjects and of records concerned, the likely consequences, the measures taken or proposed, and a point of contact. The missing information is communicated as it becomes available.

10.2.3. The notification to the supervisory authority (Article 33.1) and, where applicable, the communication to the data subjects (Article 34) are incumbent on the Controller. YStay provides it with the necessary assistance and information. YStay does not notify the supervisory authority on behalf of the Controller, save on the latter's express written instruction.

10.2.4. YStay documents any breach, its effects and the corrective measures taken.

10.3 Impact assessments and prior consultation

YStay provides the Controller, on request and to the extent of the information available to it, with reasonable assistance for carrying out a data protection impact assessment (Article 35) and for any prior consultation of the supervisory authority (Article 36).

Article 11 — Retention periods during the contract, and end of the processing

11.1. Default periods during the relationship. For the duration of the contract, YStay applies to the data processed on behalf of the Controller the periods set out below, which constitute default instructions of the Controller. Where the "modifiable" column so indicates, the Controller may set another period from its Account, within the limit stated; it assumes responsibility for justifying it.

11.2. Accounting exception, stated without ambiguity. The anonymisation of the Bookings after three years does not entail that of the accounting records: the invoice for a stay bears the name of the Guest and is kept for ten years by YStay under its own accounting obligations (Article L123-22 of the French Commercial Code, Code de commerce). Billing data therefore remains, for a person who has paid, the last place where their identity subsists.

11.3. Execution. YStay carries out the deletion or the anonymisation at the end of the periods set out above and records each erasure in the erasure register of Article 8.8. These operations are carried out by scheduled jobs, whose registration in the scheduler is verified by its automated tests, from [À COMPLÉTER : date de mise en service en production] for the periods in the table in Article 11.1; until that date, deletion and anonymisation are carried out at the Controller's request sent to privacy@ystay.app, within one month of the request.

11.4. Suspension on legal grounds. Retention is extended, and any erasure operation suspended, where a complaint, a dispute or a legal obligation so requires, upon notification by the Controller from its Account or at YStay's initiative. The suspension is reasoned and traced.

11.5. End of the contract: return then deletion. At the end of the provision of the service, for whatever reason:

• for thirty (30) days from the end of the contract, the Controller may ask YStay, by email to privacy@ystay.app, for the return of all the data processed on its behalf, in a structured and commonly used format; YStay does so within one month of the request;
• on the expiry of a period of ninety (90) days from the end of the contract, YStay deletes all that data and destroys the existing copies, save for a statutory retention obligation (accounting records of Article 11.2) or a suspension under Article 11.4;
• the backups containing that data expire according to their rotation cycle, without exceeding [À COMPLÉTER : durée de rétention des sauvegardes de la base de données], and are covered by the erasure register in the event of a restoration.

At the written request of the Controller before the end of the 90 days, YStay confirms the deletion in writing.

Article 12 — Making information available and audits

12.1. YStay makes available to the Controller the information necessary to demonstrate compliance with the obligations of Article 28 of the GDPR: this Agreement, the up-to-date Annex B, the description of the security measures and, on request, its answers to a reasonable security questionnaire.

12.2. The Controller may have an audit carried out, by itself or by an independent third party bound by an obligation of confidentiality and not a competitor of YStay, at most once in any twelve-month period, except following a data breach or at the request of a supervisory authority. The audit is notified with thirty (30) days' notice, takes place first on the documents, then where applicable on site during business hours, without disrupting operations and while respecting the confidentiality of the data of YStay's other customers. The costs of the audit are borne by the Controller; the time spent by YStay beyond two business days may be charged at the rate stated on the Pricing page.

12.3. YStay may satisfy an audit request by providing relevant and recent audit reports or certifications where it has them.

Article 13 — Transfers outside the European Union

13.1. The data is hosted in the European Union: the database and the programming interface are hosted with netcup GmbH, in a data centre located in Vienna (Austria); the Cloudflare R2 object storage buckets are created in a jurisdiction declared as the European Union.

13.2. Certain sub-processors listed in Annex B are established outside the European Union or may process data there. For each of them, Annex B states the appropriate safeguard within the meaning of Chapter V of the GDPR on which the transfer is based: an adequacy decision (including certification under the EU–United States Data Privacy Framework, "DPF"), or standard contractual clauses adopted by the European Commission, supplemented where applicable by a transfer impact assessment. YStay carries out no transfer that is devoid of a safeguard.

13.3. Should a safeguard be invalidated or cease to apply (in particular in the event of the invalidation of the adequacy decision relating to the DPF), YStay implements without undue delay the substitute safeguard provided for in the contract of the sub-processor concerned (standard contractual clauses), or suspends the transfer, and informs the Controller.

Article 14 — Liability

14.1. Each party bears the consequences of its own failures to comply with the obligations that the GDPR places upon it, in accordance with Article 82 thereof. Each party indemnifies the other against third-party claims and administrative fines caused by its own failure.

14.2. As between the parties, YStay's liability under this Agreement is subject to the cap of Article 8.6 of the Host Terms, save for wilful misconduct or gross negligence. That cap in no way limits the liability that each party incurs directly towards the data subjects or the supervisory authorities.

14.3. Each party informs the other, without undue delay, of any action, claim or proceeding of a supervisory authority relating to the processing under this Agreement, and cooperates in good faith.

Article 15 — Miscellaneous provisions

15.1. Amendment. The Agreement may be amended in accordance with Article 14 of the Host Terms (thirty days' notice, versioned and time-stamped acceptance), in particular in order to take account of a regulatory development or of a decision of a supervisory authority. Updates to Annex B follow the procedure of Article 9.2; those to Annex C are notified to the Controller.

15.2. Contact. Any request relating to this Agreement is to be sent to privacy@ystay.app. YStay has not appointed a data protection officer, such an appointment not being required at this stage; it will be reassessed in the event of regular and systematic monitoring of data subjects on a large scale.

15.3. Governing law and jurisdiction: those of the general terms of use (Article 15).

15.4. Language. The Agreement is drafted in French and may be translated for the Controller's convenience. The French version prevails.

Annex A — Description of the processing entrusted to YStay

The "usual legal basis" column states the basis usually relied on for this type of processing; the choice of the basis and the documentation accompanying it are a matter for the Controller.

Annex B — Sub-processors

Status verified as at 15 September 2026. Only the providers that process the Controller's data on behalf of YStay appear here. The third parties that process this data as independent controllers, that are the Controller's own providers, or that are involved only in the processing for which YStay is itself the controller, are listed at the end of the annex for information. The "Transfer safeguard" column states the safeguard relied on; "to be confirmed on signature" means that the corresponding contractual document must be filed before the Agreement is signed.

Third-party recipients that are not sub-processors of YStay (for information):

Providers declared in the configuration of the service but not activated, which process no data: Moonshot AI (lock closed; its reintroduction would presuppose the full qualification of the transfer to Singapore and the prior information of Article 9.2), Sentry, AWS SES, Postmark and Slack. Geocoding is self-hosted on YStay's European infrastructure.

Annex C — Features assisted by artificial intelligence

Each feature is run at the initiative of the Controller or of a Team Member; the settings allowing it to be deactivated individually from the Account are made available on [À COMPLÉTER : date de mise à disposition des réglages de désactivation par fonction]. No data transmitted is used to train models. The retention periods at the provider are those of its contract (Anthropic: 30 days at most in the production systems, unless the zero-retention option applies). None of these features produces a decision within the meaning of Article 22 of the GDPR.