Legal

Data Processing Agreement

According to the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR and the Swiss Federal Act on Data Protection (FADP)

Version 2.0 of This Agreement was created on 27 October 2026.

This Data Processing Agreement (this “DPA”), effective as of the DPA Effective Date (defined below), is entered into by and between Apaleo GmbH (“Apaleo”, “we”, or “us”, “Processor”) and the customer that accepts or otherwise agrees or opts-in to this DPA (“Customer”, or “you”), acting as controller or, where it processes Personal Data on behalf of a third-party controller (e.g. a property owner), as processor.

1 Introduction, area of application, definitions

• This DPA stipulates the rights and obligations of the Customer and Apaleo (henceforth referred to as the ‘Parties’’) in the context of processing personal data on behalf of the Customer.

• This contract applies to all activities for which Apaleo’s employees or any subcontractors tasked with processing the Customer’s personal data.

• The terms used in this DPA have the meaning given in the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and, where applicable, in the UK GDPR and the Swiss FADP (together “Applicable Data Protection Law”). References to the GDPR include the corresponding provisions of such laws where they apply.

• “The Service” means the provisioning of property management software and related solutions as described on www.Apaleo.com, including AI-enabled features of that software.

• “Customer Data” means data you submit to, store on, or send to us via the Service.

• “Personal Data” means any personal data within the meaning of Art. 4(1) GDPR that is contained in Customer Data and processed by Apaleo on behalf of the Customer.

• “Subcontractor” means a third party that we use to process Customer Data to provide parts of the Service or related technical support (“sub-processor” within the meaning of Art. 28(2) and (4) GDPR; the terms “Subcontractor” and “Subprocessor” are used synonymously in this DPA and its Appendices). Additional services, such as transportation, maintenance and cleaning, as well as using telecommunication services or user services, do not apply.

• “Data Breach” means a breach of Apaleo’s security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to Personal Data processed on behalf of the Customer (personal data breach within the meaning of Art. 4(12) GDPR).

• “in writing”, means the written form, as prescribed by § 126 BGB (Bürgerliches Gesetzbuch), or in another form under the condition that suitable verification is ensured.

• “Master Contract” means the subscription and the PCI signed with Apaleo.

• “Standard Contractual Clauses” or “SCCs” mean the standard contractual clauses as approved by the European Commission pursuant to its Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.

• “DPA Effective Date” means the date on which the Customer accepts this DPA or, if earlier, the effective date of the Master Contract.

• “Adequacy Decision” means a decision of the European Commission under Art. 45 GDPR (or, for UK Personal Data, UK adequacy regulations; for Swiss Personal Data, a decision of the Swiss Federal Council) that a third country, territory or sector ensures an adequate level of protection.

• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under Section 119A of the UK Data Protection Act 2018 (version B1.0, in force since 21 March 2022), as amended or replaced from time to time.

• “AI Act” means Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, as amended (including by Regulation (EU) 2026/1744); “AI System” has the meaning given in Art. 3(1) AI Act.

2 Scope and duration of the data processing

2.1 Scope

Apaleo is processing Customer data to provide services for property management, as described on www.Apaleo.com.

2.2 Duration

Processing will be done for the duration of the Master Contract and, thereafter, for the Export Period and backup-deletion period set out in Article 11.

2.3 Types of Personal Data and categories of data subjects

The types of Personal Data, the categories of data subjects and the nature and purposes of the processing are described in Appendix 1.

3 Nature and purpose of collecting, processing or using the data

Apaleo stores and processes Personal Data to provide the Service and related technical support, as described in Appendix 1.

4 Obligations of Apaleo

• Apaleo will only process Personal Data as contractually agreed or as instructed by you (see Article 10), unless we are legally obliged to carry out a specific type of data processing. In this case, we will inform you thereof prior to processing the data, unless informing you is illegal. We will not use Personal Data provided for processing for any another purpose, specifically our own.

• We are aware of the applicable legal provisions on data protection, and will observe the principles of correct data processing.

• We will maintain strict confidentiality when processing the Personal Data.

• Any individuals who could have access to the data processed on behalf of the Customer are obliged in writing to maintain confidentiality, unless they are already legally required to do so via another written agreement.

