Data processing

This page records the current draft data processing terms. It does not replace a data processing agreement agreed by both parties. Where GEN│RAL processes personal data on behalf of a customer, a separate DPA will be agreed before that processing begins.

Article 28 GDPR does not apply to purely aggregated, non-personal hotel KPIs.

Processing covers provision of the GEN│RAL platform, accounts, trials, analysis, support and necessary status communication. It continues for the main contract term and until contractual return or deletion.

Potential data includes business contact details, account and permission data, technical usage and security data and support communication. Data subjects are primarily customer contacts, users and administrators.

Guest, employee and special-category personal data must not be entered in hotel KPIs or free-text fields.

Processing is limited to contract performance, documented instructions and agreed functions. Persons with access are bound to confidentiality. Unlawful instructions will be flagged.

Appropriate measures include access control, roles and permissions, encrypted transmission, protected credentials, backups, recoverability, logging and regular review. See Security & TOMs.

IONOS SE provides business email and support communication. Plus Five Five, Inc. (Resend) sends necessary account, trial and status emails of the separate GEN│RAL application; a website visit alone does not trigger these messages. The public website and GEN│RAL application, including authentication, project-bound data storage and backend functions, are provided through OpenAI Sites and its documented sub-processors.

Provider privacy, transfer and sub-processor resources are linked under Security & TOMs. No particular data residency is promised. Where required, material changes will be notified in advance and customers may object on legitimate data-protection grounds.

Transfers of personal data outside the European Economic Area require the basis under Chapter V GDPR that actually applies to the particular recipient and processing activity. Possible bases, where applicable in the specific case, include adequacy decisions or EU Standard Contractual Clauses and, where necessary, supplementary measures. Merely linking to provider documents does not replace checking the specific conditions or required safeguards. Further information is provided in the privacy notice on hosting and transfers.

GEN│RAL will reasonably assist with access, rectification, erasure, restriction, portability, impact assessments and regulatory notifications. Personal data breaches will be reported to the customer without undue delay after discovery, with the information available.

After termination, personal customer data will be returned or deleted at the customer's choice unless legal retention duties apply. Technically required backup copies are removed under the providers' documented deletion cycles or blocked until then. While access remains active, personal data and – for authorised organisation roles – operational organisation data can be exported as JSON under Data & Privacy. For further return requests, including after access ends, contact support@epv-group.com.

Information necessary to demonstrate compliance with Article 28 GDPR will be made available to an appropriate extent. Audits will be coordinated with due regard to security, confidentiality and legitimate interests.