CleverRooms Data Processing Agreement
The agreement under which CleverRooms processes personal information for the hotels that use it: what it does with it, the security measures, the suppliers it uses and what happens at the end.
Contents
This Data Processing Agreement (the DPA) forms part of the agreement between the customer named in the Order Form (the Customer) and CleverRooms Tech Ltd, a company registered in England and Wales with company number 17508054, whose registered office is at 120 Warstone Lane, Birmingham B18 6NZ (CleverRooms), made up of the Order Form and the CleverRooms Customer Terms (the Agreement). Words defined in the Agreement have the same meaning here.
1. Definitions
- Data Protection Laws means all laws about personal data that apply to the processing under this DPA, including the UK GDPR, the Data Protection Act 2018 (both as amended by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications (EC Directive) Regulations 2003, and, where they apply, the EU GDPR and US State Privacy Laws.
- UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.
- US State Privacy Laws means the California Consumer Privacy Act of 2018 as amended (the CCPA) and any similar US state law that applies to the processing.
- Customer Personal Data means personal data in the Customer Data that CleverRooms processes on the Customer's behalf under the Agreement.
- Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- Sub-processor means any third party CleverRooms engages to process Customer Personal Data.
- Restricted Transfer means a transfer of Customer Personal Data (including remote access) to a country outside the United Kingdom that is not covered by UK adequacy regulations.
- UK Transfer Terms means the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses (the UK Addendum), each issued under section 119A of the Data Protection Act 2018.
- Information Commission means the UK data protection regulator (known as the ICO), formerly the Information Commissioner.
- Controller, processor, data subject, personal data, processing, special category data and supervisory authority have the meanings given in the UK GDPR. Business, service provider, contractor, sell and share have the meanings given in the CCPA.
2. Roles and scope
2.1 The Customer is the controller and CleverRooms is the processor of Customer Personal Data. Annex 1 describes the processing.
2.2 Where US State Privacy Laws apply, the Customer is a business (or controller) and CleverRooms is a service provider (or processor), and Part 12 also applies.
2.3 CleverRooms is a controller, not a processor, of personal data it processes for its own business purposes, such as its account, billing and support records about the Customer's contacts, and Usage Data. Its Privacy Notice covers that processing.
3. Instructions
3.1 CleverRooms will process Customer Personal Data only on the Customer's documented instructions, including about Restricted Transfers, unless the law requires otherwise (in which case CleverRooms will tell the Customer before processing, unless the law prohibits this).
3.2 The Customer's instructions are: (a) the Agreement and this DPA; (b) the Customer's choices and settings in the Service, including which Connected Systems to connect, which features to switch on and how long to keep records; and (c) any further written instruction agreed by both parties.
3.3 CleverRooms will tell the Customer promptly if, in its opinion, an instruction breaks Data Protection Laws. CleverRooms is not obliged to carry out such an instruction.
3.4 CleverRooms will not use Customer Personal Data to train artificial intelligence models, for marketing, or for any purpose other than providing, securing and supporting the Service for the Customer.
4. People
CleverRooms will make sure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, is trained in data protection appropriate to their role, and accesses Customer Personal Data only as needed to provide the Service or as the Customer asks (for example, to help with a support request).
5. Security
5.1 CleverRooms will put in place and maintain the technical and organisational measures in Annex 2, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing and the risks to people.
5.2 CleverRooms may update the measures in Annex 2 but will not materially reduce the overall security of the Service.
6. Sub-processors
6.1 The Customer gives CleverRooms general written authorisation to engage the Sub-processors listed in Annex 3, and further Sub-processors under this clause 6.
6.2 CleverRooms will give the Customer at least [30] days' notice before a new Sub-processor starts processing Customer Personal Data, by email to the Customer's data protection contact and by updating the list at [cleverrooms.io/legal/sub-processors]. The notice will say who the Sub-processor is, what it will do, where it will process data and the transfer safeguard.
6.3 The Customer may object on reasonable data protection grounds within that notice period. If it does, the parties will discuss it in good faith. If CleverRooms cannot reasonably avoid using the new Sub-processor for the Customer, the Customer may end the affected part of the Service by written notice and receive a refund of prepaid Fees for the time not used.