• Apaleo ensures that employees processing Personal Data have been made aware of the relevant data protection provisions as well as this DPA before starting to process the data. We regularly train and sensitize employees processing Personal Data, and ensure they are adequately instructed and supervised on an ongoing basis in terms of fulfilling data protection requirements.

• In connection with the commissioned data processing, Apaleo will support the Customer when designing and updating the list of processing activities and implementing the data protection assessment. All data and documentation required will be provided and immediately made available to the Customer upon request.

• If the Customer is subject to the inspection of supervisory authorities or any other bodies, or should affected persons exercise any rights against you, we will support you to the extent required, if the Personal Data being processed on behalf of the Customer is affected.

• We will only provide information to third parties with your prior consent, and will immediately forward you inquiries sent directly to us.

• Apaleo has appointed a data protection officer, who you can contact directly under privacy@apaleo.com. Up to date contact information will be available on www.apaleo.com.

• Any data processing may only be carried out in the EU/EEA or, if the Subcontractor or Apaleo provides the agreed service outside the EU/EEA, such transfer shall take place only in accordance with Article 12 and Chapter V GDPR.

• Apaleo will make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and will maintain a record of processing activities carried out on behalf of the Customer in accordance with Art. 30(2) GDPR.

• Taking into account the nature of the processing, Apaleo will assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR and will forward such requests to the Customer without undue delay.

5 Technical and organisational measures

• Appendix 2

  describes the technical and organisational measures Apaleo takes to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, in accordance with Art. 32 GDPR and taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks for data subjects.

• We may update our technical and organisational measures from time to time, but only in a way that will not result in the degradation of the overall security of the Service and Customer Data. We will inform you when that happens. The current version of Appendix 2 will be made available to the Customer; material changes will be notified in advance where reasonably possible.

• Should the security measures implemented by Apaleo not, or no longer, be sufficient, we will inform you immediately.

• Apaleo ensures that Personal Data processed on behalf of the Customer is kept strictly separate from any other data.

• Apaleo operates an information security management system, including written information security policies approved by management and reviewed at least annually, and regularly tests, assesses and evaluates the effectiveness of its technical and organisational measures (Art. 32(1)(d) GDPR).

6 Stipulations on correcting, deleting and blocking data

• Apaleo will only correct, delete or block data processed on behalf of the Customer, if this is in accordance to the Main Contract, or when instructed by the Customer. If an individual person contacts us directly with such an instruction, we will forward the request to you.

• Apaleo shall comply with the respective instructions provided by the Customer at all times and also after the termination of this DPA.

7 Subcontracting

• Subcontractors may only be appointed on the basis of the Customer’s general written authorisation pursuant to Art. 28(2) GDPR, as set out in this Article 7.

• Apaleo will only appoint a Subcontractor if the Subcontractor is subject to a contractual minimum of data protection obligations, which are comparable with those stipulated in this DPA and which meet the requirements of Art. 28(4) GDPR. The Customer can inspect the relevant contracts between Apaleo and the Subcontractor upon request (commercial terms may be redacted).

• The Customer’s rights must also be able to be effectively exercised against the Subcontractor. The Customer must have the right to carry out inspections, or have them carried out by third parties to the extent specified here. Apaleo may satisfy this requirement by exercising its own audit rights vis-à-vis the Subcontractor and sharing the results with the Customer, or by providing independent audit reports or certifications of the Subcontractor.

• Subcontractors who are not located and do not operate exclusively within the EU or EEA, can only be appointed, if they meet data protection standards comparable to this DPA and the transfer requirements of Article 12. We will provide you with information about the specific data protection guarantees provided by the Subcontractor and how evidence thereof can be obtained.

• Apaleo will only transfer data processed on behalf of the Customer to the Subcontractor, after all conditions for appointing a Subcontractor have been met.

• The Customer grants general written authorisation for the appointment of the Subcontractors described in

  Appendix 3

  . A list of our current Subprocessors is available at https://apaleo.com/subcontractors or such other website as Apaleo may designate (“Subprocessor Page”). We may update the Subprocessor Page to reflect any changes in Subprocessors. We will provide thirty (30) days’ prior notice to you (by e-mail to the contact designated by the Customer for data protection or account matters, in addition to publication on the Subprocessor Page); additionally, the Customer may subscribe to notifications via the Subprocessor Page. During this period you will have the opportunity to object in writing, on reasonable data protection grounds, to the intended addition or replacement of a Subprocessor.

