Data-Processing Agreement

This Data-Processing Agreement ("DPA") is entered into between the Subscriber (the "Controller"), a hotel property operating in Thailand, and ThaiHotelMinder Co., Ltd. (the "Processor"). It forms an integral part of the Terms of Service and governs the Processor's processing of Personal Data on behalf of the Controller for the purposes of providing the ThaiHotelMinder advisory workspace and modules.

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the PDPA. In this DPA: "Personal Data" means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller in connection with the Services; "Sub-Processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller; "Data Subject" means the individual to whom Personal Data relates (typically a guest of the Controller's hotel); "PDPA" means the Personal Data Protection Act B.E. 2562 of Thailand.

2. Subject-matter and duration

The Processor processes Personal Data solely for the purposes of providing the Services described in the Terms of Service, for the duration of the Subscriber's active subscription plus the retention periods set out in section 8 below. The nature and purpose of processing includes: reading reservation, guest-profile and rate-plan records from the Controller's HotelMinder workspace; generating advisory reports; drafting bilingual review responses; monitoring rate parity across Thai OTAs; and producing PDPA consent-capture audit trails.

3. Categories of Data Subjects and Personal Data

• Data Subjects: guests of the Controller's hotel property; workspace users designated by the Controller; individuals mentioned in guest reviews.
• Personal Data: name, contact details, arrival/departure dates, room type, booking channel, cancellation reason, guest preferences, review content, loyalty programme identifier, passport or Thai national ID number where the Controller elects to enable the PDPA Guest Consent module.

4. Instructions of the Controller

The Processor processes Personal Data only on the documented instructions of the Controller, including with regard to transfers of Personal Data outside Thailand. The Controller's instructions are set out in this DPA, in the Terms of Service, and in the configuration of the workspace itself (module activations, retention preferences, cross-border transfer approvals). If the Processor believes an instruction violates the PDPA or any other Thai law, it will inform the Controller without undue delay.

5. Confidentiality of authorised personnel

The Processor ensures that every person authorised to process Personal Data on its behalf has committed themselves to confidentiality in writing, is bound by a statutory duty of confidence, and receives appropriate PDPA training at least annually.

6. Security measures

The Processor implements technical and organisational measures appropriate to the risk, including: AES-256 encryption at rest; TLS 1.3 encryption in transit; ISO 27001-aligned access controls; role-based access with the principle of least privilege; centralised audit logging retained for 5 years; annual penetration testing by an independent Bangkok cybersecurity firm; incident-response process tested quarterly; PDPA breach notification within 72 hours; segregation of Personal Data by Controller. Detailed measures are described in the Security Whitepaper, which is incorporated into this DPA by reference.

7. Sub-Processors

The Controller grants the Processor general authorisation to engage the Sub-Processors listed in Annex A. The Processor will notify the Controller of any intended addition or replacement of Sub-Processors at least 30 days in advance, giving the Controller the opportunity to object on reasonable grounds. If the Controller objects, the parties will discuss in good faith a workable alternative; if none can be found, the Controller may terminate the affected module without penalty.

Annex A — Approved Sub-Processors (as at 15 January 2026):

• AIS Cloud (Bangkok data centre) — primary storage — Thailand.
• True IDC (Chiang Mai data centre) — off-site backup — Thailand.
• Postmark (Thailand endpoint) — transactional email — Thailand.
• Stripe Payments Thailand — payment processing — Thailand.
• FlowAccount — Thai accounting software — Thailand.
• Sentry (self-hosted in Bangkok DC) — error monitoring — Thailand.

8. Retention and deletion

The Processor retains Personal Data for the duration of the active subscription plus (a) 24 months for advisory reports (extendable to 60 months at the Controller's request); (b) 90 days for raw ingested data past the last delivery; (c) 30 days for security-related audit logs after the retention period specified in the module configuration. Upon termination of the subscription, the Processor deletes or returns all Personal Data within 60 days, subject only to any Thai statutory retention obligations that override this DPA.

9. Audit rights

The Controller may, upon 30 days' written notice and no more than once per calendar year, audit the Processor's compliance with this DPA. Audits are conducted at the Processor's Bangkok office during business hours and must not unreasonably interfere with the Processor's operations. Where the Processor holds a valid ISO 27001 or SOC 2 Type II certification (currently ISO 27001), the Controller agrees to accept the corresponding audit report in lieu of an on-site audit.

10. Data-subject requests

Where the Processor receives a request from a Data Subject relating to Personal Data processed on behalf of the Controller, the Processor will forward the request to the Controller within 5 working days and, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures to respond to the request. The Controller remains solely responsible for responding to the Data Subject.

11. Breach notification

The Processor notifies the Controller without undue delay, and in any event within 24 hours, of becoming aware of a Personal Data breach. The notification includes: the nature of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed to address the breach and to mitigate its adverse effects. The Processor assists the Controller in complying with its own 72-hour PDPA notification obligation to the PDPC.

12. Cross-border transfers

The Processor stores Personal Data of Thai-origin in Thailand-resident infrastructure. Transfers outside Thailand are made only under the mechanisms permitted by the PDPA and with the Controller's prior written approval (which may be expressed in the workspace's cross-border-transfer preferences).

13. Liability

The parties' liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA excludes liability that cannot be excluded under the PDPA or other Thai law.

14. Governing law and jurisdiction

This DPA is governed by the laws of the Kingdom of Thailand and any dispute is subject to the exclusive jurisdiction of the courts of Bangkok, in line with the Terms of Service.

15. Effective date and versioning

This DPA is versioned. The current version, its effective date, and its predecessor versions are enumerated on the workspace Settings → Legal screen. Where a new version of this DPA is issued, the Controller is notified at least 30 days in advance in the workspace. Continued use of the Services after that date constitutes acceptance of the new version.

16. Special processing on the Controller's documented instructions

Where the Controller instructs ThaiHotelMinder to perform any processing outside the scope of the standard advisory-module operations described on each module's product page, that instruction must be issued in writing (email is acceptable) and recorded in a "special-instruction ledger" maintained inside the workspace. Standard rate cards apply unless a separate scope-of-work is agreed.

17. Return or deletion at termination

On termination of the subscription, ThaiHotelMinder returns to the Controller a full export of the Personal Data processed on the Controller's behalf, in a structured, commonly-used, machine-readable format (JSON + CSV), within 30 days of termination. After 60 days from termination, all Personal Data is deleted from active systems; backups are purged on the next scheduled backup rotation, within 90 days.

18. Contact

For all matters relating to this DPA, please contact our Data-Protection Officer at dpo@thaihotelminder.org. A counter-signed PDF version of this DPA is available on request via the workspace Settings → Legal screen.