Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) applies between the hotel, guesthouse, or agency utilizing ReviewDesk (“Controller”) and Cavora Technologies, Near Patna City Club, Akhilesh Nagar, Kamaldah Path, Road no. 2, Patna, Bihar 800008, India (“Processor”).

1. Scope and Purpose of Processing

The Processor provides guest review reply drafting services for public review listings (Google, Booking.com, Tripadvisor). The categories of data processed include:

• Public guest review text, star ratings, and dates.
• Reviewer public display names published on the review platforms.
• Hotel contact information provided for communication and approval workflows.

Purpose: Data is processed exclusively to generate, edit, and deliver polite response proposals in the guest's language for the Controller's review and approval.

2. Obligations of the Processor

In accordance with GDPR Article 28(3), the Processor covenants and agrees that it shall:

• Documented Instructions: Process personal data solely on documented instructions from the Controller, including with respect to international transfers.
• Confidentiality: Ensure that persons authorized to process personal data have committed themselves to strict confidentiality.
• Security Measures: Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (GDPR Art. 32), including encryption in transit, strict access control, and credential isolation.
• No Passwords: Never request or store user passwords. For Google, delegate manager rights are utilized; for other platforms, text copy workflows are maintained.
• No Sale or Marketing: Never sell, rent, monetize, or use Controller or guest personal data for advertising or marketing.
• Assistance: Assist the Controller in responding to requests by data subjects exercising their rights under Chapter III GDPR.
• Deletion on Request: At the choice of the Controller, delete or return all personal data upon request or termination of services, deleting existing copies within 5 working days unless applicable law requires retention.

3. Authorized Sub-Processors

The Controller grants general authorization for the engagement of the following essential sub-processors:

Sub-Processor	Role	Location
Cloudflare, Inc.	Secure edge hosting and DDoS protection	Global / EU / US
Resend, Inc.	Transactional email notification transmission	US / EU
AI Model Providers (OpenAI / Anthropic)	Secure language translation & draft generation via commercial API (no training on customer data)	US

The Processor imposes data protection obligations no less protective than those set out in this DPA upon each sub-processor.

4. International Data Transfers

Where processing involves the transfer of personal data outside the European Economic Area (EEA), the Processor ensures an adequate level of protection through Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Article 46(2)(c) GDPR.

5. Inquiries & Signature Execution

If your compliance team requires a countersigned PDF copy of this DPA with your hotel's registered business details, please email your property details to alok@cavoratechnologies.com and we will return a countersigned document within 2 business days.