6.4 In an emergency (for example to replace a Sub-processor that has failed or become unsafe), CleverRooms may engage a replacement with shorter notice, and will tell the Customer as soon as possible; clause 6.3 still applies.
6.5 CleverRooms will impose on each Sub-processor, by written contract, data protection obligations that give at least the same level of protection as this DPA, and will remain liable to the Customer for each Sub-processor's performance of those obligations.
6.6 The providers of Connected Systems (for example the Customer's property management, rota, till or accounting system) are not Sub-processors. They are the Customer's own suppliers, and CleverRooms reads from them on the Customer's instruction.
7. Where data is processed, and transfers
7.1 CleverRooms stores Customer Personal Data in the United Kingdom (London) by default.
7.2 Some Sub-processors in Annex 3 process data, or can access it, outside the UK. The Customer authorises those transfers, which CleverRooms will make only: (a) to a country covered by UK adequacy regulations, including, for the United States, to a recipient certified under the UK Extension to the EU-US Data Privacy Framework whose certification covers the categories of data (including human resources data, where staff data is transferred); or (b) under the UK Transfer Terms, signed with the recipient, together with a transfer risk assessment showing that the protection for people is not materially lower than in the UK.
7.3 If the basis for a transfer stops being valid (for example if the UK adequacy regulations for the United States are revoked or struck down), CleverRooms will promptly move that transfer onto the UK Transfer Terms or stop it, and tell the Customer what it has done.
7.4 If the Customer is established in the European Economic Area or the EU GDPR otherwise applies, the EU Standard Contractual Clauses ([Module 2 / Module 3]) are incorporated by reference for transfers that need them, completed as set out in Annex 4. [Delete if CleverRooms does not take EU customers yet.]
8. Helping the Customer
8.1 Data subjects' requests. If CleverRooms receives a request from a person exercising their data protection rights about Customer Personal Data, it will pass it to the Customer within [5] business days and will not answer it except to tell the person it has done so. Taking into account the nature of the processing, CleverRooms will help the Customer answer requests (to see, correct, delete, restrict, object to or move data) by giving it tools in the Service where available and otherwise by doing what the Customer reasonably asks within [10] business days.
8.2 Complaints. If CleverRooms receives a complaint about the processing of Customer Personal Data, it will pass it to the Customer within [5] business days, so the Customer can meet its duty to acknowledge complaints within 30 days (section 164A of the Data Protection Act 2018).
8.3 Impact assessments. CleverRooms will give the Customer the information it reasonably needs for data protection impact assessments and any prior consultation with the Information Commission, including the support pack in Annex 5 for staff monitoring features (clock-in taps, rotas and records of checks).
8.4 Regulators. CleverRooms will co-operate with the Information Commission or another supervisory authority on request, and will tell the Customer about any request about Customer Personal Data unless the law prohibits it.
9. Personal Data Breaches
9.1 CleverRooms will tell the Customer without undue delay, and in any event within [24] hours, after becoming aware of a Personal Data Breach. If full details are not available within that time, CleverRooms will send what it knows and add the rest in phases as soon as they are available.
9.2 The notice will describe, as far as known: what happened and when; the categories and approximate numbers of people and records affected; the likely consequences; what CleverRooms has done and proposes to do, including to limit harm; and a contact for more information.
9.3 CleverRooms will take reasonable steps to contain the breach, investigate it and prevent it happening again, and will help the Customer with its own notifications to the Information Commission (within 72 hours where required) and to the people affected. CleverRooms will not notify the regulator or the people affected about a breach of Customer Personal Data on the Customer's behalf unless the Customer asks or the law requires it.
9.4 Notifying a breach is not an admission of fault or liability.
10. At the end
10.1 When the Agreement (or a Pilot that does not continue) ends, the Customer may export Customer Personal Data for [30] days. CleverRooms will then delete Customer Personal Data within [30] days, and backups will be overwritten within a further [35] days, as clause 16.5 of the Customer Terms and the Retention Policy set out.