• If the Customer objects, the Parties will discuss the objection in good faith. If no resolution is reached within thirty (30) days, Apaleo may refrain from using the Subprocessor for the Customer, or the Customer may terminate the affected part of the Service with effect from the date on which the Subprocessor would be engaged, without penalty and with a pro rata refund of prepaid fees for the terminated period. Without objection within the notice period, the authorisation for the change is deemed given.

• Where urgent security, availability or legal reasons require the immediate replacement of a Subprocessor, Apaleo may do so with notice as soon as reasonably practicable; the objection right in the preceding paragraph then applies with effect for the future.

• Apaleo will not process Customer Data through a new Subprocessor – including in connection with alpha, beta or pilot features – before the notice period has lapsed or an objection has been resolved, except in urgent cases under the preceding paragraph. Feature-specific addenda for alpha, beta or pilot features supplement, and do not reduce, this DPA.

• Apaleo imposes on each Subcontractor, by written contract, data protection obligations equivalent to those in this DPA and remains fully liable to the Customer for the Subcontractor’s performance of its obligations (Art. 28(4) GDPR).

• Subcontractors that provide AI models or AI-enabled services (“AI Subcontractors”) are identified as such in Appendix 3. Apaleo will contractually ensure that AI Subcontractors (i) process Customer Data only to provide the relevant service to Apaleo, (ii) do not use Customer Data to train, retrain or improve their models, and (iii) retain Customer Data only for as long as necessary to provide the service (including limited retention for abuse and safety monitoring where applicable).

• Tools used solely for internal purposes (e.g. issue tracking, source-code hosting, CRM) are listed in Appendix 3 for transparency; Apaleo does not intend to transfer Customer Data to them. Apaleo’s internal rules prohibit entering Customer Data into any tool that has not been approved by Legal & InfoSec following an assessment, including execution of a data processing agreement where required.

8 Rights and obligations of the Customer

• The Customer is solely responsible for assessing the admissibility of the processing requested and for the rights of affected parties.

• The Customer shall document all orders, partial orders or instructions. In urgent cases, instructions may be given verbally. These instructions will be immediately confirmed and documented by Apaleo.

• The Customer shall immediately notify Apaleo if it finds any errors or irregularities when reviewing the results of the processing.

• The Customer is entitled to inspect compliance with the data protection provisions and contractual agreements with Apaleo to an appropriate extent, either personally or by third-parties. This includes obtaining information and accessing the stored data and the data processing programs as well as other on-site inspections. Apaleo must make it possible for all individuals entrusted with carrying out audits to access and inspect as required. Apaleo is required to provide the necessary information, demonstrate the procedures and provide the necessary documentation for carrying out inspections.

• Inspections at Apaleo’s premises must be carried out without any avoidable disturbances to the operation of our business. Unless otherwise indicated for urgent reasons, which must be documented by the Customer, inspections shall be carried out after appropriate notice and during Apaleo’s business hours, and not more frequently than every 12 months, unless an inspection is required by a supervisory authority or follows a Data Breach.

• Apaleo may satisfy an audit request in the first instance by providing current independent audit reports, certifications or attestations covering the Service (where available) and its security documentation. On-site inspections are limited to what is necessary, are subject to confidentiality obligations, must not give access to data of other customers or to information whose disclosure would endanger Apaleo’s security, and are at the Customer’s cost unless the inspection reveals a material breach by Apaleo.

9 Notification obligations

• Apaleo will immediately notify you of any Data Breaches, latest 24 hours from the moment we realise a Data Breach has occurred. This notification must contain at least the following information:

  • A description of the type of the Data Breach including, if possible, the categories and approximate number of affected persons as well as the respective categories and approximate number of the personal data sets;

  • The name and contact details of the data protection officer or another point of contact for further information;

  • A description of the probable consequences of the personal data protection infringement;

  • A description of the measures taken or proposed by Apaleo to rectify the personal data protection infringement and, where applicable, measures to mitigate their possible adverse effects.

