DATA PROCESSING AGREEMENT (SUPPLIERS)

DATA PROCESSING AGREEMENT

Purpose

This Data Processing Agreement (“DPA”) forms part of the Supplier Agreement between Luxeromo.com and each Supplier.

Where applicable, Luxeromo.com and the Supplier agree to comply with relevant data protection laws, including the UK GDPR, the EU GDPR (where applicable) and other relevant privacy legislation.

Supplier Responsibilities

Suppliers receiving customer information through Luxeromo.com agree to:

- Process customer data only for legitimate booking and customer service purposes;
- Keep all personal data secure and confidential;
- Implement appropriate technical and organisational security measures;
- Restrict access to authorised personnel only;
- Not sell, rent or misuse customer data;
- Not use customer information for unrelated marketing without a lawful basis and any required consent;
- Notify Luxeromo.com promptly of any personal data breach affecting customer information received through the Platform;
- Assist Luxeromo.com where reasonably necessary in responding to customer privacy requests.

Luxeromo.com Responsibilities

Luxeromo.com will:

- Process personal data lawfully and fairly;
- Take reasonable measures to protect customer information;
- Share only the information reasonably required to facilitate bookings and related services;
- Maintain appropriate administrative, technical and organisational safeguards.

Data Security

Both parties agree to implement reasonable safeguards to protect personal data against:

- Unauthorised access;
- Accidental loss;
- Destruction;
- Alteration;
- Disclosure;
- Misuse.

International Transfers

Where personal data is transferred internationally, each party shall comply with applicable legal requirements relating to cross-border data transfers.

Data Breach Notification

Each party shall notify the other without undue delay after becoming aware of any personal data breach affecting personal information shared through the Platform, where notification is required by law or reasonably necessary to mitigate harm.

Termination

Upon termination of the Supplier Agreement, the Supplier shall securely delete or return personal data where required by applicable law and where retention is no longer necessary for legal or operational purposes.