10.2 CleverRooms may keep Customer Personal Data after that only where the law requires it, and then it will keep it confidential, process it only for that legal purpose, and delete it when the requirement ends.
10.3 CleverRooms will confirm deletion in writing on request.
11. Showing compliance and audits
11.1 CleverRooms will make available to the Customer, on request, the information reasonably needed to show that it complies with this DPA and Article 28 of the UK GDPR, including: a current security summary; its record of processing for the Customer; its current Sub-processor list; and copies or summaries of certifications and independent tests as it obtains them (for example Cyber Essentials and penetration test summaries).
11.2 If that information is not enough to show compliance, or a regulator requires it, the Customer (or an independent auditor bound by confidentiality, who is not a competitor of CleverRooms) may audit CleverRooms' compliance with this DPA, no more than once in any 12 months (except after a Personal Data Breach or where a regulator requires it), with at least [30] days' written notice, during business hours, remotely where possible, and without access to other customers' data. Each party pays its own costs of an audit, unless the audit reveals a material breach by CleverRooms, in which case CleverRooms pays the reasonable costs of the audit.
12. US State Privacy Laws
Where US State Privacy Laws apply to Customer Personal Data:
12.1 The Customer discloses Customer Personal Data to CleverRooms only for the limited and specified business purposes of providing the Service, as described in the Agreement and Annex 1.
12.2 CleverRooms will not: (a) sell or share Customer Personal Data; (b) keep, use or disclose it for any purpose (including any commercial purpose) other than the business purposes in clause 12.1, or outside the direct business relationship between the parties, except as US State Privacy Laws allow; or (c) combine it with personal data CleverRooms receives from or on behalf of anyone else, or collects itself, except as US State Privacy Laws allow.
12.3 CleverRooms will comply with US State Privacy Laws, give the same level of privacy protection they require, and tell the Customer if it can no longer meet its obligations under them.
12.4 The Customer may take reasonable and appropriate steps to make sure CleverRooms uses Customer Personal Data in line with the Customer's obligations, and, after notice, to stop and remedy unauthorised use.
12.5 CleverRooms will help the Customer answer consumer requests and meet its obligations under any rules on risk assessments, cybersecurity audits and automated decision-making technology that apply to the Customer's use of the Service.
12.6 CleverRooms certifies that it understands and will comply with the restrictions in this Part 12.
13. Liability and order of precedence
13.1 Each party's liability under this DPA is subject to the limits in clause 15 of the Customer Terms, including the data protection cap in clause 15.4(c). This does not limit either party's liability to data subjects under Data Protection Laws where the law does not allow it to be limited.
13.2 If this DPA conflicts with the rest of the Agreement on anything about personal data, this DPA prevails. If the UK Transfer Terms or EU Standard Contractual Clauses conflict with this DPA, they prevail.
14. Term
This DPA lasts for as long as CleverRooms processes Customer Personal Data under the Agreement.
