Data Processing Agreement
Data Processing Agreement
Shillinki Hosting Oy (trading as Hosta) — co-hosting services only
1.9.2026
BACKGROUND AND SCOPE
This DPA applies specifically to the co-hosting Services Agreement between the Client and Shillinki Hosting Oy (“Hosta”). Under that Agreement, the Client — the property owner — acts as host toward guests of the property under service, and is responsible for fulfilling the obligations related to accommodation activities. Shillinki Hosting Oy is never itself a party to, or in a direct contractual relationship with, the guest. Accordingly, in respect of the personal data of guests processed in connection with the Services, the Client is the controller and Shillinki Hosting Oy is the processor.
This DPA does not apply to Shillinki Rentals Oy. Where Shillinki Rentals Oy provides long-term rental services directly, it is itself the landlord in the contractual relationship with the tenant, and is accordingly the controller of that tenant’s personal data in its own right — not a processor acting on behalf of a property owner.
This DPA also does not apply to personal data Shillinki Hosting Oy processes about the Client itself (e.g. identity verification, politically-exposed-person screening, billing and contract administration), where Shillinki Hosting Oy acts as an independent controller as described in Hosta’s Privacy Policy.
DEFINITIONS
“GDPR” means Regulation (EU) 2016/679. “Applicable Data Protection Law” means the GDPR and the Finnish Data Protection Act (1050/2018). “Controller”, “Processor”, “Personal Data”, “Data Subject”, “Processing” and “Personal Data Breach” have the meanings given in the GDPR. “Sub-processor” means a processor engaged by Hosta to process Personal Data on the Client’s behalf.
SUBJECT MATTER, DURATION, NATURE AND PURPOSE OF PROCESSING
Subject matter: processing of guest personal data in connection with the accommodation services provided under the Services Agreement.
Duration: for the term of the Services Agreement, and thereafter only as needed to comply with the Deletion and Retention section below.
Nature of processing: collection, storage, verification and communication of guest personal data within Hosta’s systems (including Hostaway, EnsoConnect and Conduit) in the course of booking, check-in, guest communication and related administration.
Purpose: enabling the Client to provide accommodation services to guests.
CATEGORIES OF DATA SUBJECTS AND PERSONAL DATA
Data subjects: guests of the property under service. Categories of personal data: name, contact details (email, phone), booking and reservation details, guest messages and communications, and, where required for check-in or statutory registration purposes, copies of identity documents. Hosta does not process payment card data on the Client’s behalf. The parties do not intend for special categories of personal data (Article 9 GDPR) to be processed; where an identity document incidentally reveals such data, it is used solely for identity verification.
HOSTA’S OBLIGATIONS AS PROCESSOR
Hosta shall:
process guest personal data only on the Client’s documented instructions — as set out in the Services Agreement and the Host Information Package — unless required to do otherwise by law, in which case Hosta will inform the Client before processing, unless the law prohibits this;
ensure that persons authorised to process the personal data (including Hosta’s staff and virtual assistants) are bound by confidentiality;
implement appropriate technical and organizational security measures, consistent with those described in Hosta’s Privacy Policy (access controls, encrypted storage, retention limits, and, for staff outside the EU/EEA, Standard Contractual Clauses);
engage the sub-processors listed in Hosta’s Privacy Policy (hosta.fi/privacy-policy) to support service delivery; the Client authorises this general engagement upon signing the Services Agreement, and Hosta will give reasonable notice of material changes to that list;
taking into account the nature of the processing, assist the Client by appropriate technical and organizational measures, insofar as reasonably possible, in responding to guest requests to exercise their rights under Applicable Data Protection Law;
assist the Client in ensuring compliance with its obligations relating to security of processing, breach notification and data protection impact assessments, taking into account the information available to Hosta;
notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting guest personal data processed under this DPA;
at the end of the Services Agreement, delete or, at the Client’s request, make available for retrieval the guest personal data processed under this DPA, subject to the retention periods set out below;
make available to the Client information reasonably necessary to demonstrate compliance with this DPA.