• Where it is not possible to provide all information at the same time, the information may be provided in phases without undue further delay (Art. 33(4) GDPR). The Customer remains responsible for any notification to the supervisory authority and data subjects, unless otherwise agreed.

• Apaleo will immediately inform you of any inspections or measures carried out by supervisory authorities or other third parties if they relate to the commissioned data processing.

• Apaleo will support you fulfilling your communication obligations towards affected persons of a Data Breach by providing all relevant information, in accordance with Art. 34 GDPR.

• Apaleo supports the customer in complying with the obligations in Articles 32 to 36 of the GDPR for the security of personal data, reporting obligations in the event of data breaches, data protection impact assessments and prior consultations. These include obligation to:

  • ensure an appropriate level of protection through technical and organizational measures that take into account the circumstances and purposes of the processing as well as the forecast probability and severity of a possible violation of the law due to security gaps and enable an immediate detection of relevant violation events;

  • immediately report personal data breaches to the customer;

  • Support the Customer within the scope of his obligation to provide information to the data subject and to provide him with all relevant information immediately in this context;

  • assist the Customers in their data protection impact assessment (including, where AI Features are used, as set out in Article 13);

  • support of the customer in the context of previous consultations with the supervisory authority.

10 Instructions

• The Customer reserves the right of full authority to issue instructions concerning data processing on their behalf.

• Apaleo will immediately inform the Customer if an instruction issued by the Customer violates, in its opinion, legal requirements. Apaleo is entitled to forego carrying out the relevant instructions until they have been confirmed or changed by the party responsible on behalf of the Customer.

• Apaleo is to document the instructions issued and their implementation.

• The Customer’s documented instructions at the DPA Effective Date are the Master Contract, this DPA, and the Customer’s configuration and use of the Service (including settings, user roles and permissions, and the enabling or disabling of AI Features). Further instructions that go beyond the scope of the Service require agreement between the Parties and may be subject to reasonable charges.

11 Ending the commissioned processing

• When terminating the DPA or at any time upon your request, Apaleo will either destroy the data processed as part of the commission or submit the data to you at your discretion. All copies of the data still present will also be destroyed. The data will be destroyed in such a way that restoring or recreating the remaining information will no longer be possible, even with considerable effort.

• During the term and for thirty (30) days after termination of the Master Contract (the “Export Period”), Apaleo will make Customer Data available for export in a structured, commonly used and machine-readable format, consistent with Chapter VI of Regulation (EU) 2023/2854 (Data Act) to the extent applicable. After the Export Period Apaleo will delete Customer Data, unless Union or Member State law requires storage; copies in backups are deleted in accordance with the regular backup cycle, at the latest within ninety (90) days.

• Apaleo is obligated to immediately ensure the return or deletion of data from Subcontractors.

• Apaleo must provide proof of the data being properly destroyed and immediately submit this proof to the Customer.

• Apaleo will keep any documentation that serves the purpose of providing proof of proper data processing according to the respective retention periods, including the statutory period after the DPA has expired. We may submit the respective documentation to you once our contractual obligations have ended.

12 International data transfers

• Apaleo’s own infrastructure is located in the EU/EEA. Any transfer of Personal Data by Apaleo or a Subcontractor to a country outside the EEA (“Third Country”) (“Restricted Transfer”) will take place only on the Customer’s documented instructions – which the Customer hereby gives for the Subcontractors listed in Appendix 3 – and only if the requirements of Chapter V GDPR are met.

• Adequacy Decisions.

  Where the recipient is located in a Third Country covered by an Adequacy Decision, the transfer is based on that decision. As at the date of this DPA this includes, in particular, the United Kingdom (Commission decision of 19 December 2025, valid until 27 December 2031), Switzerland, Canada (commercial organisations subject to PIPEDA) and Brazil (decision in force since 28 January 2026), and – for the United States – recipients certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023).

• Standard Contractual Clauses.

