Data processing terms

What we process, and why

• Subject: running the hotel's property management, sales, store and accounts in Xenia.
• People: the hotel's guests and staff.
• Data: names, phone numbers, email addresses, ID details and images, stays, bills, payments, and records of what staff did.
• Length: for as long as the hotel uses Xenia, and then as set out below.

Our promises as processor

• We process the data only on the hotel's documented instructions, which are its use of Xenia and these terms, unless the law requires otherwise.
• Everyone at Xenia who can reach the data is bound to keep it confidential.
• We keep it secure as described on our security page: separation between hotels, encryption of stored files, sign-in security and an audit trail.
• We use only the subprocessors listed on our subprocessors page, under terms that give the same protection, and we will tell the hotel before we add or replace one.
• We help the hotel to answer requests from the people the data is about, and to meet its own duties on security, breaches and impact assessments.

Breaches

If we become aware of a breach that exposes the hotel's personal data, we tell the hotel without delay, with what we know, so that the hotel can meet its own duty to inform the Nigeria Data Protection Commission, which the law sets at 72 hours.

When the hotel leaves

The hotel can export its data at any time. After the hotel ends its use of Xenia, we delete its personal data after a reasonable period for export, except where the law requires us to keep it. Financial records are kept for seven years from the booking's check-out.

Checking our work

The hotel may ask us for the information needed to show we meet these terms, and we will cooperate with reasonable checks. [Audit terms and any international transfer terms to be settled with the company's lawyer.]