Data Processing Agreement

    Version 1.0, effective 30 October 2026

    1. Parties and scope

    This Data Processing Agreement ("DPA") forms part of the MimmoBook Terms of Service between MimmoBook ("Processor") and the customer ("Controller"). It applies whenever MimmoBook processes personal data on behalf of the Controller in the course of providing the MimmoBook reservation management service ("Service").

    2. Subject matter and duration

    The subject matter is the processing of personal data necessary to operate the Service. The duration of the processing equals the duration of the Controller's subscription, plus the deletion period described in section 9.

    3. Nature and purpose of processing

    MimmoBook processes personal data solely to host, secure, support and improve the Service. The Processor will not use Controller personal data for its own marketing or for any purpose outside of the documented instructions of the Controller.

    4. Categories of data subjects and personal data

    Data subjects include the Controller's staff users and the Controller's end guests who submit reservations. Categories of personal data include contact details (name, email, phone), reservation details, optional dietary notes, and authentication credentials.

    5. Processor obligations (Art. 28)

    • Process personal data only on documented instructions from the Controller.
    • Ensure persons authorised to process the data are bound by confidentiality.
    • Implement appropriate technical and organisational measures (see section 7).
    • Assist the Controller with data subject requests and DPIAs where reasonably required.
    • Make available all information necessary to demonstrate compliance with Art. 28 GDPR.

    6. Subprocessors

    The Controller grants general authorisation for the use of the subprocessors listed at /legal/subprocessors. MimmoBook will give at least 30 days written notice before adding or replacing a subprocessor that handles personal data, during which the Controller may object on reasonable data protection grounds and, if the parties cannot agree, terminate the affected part of the Service.

    7. Security measures

    MimmoBook implements industry-standard measures including encryption in transit (TLS 1.2 or higher) and at rest, role-based access control with row-level security, multi-factor authentication for administrators, audit logging, automated backups, vulnerability scanning, and least-privilege production access. A summary is available on request.

    8. International transfers

    Where personal data is transferred outside the European Economic Area, MimmoBook relies on the European Commission Standard Contractual Clauses (Decision 2021/914) and applies supplementary measures where necessary.

    9. Return and deletion

    Within 30 days after termination of the Service, MimmoBook will, at the Controller's choice, delete or return all personal data and delete existing copies, except where retention is required by law. Backups are overwritten on a 30 day rolling schedule.

    10. Personal data breach notification

    MimmoBook will notify the Controller without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting Controller data. The notice will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address it.

    11. Audits

    The Controller may, no more than once per year and on 30 days written notice, audit MimmoBook's compliance with this DPA. MimmoBook may satisfy this obligation by providing a recent independent third-party audit report.

    12. Governing law

    This DPA is governed by the laws of Finland, without regard to its conflict of laws rules. Disputes are subject to the exclusive jurisdiction of the courts of Helsinki.

    13. Signing

    By using the MimmoBook Service, the Controller accepts this DPA. If the Controller requires a counter-signed copy, email our privacy contact and we will return one within 5 business days. The address is hidden from automated crawlers and revealed on click; please include the legal entity name and business ID in your request.