  Where no Adequacy Decision applies, or where an Adequacy Decision is invalidated, suspended or repealed (including by a court), Apaleo will ensure appropriate safeguards pursuant to Art. 46 GDPR, in particular by concluding the SCCs (Module Three, processor to processor) with the relevant Subcontractor. As regards the United States and other Third Countries, Apaleo has concluded such SCCs with its Subcontractors irrespective of any certification under the EU-U.S. Data Privacy Framework, so that the SCCs apply as fallback.

• SCCs between the Parties.

  To the extent a Restricted Transfer to the Customer (or to a controller on whose behalf the Customer acts) located in a Third Country without Adequacy Decision requires the SCCs, Module Four (processor to controller) is incorporated by reference and completed as follows: Clause 7 (docking) does not apply; Clause 11 optional wording does not apply; Clause 13: the competent supervisory authority is the Bavarian Data Protection Authority (BayLDA); Clause 17: German law; Clause 18(b): the courts of Munich, Germany; Annex I is completed by Appendix 1, Annex II by Appendix 2 and, for Module Three relationships, Annex III by Appendix 3. In the event of a conflict, the SCCs prevail over this DPA.

• United Kingdom.

  Where Personal Data subject to the UK GDPR is the subject of a Restricted Transfer that is not covered by UK adequacy regulations (including the UK Extension to the EU-U.S. Data Privacy Framework (“UK-U.S. data bridge”)), the UK Addendum is incorporated by reference; the information required by its Tables 1 to 4 is that set out in this DPA and its Appendices.

• Switzerland.

  Where Personal Data subject to the Swiss FADP is the subject of a Restricted Transfer not covered by a Swiss adequacy determination (including the Swiss-U.S. Data Privacy Framework), the SCCs apply with the adaptations required by the Swiss Federal Data Protection and Information Commissioner (FDPIC): references to the GDPR are to be understood as references to the FADP, the FDPIC is the competent supervisory authority insofar as the transfer is governed by the FADP, and data subjects in Switzerland may bring claims in the courts of Switzerland.

• Transfer impact assessment.

  Where Apaleo relies on the SCCs or the UK Addendum, it carries out and documents a transfer impact assessment (Clause 14 SCCs; EDPB Recommendations 01/2020), implements supplementary measures where necessary (e.g. encryption in transit and at rest, pseudonymisation, access restrictions and contractual commitments to challenge unlawful government access requests) and makes a summary available to the Customer upon request.

• Government access.

  Apaleo will notify the Customer of any legally binding request by a public authority for disclosure of Personal Data, unless prohibited by law, and will require its Subcontractors to challenge requests they consider unlawful.

• Changes in law.

  Where a change in Applicable Data Protection Law, a decision of the European Commission, a supervisory authority or a court (including the invalidation of an Adequacy Decision) or the adoption of new or amended SCCs requires an amendment of this DPA or of the transfer mechanisms used, the Parties will cooperate in good faith to implement it without undue delay. Apaleo may implement replacement transfer mechanisms (e.g. updated SCCs) by notice to the Customer.

13 Artificial intelligence

• This Article applies where the Service includes AI Systems, including AI-assisted or agentic functionality and interfaces that allow AI tools to access the Service (for example via a Model Context Protocol (MCP) server) (“AI Features”). Apaleo identifies AI Features in its product documentation.

• Prompts and context.

  AI Features may transmit prompts and context from the Customer’s account to AI Subcontractors – which may include Personal Data of guests and staff that the relevant user is permitted to access, and any personal data a user types into a free-text prompt – and prompts may be logged with analytics Subcontractors. The scope of data transmitted by each AI Feature (including whether guest data is transmitted and whether access is read-only) is described in the product documentation or the applicable feature addendum. The Customer will instruct its users not to enter more personal data into free-text prompts than is necessary.

• Roles.

  Where AI Features process Personal Data, Apaleo does so as processor on the Customer’s instructions. As between the Parties and to the extent the AI Act applies, Apaleo acts as provider and the Customer as deployer of the AI Features. Each Party complies with the obligations of the AI Act that apply to it, including AI literacy (Art. 4 AI Act) for its own personnel who use or operate AI Features.

• No training.

  Apaleo will not use Customer Data to train, fine-tune or improve AI models (its own or those of third parties), except on the Customer’s written instruction, and ensures the same for AI Subcontractors in accordance with Article 7.