Annex 1: Details of the processing
| Subject matter | Providing the CleverRooms hotel operations service to the Customer. |
| Duration | The Pilot and Subscription Term, plus the export and deletion periods in clause 10. |
| Nature of processing | Collecting data from Connected Systems the Customer connects (read-only by default) and from what Authorised Users enter, upload, email in or record by tapping NFC tags; storing, organising and structuring it; searching and analysing it to show dashboards, plans, logs and answers; using AI models to answer questions, summarise and draft; sending emails and app notifications that an Authorised User triggers or sets up; exporting and deleting it. |
| Purpose | To run the Service for the Customer's Venues: operations dashboards, housekeeping plans, records of checks, staff clock-in and shift information, finance views (read only), automations the Customer sets up, and answers to the Customer's questions. |
| Categories of data subjects | The Customer's employees, workers, agency staff and contractors; the Customer's Authorised Users; contacts at the Customer's suppliers and service contractors; any other person whose details appear in documents or messages the Customer chooses to put into the Service (for example a name in an invoice). The Service is designed not to collect hotel guests' personal data (see below). |
| Categories of personal data | Identity and contact details (name, work email, work phone, job title, department, Venue); work information (roles, rotas and shifts, hours, holiday and "unavailable" days without reasons, clock-in and clock-out taps with time and the tag's location, checks and tasks completed with who and when, certificates and training records with expiry dates); supplier and contractor contact details and the content of invoices, reports and emails the Customer sends in; account and technical information (sign-in records, device type for the app, actions in the audit log). |
| Guest data | Not intended. Connections to property management systems are set up to leave guest personal data out where the system allows it (for example Apaleo's "omit personal data" option and Oracle's separate opt-in for sensitive guest data, which CleverRooms does not request). Room numbers, room status, arrival and departure counts and occupancy are used without guest names. If guest personal data reaches the Service incidentally (for example in an email the Customer forwards), it is processed only as part of that item and is covered by this DPA. |
| Special category data | Not intended. The Service records that a person is unavailable, not why. The Service does not use biometrics. The Customer must not put special category data into the Service unless the Order Form includes a feature that needs it. |
| Children's data | The Service does not ask for dates of birth or ages. Where the Customer employs people under 18, their work information is processed like any other member of staff's. |
| Frequency | Continuous, for the duration. |
| Retention | As set by the Customer in the Service (the default is to keep records for the Subscription Term), subject to any legal hold the Customer places, and the CleverRooms Retention Policy. |
Annex 2: Security measures
| Area | Measure | Status |
|---|---|---|
| Hosting | Google Cloud, London region (europe-west2); each customer's data kept in its own tenant store, separated from other customers'. | In place |
| Encryption | Data encrypted in transit (TLS 1.2 or higher) and at rest (Google Cloud's default encryption, with keys managed in Cloud KMS for sensitive items). | In place |
| Secrets | Connection credentials and keys held in Google Secret Manager or an encrypted store; never in code, logs or support tickets. | In place |
| Connected Systems | Read-only by default; any write needs a named person to confirm it and can be undone; each connection asks only for the permissions it needs; credentials deleted on disconnect. | In place |
| Access control | Role-based access per Venue; staff see only what their role allows; sign-in through WorkOS with email codes, no self sign-up; NFC tags signed so a copied tag is refused. | In place |
| CleverRooms' own access | Two-step sign-in on every administrative account (Google Cloud, GitHub, Vercel, Apple, Resend, the domain registrar and others); least privilege; access to customer data only to support the customer and logged. | Before the first live hotel (part of Cyber Essentials) |
| Logging | An audit log of who did what and when in the Service; security and service logs kept for a limited time (see the Retention Policy). | In place |
| Backups | Daily backups and point-in-time recovery for customer databases; backups kept for no more than [35] days; a restore drill done and recorded at least [twice a year]. | Before the first live hotel (restore drill not yet proven) |
| Resilience | Managed services with automatic restarts; deletion protection on databases; monitoring and alerts for errors and slow pages. | Partly in place |
| AI | AI providers used under commercial terms that do not allow training on customer data; only the data needed for a request is sent. | In place [confirm each provider's input retention period] |
| Software | Code review and automated tests before every release; dependency vulnerability checks; a documented rollback for every release. | In place |
| Incidents | A written incident response plan that can notify customers within 24 hours; a record of every incident. | Before the first live hotel |
| People | Confidentiality duties for everyone with access; data protection training at joining and every year. | Before the first live hotel |
