# Data Processing Addendum

How Innexo processes personal information on behalf of customers. This Data Processing Addendum ("DPA") describes how we handle personal information on behalf of customers using the platform. This DPA is incorporated into our Terms of Service or any other agreement between us and the customer.

Canonical URL: https://innexo.com/data-processing-addendum

## Roles

These roles follow the controller and processor model used by the GDPR and similar laws: the Customer decides why and how guest records are used, and we act only on its instructions.

- Customer (Controller): The hotel, lodging provider, or property manager using Innexo. As the Data Controller, the Customer determines the purposes and means of processing guest and operational personal information.
- Innexo (Processor): We act as the Data Processor, handling personal information solely on the Customer's instructions to provide the PMS services.

## Processing Scope

We process personal information solely to provide the PMS services. Processing may include:

- Storage of guest information
- Reservation management
- Reporting and analytics
- Operational processing (housekeeping, work orders, staff management)
- Financial reconciliation and accounting (where enabled)

## Security Measures

We maintain technical and organizational security measures including:

- Encryption in transit using TLS 1.2 or higher
- Encryption of sensitive records at rest using AES-256 or equivalent
- Role-based access controls (RBAC) and least privilege access
- Multi-factor authentication for administrative access
- Continuous monitoring and logging
- Backup protection and disaster recovery procedures

## Subprocessors

Innexo may engage subprocessors to assist in providing the services. All subprocessors must maintain appropriate security standards and are bound by data protection obligations no less protective than this DPA. Subprocessors may include:

- Cloud hosting and infrastructure providers
- Database and storage providers
- Support and monitoring platforms
- Email delivery services
- Customers may request a list of current subprocessors by contacting security@innexo.com.

## International Transfers

Personal information may be processed in the United States and other secure locations. We rely on appropriate transfer mechanisms where required by applicable data protection law (e.g., Standard Contractual Clauses for transfers from the EEA or UK).

## Data Subject Requests

Innexo will assist Customers in responding to requests from individuals (such as access, deletion, or correction requests) to the extent technically feasible and required by applicable law.

Requests from individuals directed to Innexo will be forwarded to the relevant Customer without undue delay.

## Breach Notification

In the event of a personal data breach affecting Customer records, we will notify the Customer without undue delay after becoming aware of the breach, providing enough detail to allow it to meet its notification obligations under applicable law.

## Deletion and Return

Upon termination of the services, Innexo will, at the Customer's choice, delete or return all personal information processed on its behalf, and delete existing copies, unless applicable law requires storage.

## Contact

For DPA inquiries, subprocessor lists, or data subject request assistance, email security@innexo.com.

## Related pages

- Our [Privacy Policy](https://innexo.com/privacy) explains the controller and processor roles in more detail, including guest records entered by hotels.
- The encryption, access control, and monitoring measures listed here are described further on the [Security page](https://innexo.com/security).
- This DPA is incorporated into the [Terms of Service](https://innexo.com/terms-of-service) that govern use of the platform.
- Learn more [about Innexo](https://innexo.com/about) and the hotels the platform serves as a processor.