• Access control and human oversight.

  AI Features acting on behalf of a user access Customer Data only within the permissions that the Customer has granted to that user or role. The Customer may enable, restrict or disable AI Features and configure permissions. The Customer remains responsible for appropriate human oversight and for reviewing AI-generated output before relying on it.

• Prohibited and high-risk use.

  Apaleo does not provide AI Features for practices prohibited under Art. 5 AI Act, and the Service is not designed as a high-risk AI system within the meaning of Art. 6 and Annex III AI Act. The Customer will not use AI Features for such purposes (for example emotion recognition in the workplace, biometric categorisation, social scoring, or decisions on employment or creditworthiness) without Apaleo’s prior written agreement.

• Automated decisions and transparency.

  AI Features are not intended to take decisions based solely on automated processing that produce legal or similarly significant effects on data subjects (Art. 22 GDPR). The Customer will not configure or use them in that way without ensuring the safeguards required by Art. 22 GDPR, and informs data subjects as required by Arts. 13 to 15 GDPR and, where applicable, Art. 50 AI Act.

• Assistance.

  Apaleo provides the information reasonably necessary for the Customer’s data protection impact assessment (Art. 35 GDPR) and, where applicable, fundamental rights impact assessment (Art. 27 AI Act) and for the Customer’s deployer obligations under the AI Act.

• Internal AI tools.

  Apaleo personnel may use AI assistants and development tools approved by Apaleo under enterprise terms. Customer Data may be entered into such tools only to the extent necessary for support or operation of the Service and only if the tool is listed in Appendix 3.

14 Jurisdiction, Law, order of precedence

• The place of jurisdiction for any disputes arising from this Agreement shall be Munich, Germany.

• This DPA and all appendixes related hereto shall be governed exclusively by the law of the Federal Republic of Germany.

• By signing of this DPA Apaleo and the Customer agree that all previous DPAs regarding the subject matter of this DPA cease to exist with effect from the DPA Effective Date.

• In the event of a conflict, the SCCs and the UK Addendum prevail over this DPA, and this DPA prevails over the Master Contract and any other agreement with regard to the processing of Personal Data. The liability of the Parties is governed by the Master Contract, without prejudice to the rights of data subjects under Art. 82 GDPR and the SCCs.

• Addenda for alpha, beta or pilot features may add feature-specific commitments but do not reduce the protection afforded by this DPA; in the event of a conflict, the provision that is more protective of data subjects prevails.

Appendix 1 – Details of data processing

Apaleo stores and processes guest data on your behalf.

Data:

• ID/Passport data;

• Name;

• Email address;

• Address and communication data;

• Nationality;

• Gender;

• Date of birth;

• Free text comment (which technically can include personal data);

• Invoice address;

• Booking, stay and folio data (reservation details, services booked, invoices, preferences);

• Payment data (payment-method tokens, last digits, expiry date, payment status; full card data is processed by the payment Subcontractors in PCI-DSS-compliant environments);

• Company and tax details of guests or corporate bookers, where provided;

• Title and telephone number of bookers and guests (e.g. via the hosted booking engine);

• Free-form cart attributes defined by integrators (key/value pairs);

• Technical request data (IP address, browser user-agent) in infrastructure logs;

• AI interaction data (free-text prompts, generated dashboard configurations, AI responses, and prompts and context transmitted to AI Subcontractors);

• User and usage data of the Customer’s users (user ID, name, e-mail address, role, IP address, audit and log data).

Categories of data subjects: guests and prospective guests of the Customer and their companions; booking contacts and corporate clients; the Customer’s employees and other authorised users of the Service.

Special categories of data (Arts. 9 and 10 GDPR): not intended to be processed. ID documents, nationality or free-text fields may incidentally reveal such data. The Customer will not intentionally submit special categories of data and should avoid entering them in free-text fields.

Nature, purpose, frequency and duration: storage, retrieval, display, transmission, structuring, backup, deletion, monitoring, support, payment processing and – at the Customer’s instruction – AI Features, in order to provide the Service; continuous basis for the duration set out in Article 2.2.

Recipients: Apaleo employees working in product development and support can access this data, to provide support and help. This access is read-only, unless you request modifications or deletion of data in written form.