| Certification | Cyber Essentials, then [Cyber Essentials Plus / ISO 27001] as the business grows; independent penetration test before [the first group customer]. | Planned |
Annex 3: Sub-processors
| Sub-processor | What it does | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Google Cloud EMEA Limited (Google Cloud) | Hosting, databases, file storage, keys and secrets; reading documents such as invoices when the Customer switches that on | All Customer Personal Data | United Kingdom (London); [support access may be from other countries] | Google Cloud's data processing terms, including the UK Transfer Terms for any access from outside the UK |
| Neo4j, Inc. (Neo4j Aura) | Database that holds how the Venue's records connect | Customer Personal Data in the operations records | [Google Cloud London, to confirm]; company in the US and Sweden | [UK Extension / UK Transfer Terms, to confirm] |
| Anthropic, PBC | AI model that answers questions, summarises, drafts and helps build automations | The parts of Customer Personal Data needed for each request | United States | [UK Extension / UK Transfer Terms, to confirm]; no training on customer data |
| WorkOS, Inc. | Sign-in and user management | Authorised Users' names, emails and sign-in records | United States | [UK Extension / UK Transfer Terms, to confirm] |
| Resend (Plus Five Five, Inc.) | Sending emails (invites, reminders, summaries) and receiving emails the Customer sends in | Email addresses and email content | [United States / EU region, to confirm] | [UK Extension / UK Transfer Terms, to confirm] |
| Nango, Inc. | Holding connection credentials for Square and QuickBooks, for US Venues only | Connection credentials; no staff data | United States | [UK Transfer Terms, to confirm]; UK Venues' credentials stay in CleverRooms' own store in London |
| Twilio Inc. | Texts and WhatsApp messages, only if the Customer switches messaging on (not yet available) | Phone numbers and message content | [United States] | [UK Extension / UK Transfer Terms] |
| Apple Inc. | Notifications to the CleverRooms iPhone app (not yet live) | A device token and the short text of the notification | United States | [Apple's terms, to confirm] |
Not Sub-processors: the Customer's Connected Systems (clause 6.6), and Vercel, which hosts only the public marketing website cleverrooms.io and receives no Customer Personal Data.
Annex 4: Transfer details for the UK Transfer Terms and EU clauses
For the IDTA or UK Addendum and, where clause 7.4 applies, the EU Standard Contractual Clauses: the exporter is the Customer (or CleverRooms, for onward transfers to Sub-processors); the importer is CleverRooms or the relevant Sub-processor; the details of the transfer are in Annex 1; the security measures are in Annex 2; the Sub-processors are in Annex 3; the governing law and courts are those of England and Wales; either party may end the UK Addendum under its section 19 if the approved addendum changes; [EU clauses: clause 7 docking clause applies; clause 9 option 2 (general authorisation, notice period as in clause 6.2 of this DPA); clause 11 optional language does not apply; clause 17 option 1, the law of Ireland; clause 18 courts of Ireland; the competent supervisory authority is that of the EU member state where the Customer is established].
Annex 5: Staff monitoring support pack
Clock-in taps, rotas and records of who completed which check are forms of monitoring workers. The Information Commission's guidance on monitoring workers expects the employer (the Customer) to: show that monitoring is necessary and proportionate and choose the least intrusive way; carry out a data protection impact assessment, consulting staff, or record why one is not needed; have a lawful basis; explain the monitoring specifically in the staff privacy notice; and set how long records are kept. CleverRooms provides the following to help.
A. What CleverRooms records about staff
- When a person taps in and out, which tag they tapped, and when (to record attendance and hours).
- Which checks and tasks a person completed, and when (to keep the records that inspectors and the law expect, such as temperature or fire checks).
- Rotas and shifts read from the Customer's rota system.
- What CleverRooms does not do: track location continuously or outside working time; read personal phones' data; use biometrics; record reasons for absence; score or rank individual staff performance.
B. Template wording for the Customer's staff privacy notice
"We use CleverRooms, provided by CleverRooms Tech Ltd, to run our hotel's daily operations. When you tap your phone or card on a CleverRooms tag, it records the time and the tag's location, so that we can keep accurate records of hours worked and of the checks we have to carry out (such as food safety and fire checks). CleverRooms also shows your rota from [rota system]. We use this information to pay you correctly, to plan shifts and to show that required checks were done. We rely on [our legal obligations and our legitimate interests in running the hotel safely]. We keep these records for [period] and then delete them. CleverRooms does not track where you are outside a tap, does not use fingerprints or face scans, and does not score your performance. Any decision about you is made by a person, and you can ask a manager to review it. You can ask to see your records, or raise a concern, by contacting [name / email]."
C. Inputs for the Customer's impact assessment
A description of the processing (Annex 1), the security measures (Annex 2), the Sub-processors and transfers (Annex 3), the default and configurable retention (the Retention Policy), and answers to the Customer's follow-up questions within [10] business days.