Data Processing Agreement
Last updated: October 2026
In the Hydra Suite software (PMS, POS, INV, booking engine, AI chatbot) the hotel or venue — the Customer — handles its guests’ and staff’s data: the Customer is the controller of that data and Szalai Kevin, sole trader (Hydra Suite, the “Provider”), is its processor. This page summarises our single data processing agreement under Article 28 GDPR, which covers every Hydra service. The text to sign is provided with the service contract; this summary is a draft awaiting legal review and does not replace the signed agreement.
1. Roles of the parties
The Customer (hotel, venue) is the controller: it decides why and how its guests’ and staff’s data is processed. The Provider is the processor: it processes that data only on the Customer’s behalf and documented instructions. For our own customer and billing data we are the controller (see the Privacy notice). NAV, NTAK, the VIZA system and the municipality collecting tourist tax receive data as independent recipients, under the Customer’s legal obligations — they are not the Provider’s sub-processors. The Hydra Spa appointment booking service has its own, separate agreement.
2. Subject matter, nature and purpose — per service
• Hydra PMS: runs on the Customer’s own computer, with a local database. Guest data reaches the Provider only through: encrypted cloud backups to the Hydra Admin server (if the Customer switches them on); relaying OTA bookings from the Channex channel manager to the PMS; occupancy sharing between partner hotels (only which room is taken when — no guest names); remote support at the Customer’s request. • Hydra POS: runs locally; day-close backups and manager statistics go to the Hydra Admin server. • Hydra INV: runs locally; a daily backup goes to the Hydra Admin server. • Booking engine: operated by the Provider; guests’ online bookings, card payments through SimplePay. • AI chatbot: operated by the Provider; guests’ questions are answered by Anthropic’s model. The only purpose is providing the contracted service; the Provider does not use the data for its own purposes.
3. Personal data and data subjects
Data subjects: the Customer’s guests and their companions, people booking and using the chatbot, the Customer’s staff and users. Data: identification and contact data (name, address, email, phone); guest register data under section 9/H of Hungarian Act CLVI of 2016 (birth data, nationality, type and number of the identity document); stay and booking data; billing and payment data (the Provider stores no card data); chat messages; user IDs, password hashes and logs. Special categories of data are not a purpose of the service. The detailed list is in the agreement’s annex.
4. Duration
For the term of the service contract, then until return or deletion under section 11.
5. Instructions and confidentiality
The Provider processes data only on the Customer’s documented instructions — the contract, this agreement and the settings the Customer makes in the software — including transfers outside the EU. If the law requires other processing, the Provider tells the Customer beforehand unless the law forbids it. If it considers an instruction unlawful, it says so without delay. Everyone with access to the data is bound by confidentiality.
6. Security measures (Art. 32) — and what we can’t do yet
What the software actually does: encrypted connections (TLS) for all traffic over the internet; passwords stored only as hashes (PBKDF2 in the PMS and POS, scrypt in the booking engine dashboard, bcrypt for Hydra Admin and chatbot portal accounts); software updates and licence answers signed with Ed25519; PMS cloud backups encrypted on the Customer’s computer (X25519 + AES-256-GCM) to the Provider’s recovery key, whose private half is kept offline and never on a server — so the Provider opens a backup only for disaster recovery at the Customer’s request; mandatory two-factor sign-in (TOTP) for Hydra Admin staff accounts (being introduced); per-device secrets never enter the synchronised data; logged backup downloads and deletions; automatic retention rules. Known limitations, with fixes planned: the local PMS and POS databases are not encrypted on disk — until then we recommend full-disk encryption (e.g. BitLocker); the local network (LAN) sync between workstations is not encrypted — keep the till and front-desk network separate from the guest network; POS and INV cloud backups are not yet end-to-end encrypted (TLS protects them in transit). Schedule for the fixes: [to be completed].