All Subcontractors are listed in Appendix 3.

Appendix 2 – Technical and organizational measures

See the sections General Notes and Data processed on behalf (“Guest data”) in the document Apaleo – Technical and Organizational measures, version 2.0 of 27 October 2026 (as updated from time to time in accordance with Article 5), which forms part of this DPA.

Appendix 3 –Subcontractors

With all the subcontractors located in the U.S. (or in any other Third Country without Adequacy Decision), Apaleo has signed data processing agreements which incorporate the Standard Contractual Clauses. Where a Subcontractor is additionally certified under the EU-U.S. Data Privacy Framework, the transfer may also rely on the Adequacy Decision, with the SCCs serving as fallback. The transfer mechanisms are set out in the table below and in Article 12.

Transfer mechanisms by Subcontractor

Apaleo – technical and organizational measures

Version 2.0 – 27 October 2026

General notes

Awareness

Protecting the personal data we are entrusted with is very important to Apaleo. New functionality as well as changes in the overall architecture are discussed with by the security and privacy officer before they are implemented, to assess security risks and compliance. All members of the Apaleo product and support team received a software security and data privacy awareness training, which is refreshed at least once a year. Training is completed by new joiners as part of onboarding, and completion is tracked and monitored in Apaleo’s compliance automation platform.

Governance and policies

Apaleo has appointed a Data Protection Officer and an Information Security Officer and operates an information security management system. Policies, controls and supporting evidence are maintained and continuously monitored in a compliance automation platform. The policy framework covers: information security; access control; cryptography and key management; data classification, handling, retention and disposal; acceptable use; asset and endpoint management (e.g. device encryption, screen lock, malware protection); secure development and change management; vulnerability and patch management; logging and monitoring; incident response; business continuity and disaster recovery; risk management; vendor and third-party risk management; and personnel security (confidentiality obligations, onboarding and offboarding). Policies are approved by management, acknowledged by all personnel and reviewed at least annually. Tool and AI governance

New SaaS and AI tools are used for work only after assessment by Legal & InfoSec (security, GDPR and contractual review) and, where company, customer or user data is involved, after a data processing agreement is in place. AI tools are used under enterprise or business terms that exclude training on Apaleo data; access is provided via single sign-on. Personnel are instructed not to enter credentials or personal data of customers into AI tools that are not approved for that purpose.

Data of customers and their employees, website visitors, leads and App providers

Controlled Access

Only Apaleo employees working in marketing and sales are allowed to access personal data of customers, website visitors, leads, and App providers. The master copy of all personal data is stored and processed using selected cloud software. Access is restricted via username and password, and multi-factor-authentication through Apaleo’s company-wide workforce identity (single sign-on).

Only short-lived copies (typically hours, maximum 7 days) for fulfilling specific tasks that cannot be done using any of the selected cloud software can exist on electronic devices of members of the Apaleo sales and marketing team. Access to those devices is restricted minimum with user name and password, in some cases via biometrical identification.

Passwords need to adhere to a strict policy, which is regularly adopted to latest security standards.

Auditing

Modification of personal data is:

• logged by Hubspot (on a field level) and Microsoft OneDrive (on a document level)

• Not possible in zendesk, but data can be deleted. Employees have been briefed to not delete data without checking back with the privacy officer.

• Data processed on behalf (“Guest data”)

Controlled Access

Only Apaleo employees working in product development and support in the European Union can access personal data. The master copy of all personal data is stored and processed using a secured production account of Amazon Web Services (AWS). Access to this system is restricted. Access to the protected system components is restricted via individual username and password, and multi-factor-authentication is enforced. The group of people with access to the certain system components is limited to a minimum and by proper configuration of access policies the access rights are also limited to those rights required to perform the job. The group of admins and the access policies are reviewed on a regular basis. Whenever an employee leaves the company all his accounts are deleted immediately.

The use of shared or default user ids is prevented, and default user ids are removed where possible. The passwords for the remaining default user ids are stored in a secure password vault only a limited group of people has access to.

Only short-lived copies (typically minutes, maximum 24 hours) for investigations of the support team can exist on electronic devices of members of the Apaleo support team. Access to those devices is restricted minimum with user name and password, in some cases via biometrical identification.

