This Data Processing Agreement ("DPA") is part of the Business Service Agreement between AIroomier and the business that uses the service ("Customer"). It applies whenever AIroomier processes personal data on the Customer's behalf, in particular the data of the Customer's guests. It meets the requirements of Article 28 of the EU General Data Protection Regulation (GDPR) and of Turkish Law No. 6698 (KVKK). By opening an account and accepting the Business Service Agreement, the Customer also accepts this DPA. A separate signature is not required.
Parties and roles#
- Controller: the Customer. It decides why guest data is processed and is responsible toward its guests.
- Processor: Gürer Ilgar, trading as AIroomier, Liman Mah. 18. Sok. No: 23, 07070 Antalya, Türkiye, support@airoomier.com (full details in the Legal notice).
- Where AIroomier processes data for its own purposes (for example the Customer's account, billing and the marketing website), AIroomier is the controller and the Privacy Policy applies instead of this DPA.
Subject, nature and purpose#
AIroomier provides the Mira AI front-desk assistant and the management panel. To do this it receives guest messages, generates replies with large language models, shows availability and prices, records booking and service requests, sends notification emails and stores the conversation history in the panel. With the Staff Interpreter (Pro), AIroomier also converts conversations between the Customer's staff and guests from speech to text, translates them and suggests replies. AIroomier processes the data only to provide this service.
The DPA runs for as long as the Business Service Agreement is in force, and afterwards until the data has been deleted or returned.
Types of data and data subjects#
Data subjects: the Customer's guests and prospective guests who use the chat or send a request; the Customer's staff who use the panel.
Types of data: chat messages and AI replies; name, email address and phone number; stay dates, number of guests, room or pitch preferences and other booking or request details; language and time of the conversation; technical data such as IP address and browser information; when the Staff Interpreter is used, the spoken conversation, its transcript and translation; panel users' names, email addresses and roles.
Special categories of data (for example health data) are not needed for the service. The Customer tells its guests not to share them in the chat (the chat window shows this notice). If a guest still shares such data, AIroomier treats it in the same way as all other chat data.
Customer's instructions#
- AIroomier processes the data only on the Customer's documented instructions. The Business Service Agreement, this DPA and the settings the Customer chooses in the panel are those instructions.
- AIroomier informs the Customer without delay if it believes an instruction breaks data protection law.
- If AIroomier is required by law to process data in another way, it informs the Customer first, unless the law forbids this.
- The Customer is responsible for having a legal basis for the processing and for informing its guests, for example in its own privacy notice.
Confidentiality#
Everyone at AIroomier who can access the Customer's data is bound to confidentiality and may process the data only on the Customer's instructions.
Technical and organisational measures#
AIroomier applies the following measures (Annex II of the Standard Contractual Clauses):
- Hosting in the EU: the application, the database and uploaded files are on a server operated by Contabo GmbH in a data centre in Lauterbourg, France.
- Encryption in transit: all connections to the panel, the chat window and the API use HTTPS (TLS).
- Access control: every business is a separate tenant and cannot see the data of other businesses. Panel roles (owner, admin, manager, agent) limit what each user can see; staff with the agent role see only guest requests.
- Passwords are stored only as an irreversible hash. Administrative access to the servers is limited to authorised AIroomier personnel.
- AI providers and training: the language-model providers for Mira are set to zero data retention, so they do not store prompts or replies, and providers that train on request data are excluded. For the Staff Interpreter, Deepgram (speech-to-text) is opted out of model training and keeps audio only as long as needed to process it, and Anthropic (translation) does not use the data for training and deletes it within 30 days at the latest; Google Cloud Text-to-Speech (reading translations aloud) receives only text, never audio. AIroomier stores no voice recordings.
- Data minimisation and retention: chat records are kept for up to 12 months. After an account is closed, its data is deleted within 30 days, and from backups within 90 days at the latest.
- Availability: regular backups and monitoring of the service.
AIroomier may update these measures as technology develops, provided the level of protection does not fall.
Sub-processors#
- The Customer gives general authorisation for AIroomier to use sub-processors. The current list, with each provider's purpose, location and transfer basis, is on the Sub-processors page.
- AIroomier announces a new or replaced sub-processor at least 30 days in advance by email to the account owner and on the Sub-processors page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service.
- AIroomier imposes on each sub-processor data protection obligations that are at least as protective as this DPA and remains liable for its sub-processors.
International data transfers#
- AIroomier is established in Türkiye. The European Commission has not adopted an adequacy decision for Türkiye. Where the Customer is subject to the GDPR, personal data is therefore transferred to AIroomier under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor). The clauses are incorporated into this DPA by reference, with the Customer as data exporter and AIroomier as data importer.
- The following options apply: Clause 7 (docking clause) applies; Clause 9 option 2 (general authorisation, 30 days' notice); the optional wording in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the one of the EU member state where the Customer is established, or where its EU representative is established; Clauses 17 and 18: the laws and courts of Ireland.
- Annex I of the clauses is completed by this DPA: the parties are listed under "Parties and roles", the processing is described under "Subject, nature and purpose" and "Types of data and data subjects", and the transfer is continuous for the term of the agreement. Annex II is the section "Technical and organisational measures". Annex III is the Sub-processors page.
- For transfers subject to Swiss law, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the competent authority is the FDPIC. For transfers from the United Kingdom, the UK Addendum to the EU Standard Contractual Clauses applies.
- Some sub-processors process data outside the EU, mainly in the USA. AIroomier uses those providers only with appropriate safeguards under Article 46 GDPR (standard contractual clauses in the provider's data processing terms, and the EU–US Data Privacy Framework where the provider is certified). Where the transfer is subject to KVKK, AIroomier uses the standard contracts required by Article 9 of KVKK.
- If the Standard Contractual Clauses conflict with this DPA, the clauses prevail.
Assistance to the Customer#
- AIroomier helps the Customer, as far as reasonably possible, to answer guests' requests to exercise their rights (access, correction, deletion, restriction, objection and data portability). Most of this is possible directly in the panel. If a guest writes to AIroomier, AIroomier forwards the request to the Customer and does not answer it alone.
- AIroomier also helps with security, breach notifications, data protection impact assessments and consultations with the supervisory authority (Articles 32 to 36 GDPR), taking into account the information available to it.
Personal data breaches#
AIroomier informs the Customer without undue delay and at the latest within 48 hours after becoming aware of a personal data breach that affects the Customer's data. The notice describes, as far as known, what happened, which data and roughly how many people are affected, the likely consequences and the measures taken. AIroomier adds information as it becomes available and takes reasonable steps to contain the breach.
Audits and information#
AIroomier makes available the information needed to show compliance with this DPA, mainly this document, the Sub-processors page and written answers to reasonable questions. If this is not enough, the Customer may carry out an audit itself or through an independent auditor bound to confidentiality, with at least 30 days' notice, during business hours and not more than once a year, unless a supervisory authority requires otherwise or there has been a breach. Each party bears its own costs.
Deletion and return of data#
When the agreement ends, the Customer can export its data in the panel. AIroomier then deletes the Customer's personal data within 30 days, and from backups within 90 days at the latest, unless the law requires it to keep the data for longer. On request, AIroomier confirms the deletion in writing.
Liability and order of precedence#
The liability provisions of the Business Service Agreement apply, except where the GDPR or the Standard Contractual Clauses do not allow a limitation. If this DPA conflicts with the Business Service Agreement, this DPA prevails on data protection matters. AIroomier may update this DPA; it announces material changes in advance by email, and the changes may not lower the level of protection.
Version: 31 October 2026. For questions about this DPA write to support@airoomier.com.