7. Sub-processors
The Customer gives general authorisation for the sub-processors below. The Provider notifies the Customer at least 30 days before adding or replacing one; the Customer may object on reasonable data-protection grounds, and if the parties cannot agree, may terminate the affected service free of charge. The Provider imposes the same data-protection obligations on every sub-processor and remains liable for them.
| Sub-processor | What for | Where | Transfer safeguard |
|---|---|---|---|
| Railway Corporation | Hosting: Hydra Admin (backups, Channex relay, partner occupancy, chatbot), booking engine | EU region (US company) | Stored in the EU; DPF, with the SCCs in Railway’s DPA as fallback |
| Resend, Inc. | Email delivery (booking confirmations, account and chatbot emails) | EU region (US company) | Stored in the EU; DPF, with the SCCs in Resend’s DPA as fallback |
| OTP Mobil Kft. (SimplePay) | Card payments in the booking engine — as payment service provider, an independent controller for card data | Hungary | Within the EU |
| Channex.io Ltd. | Channel manager: OTA bookings and availability (PMS) | United Kingdom | UK adequacy decision |
| Anthropic PBC | AI answers in the chatbot (chatbot only) | USA | SCCs [DPF — to be confirmed] |
| Functional Software, Inc. (Sentry) | Booking engine error reports, only if switched on; no guest data intended | [region — to be confirmed] | DPF or SCCs [to be confirmed] |
| Google (Drive) | Only if the Customer turns on Google Drive backup in the PMS: the Customer’s own Google account and contract — not the Provider’s sub-processor | The Customer’s own transfer |
8. Transfers outside the EU
Data leaves the EU only as the table shows: chatbot messages go to Anthropic in the USA under standard contractual clauses (SCCs); Channex operates in the United Kingdom, which has an adequacy decision. Railway and Resend are US companies, but the data is stored in their EU regions; both are DPF-certified and their agreements include the SCCs as a fallback. Any other transfer happens only on the Customer’s instruction and with a safeguard under Chapter V GDPR.
9. Help with data-subject requests and compliance
The Provider helps the Customer answer data-subject requests (access, rectification, erasure, restriction, portability, objection) and meet its obligations under Articles 32–36. Tools available today: in the booking engine a guest can download their booking data and ask for deletion, which the hotel anonymises in one step or closes with a reason; in the PMS guest data can be searched, corrected and deleted; a dedicated PMS export and erasure tool is being built. Where a request concerns data held by the Provider, the Provider helps within [5] working days.
10. Personal data breaches
The Provider notifies the Customer of a breach affecting the Customer’s data without undue delay and at the latest within 48 hours of becoming aware of it, with the information listed in Art. 33(3) (anything not yet known follows later). The Customer decides on notifying NAIH and the data subjects; the Provider helps.
11. Return and deletion
When the contract ends, the Provider, at the Customer’s choice, returns the data in a machine-readable format or deletes it, and deletes the copies it holds within 30 days of termination, unless the law requires keeping them. Hydra Admin deletes everything linked to the hotel in one step (backups, chat, the Channex queue, logs, accounts — this function is being introduced); only the Provider’s own invoices to the Customer remain (8 years). Backups also rotate during the contract: the last 7 PMS backups, the last 30 POS backups per terminal and the last 14 days of INV backups are kept; chat conversations are deleted after 31 days. Deleting the local database on the Customer’s own computers is the Customer’s task.
12. Audits
The Provider makes available all information needed to demonstrate compliance with Article 28 and allows audits by the Customer or an auditor it mandates — at most once a year (and after a breach), on at least 15 days’ written notice, in business hours and under confidentiality.
13. Liability
Liability follows the service contract and the Terms of Use as far as the GDPR and Hungarian law allow; liability between controller and processor is allocated under Article 82 GDPR.
14. Governing law and annexes
The agreement is governed by Hungarian law, the GDPR and the Information Act; on data protection it prevails over any conflicting term. Annexes: the detailed data and data-subject list per service, the retention table, the sub-processor list and the security measures. Data protection contact: info@hydrasuite.hu, +36 30 861 7345.