Passwords need to adhere to a strict policy, which is regularly adopted to latest security standards.

All data is secured on the transport layer (TLS) when transmitting data between different cloud applications or local computers. TLS protocols that are known to have security vulnerabilities will not be used.

Data at rest, that means, stored in the database, is encrypted. Booker and guest data held in transient booking-engine records is additionally encrypted with managed keys (KMS).

Customer-facing security features

The following security features are available in the Service as at the date of this version. Features marked “(rollout)” or “(beta)” are not yet available to all customers and do not constitute a commitment to specific functionality or timelines.

• Authentication: secure token-based login; multi-factor authentication via authenticator app (opt-in); passkeys as passwordless, phishing-resistant login.

• Single sign-on and provisioning: SAML-based single sign-on and SCIM user provisioning, compatible with Microsoft Entra ID, Okta and other identity providers (since June 2026).

• Authorisation: real-time, fine-grained permissions engine with property-scoped roles; custom user roles; fine-grained access control for apps and API clients (rollout).

• Network access: IP allowlisting for login (rollout).

• Data privacy: role-based masking of sensitive guest data (beta).

• Audit logs: activity logs across core areas (reservations, folios, units, user management, accounting).

• AI and agents: AI agents operate within the same permissions engine as human users; dedicated permissions and user roles govern AI/agent tools accessing the Service (MCP server).

Auditing

For the databases and object store, access and modifications are logged, including the user's identifier.

It is not possible to modify data through the used logging cloud services. Only the person designated to be on-call is supposed to access them, but access is not logged by these systems.

In Apaleo, access and modifications are logged, including a user identifier masked as ‘support’ for Apaleo product support members, as to not disclose employee data to customers. The support person on call can be identified via the on-call calendar. In exceptional cases, people who are not on-call will access this data, too. This will be documented in the calendar. If the customer request Apaleo support to modify or delete data processed on his behalf, this request will be documented in written form, including the person performing this task.

Data separation

Data of different customers is separated in the databases. Test and productive data for a customer are separated. It is not possible to mix data for different customers within one request or response to the Apaleo APIs. Central components, mainly the Apaleo identity server, ensure that users of Apaleo can only access data for the customer projects they are members of.

Availability

Data in the database is additionally stored in close to real time on a fail-over replica. In case of an outage of the main database, this replica takes over within minutes.

Data stored in databases or object stores is backed up at least once a day, depending on the specific technology used. Backups are stored in a separate availability zone in the datacenters of Amazon Web Services, ensuring that problems in Apaleo's main zone of operations do not affect the backups. Backups of databases can typically be restored in less than one hour, backups of data in the object store within one day.

The outage of any of the components Apaleo consists of is constantly monitored, and problems will be reported to Apaleo after five minutes latest. For technical problems within the services, monitoring and reporting is done every 15 minutes.

Business continuity and incident response

Apaleo maintains documented business continuity and disaster recovery plans and a documented incident response procedure (detection, classification, containment, notification, post-incident review). Personal data breaches are notified to the Customer in accordance with Article 9 of the DPA. Plans are reviewed and tested at least annually.

Secure development and vulnerability management

Changes to production follow a documented change-management process including peer review, automated testing and dependency and vulnerability scanning in the build pipeline. Vulnerabilities are prioritised by severity and remediated within defined timeframes. Independent penetration tests are carried out at least annually.

Technical and organizational measures of Apaleo’s subprocessors

We evaluate the security measures taken by each subprocessor, especially the ones processing guest data, before entering an agreement with them and review them periodically as part of our vendor risk management process (vendor inventory, risk classification and review of independent audit reports and certifications, such as SOC 2 and PCI DSS, where available). With all the subprocessors located in the U.S. Apaleo has signed data processing agreements which incorporate the Standard Contractual Clauses as approved by the European Commission pursuant to its Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced. Transfers are further governed by Article 12 of the DPA. As the details are changing often, please refer to their documentation and compliance certifications, available online:

The current list of Subprocessors, including purposes and privacy documentation, is set out in Appendix 3 of the DPA, which replaces the table previously included in this document.