Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (DPA) applies when DT Software Limited, business registration number 62231627, Unit 1022A Beverly Commercial Centre, 87–105 Chatham Road South, Tsim Sha Tsui, Kowloon, Hong Kong (Vortex PMS) processes personal data for a hotel, property manager or other customer (the Controller) through Vortex PMS.

The Controller determines the purposes and means of processing. Vortex PMS processes guest, booking, payment, check-in and communication data only to provide, secure and support the service and on the Controller's documented instructions.

2. Security and confidentiality

Vortex PMS applies appropriate technical and organisational measures, including access controls, tenant isolation, encryption in transit and at rest, audit logging, backups, incident monitoring and least-privilege staff access. Persons authorised to process personal data are bound by confidentiality obligations.

3. Subprocessors and transfers

Vortex PMS may use infrastructure, payment, channel-management, email and monitoring providers that are necessary to operate the service. A current processor list and relevant transfer safeguards are available from hello@vortexpms.com on request. Production application data is hosted in Helsinki, Finland. Vortex PMS remains responsible for subprocessors and requires equivalent data-protection obligations.

4. Assistance and incidents

Vortex PMS will reasonably assist with data-subject requests, security assessments, deletion or export requests, and cooperation with the supervisory authority. Vortex PMS will notify the Controller without undue delay after confirming a personal-data breach affecting the Controller's data and will provide available details and updates.

5. Retention and deletion

The Controller sets retention periods where the product provides that control. On termination, Vortex PMS will return or delete personal data on the Controller's instruction, unless retention is required by applicable law. Backup copies expire through the normal backup lifecycle.

6. Contact

Questions, processor-list requests and signed-DPA requests can be sent to hello@vortexpms.com.