Data Processing Agreement

Wild Spaces Ventures Ltd — Version 1.0, effective 25 October 2026

This Data Processing Agreement (the “DPA”) forms part of the Agreement between Wild Spaces Ventures Ltd (“we”, “us”, the “Processor”) and the Customer (the “Controller”) and applies to our processing of personal data on the Customer’s behalf in the course of providing the Service. Capitalised terms not defined here have the meanings given in the Terms of Service. Notices and requests under this DPA may be sent to us at privacy@lodgestock.ai.

1.Definitions

1.1

“Data Protection Law” means all law applicable to the processing of personal data under the Agreement, including the UK General Data Protection Regulation and the Data Protection Act 2018 (together “UK GDPR”), the EU General Data Protection Regulation where applicable, and the data protection law of the jurisdiction in which the Customer is established.

1.2

“personal data”, “processing”, “data subject”, “personal data breach” and related terms have the meanings given in UK GDPR.

1.3

“Sub-processor” means any third party we engage to process personal data on the Customer’s behalf in connection with the Service.

2.Roles and scope

2.1

The Customer is the controller and we are the processor of the personal data described in Annex A. Each party shall comply with its own obligations under Data Protection Law.

2.2

The Customer instructs us to process personal data as necessary to provide the Service and as documented in the Agreement. This DPA and the Agreement are the Customer’s complete documented instructions. Additional instructions require written agreement of both parties.

2.3

The Customer warrants that it has a lawful basis for the processing, that it has provided any notices to and obtained any permissions from its staff and other data subjects required by Data Protection Law, and that its instructions comply with Data Protection Law.

3.Our obligations as processor

3.1

We shall:

(a)

process personal data only on the Customer’s documented instructions, unless required otherwise by law, in which case we will inform the Customer unless prohibited from doing so;

(b)

ensure that all persons authorised to process the personal data (including our support engineers) are bound by obligations of confidentiality;

(c)

implement and maintain the technical and organisational measures described in Annex C;

(d)

assist the Customer, taking into account the nature of the processing, in responding to data subject requests and in meeting the Customer’s obligations regarding security, breach notification and data protection impact assessments, insofar as this is possible;

(e)

make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as set out in clause 8; and

(f)

at the end of the Agreement, delete or return the personal data in accordance with clause 9 of the Terms of Service, unless retention is required by law.

4.Sub-processors

4.1

The Customer gives general written authorisation to our engagement of the Sub-processors listed in Annex B, and to our engagement of replacement or additional Sub-processors in accordance with this clause.

4.2

We will give the Customer at least 14 days’ written notice before adding or replacing a Sub-processor. If the Customer reasonably objects on data protection grounds within that period and we cannot offer a reasonable alternative, the Customer may cancel the subscription under clause 8 of the Terms of Service before the change takes effect. Where a Sub-processor is engaged only to provide an optional feature, we will identify the Sub-processor and the data it will process before the Customer enables that feature, and the Customer’s enabling of the feature constitutes its specific authorisation of that Sub-processor. Where a Sub-processor must be replaced urgently for security or service continuity reasons, we may give notice as soon as reasonably practicable after the change, and the Customer’s right to object applies from that notice.

4.3

We will impose on each Sub-processor data protection obligations materially equivalent to those in this DPA, and we remain responsible to the Customer for each Sub-processor’s performance.

5.International transfers

5.1

Customer Data is hosted in the European Economic Area (Ireland). Where we or a Sub-processor transfer personal data outside the UK or EEA (including to the United States), we will ensure the transfer is made under a lawful transfer mechanism, including UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses with the UK Addendum, as applicable.

5.2

Where the Customer is established in a jurisdiction whose law imposes conditions on cross-border transfer of personal data, the Customer confirms that its use of the Service constitutes its instruction and consent to the transfers described in this DPA, and the parties will cooperate to satisfy any additional local requirements.

6.Personal data breach

6.1

We will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the personal data processed under this DPA, and will provide information reasonably available to us to assist the Customer in meeting its own notification obligations.

7.Data subject requests

7.1

If we receive a request from a data subject relating to personal data processed under this DPA, we will forward it to the Customer promptly and will not respond directly except to acknowledge receipt or as required by law. The Service provides administrative tools enabling the Customer to access, correct and deactivate staff records, and we will provide an export of personal data on request. Corrections to sign-in email addresses are made by us on request. We will provide reasonable additional assistance on request.

8.Audit

8.1

No more than once in any 12-month period, and on at least 30 days’ written notice, the Customer may audit our compliance with this DPA. We may satisfy an audit request by providing recent third-party certifications, sub-processor compliance documentation, or written responses to a reasonable security questionnaire. On-site audits are limited to circumstances required by Data Protection Law or following a personal data breach, are conducted at the Customer’s cost during business hours, and must not compromise the security or confidentiality of other customers’ data.

9.Liability and term

9.1

The liability of each party under this DPA is subject to the exclusions and limitations in clause 15 of the Terms of Service. This DPA takes effect on the start date of the subscription and remains in force for as long as we process personal data on the Customer’s behalf.

9.2

We may update this DPA, including its Annexes, in accordance with clause 16.4 of the Terms of Service. Changes to Sub-processors are governed by clause 4.

Annex A — Details of processing

Subject matter and duration. Processing of personal data as necessary to provide the LodgeStock operational logging and monitoring platform, for the duration of the subscription plus the export and deletion periods in clause 9 of the Terms of Service.

Nature and purpose. Hosting, storage, display, transmission and analysis of operational records; authentication of users; attribution of operational entries to staff members for audit purposes; generation and delivery of digest and alert emails. Where AI-generated narrative summaries are included in digests, they are produced from operational data only and no personal data is submitted to the AI provider.

Categories of data subjects. The Customer’s staff and contractors (Authorised Users); recipients of digest and alert emails designated by the Customer (which may include owners, directors and managers); drivers and other individuals named in free-text fields by the Customer’s staff.

Categories of personal data.

Identity and contact data: staff names, display names, usernames, roles, email addresses, WhatsApp numbers (where provided for account setup), digest recipient names and email addresses.
Credentials and security data: hashed PINs, encrypted passwords, hashed invitation and setup tokens, failed-attempt counters and lockout timestamps.
Usage and attribution data: records of which staff member logged, amended, voided or acknowledged each operational entry; session data including IP address, browser user agent and last-seen timestamps; audit log entries including actor, IP address and before/after record states.
Content data: free-text comments, notes and driver names entered by staff; the rendered content of digest and alert emails sent on the Customer’s behalf.
Error reports: when the application encounters a fault, a technical report containing the error details, the page or action involved, and pseudonymous lodge and staff account identifiers, used solely to diagnose and fix the fault.

Special category data. None. The Service does not process guest identities (guest occupancy is recorded as counts only), payment card data, photographs, precise location data, or any special category personal data, and the Customer shall not use the Service to process such data.

Retention within the Service. During the subscription, personal data is retained as follows:

Session records, including network address, browser user agent and last-seen timestamp, are deleted automatically 30 days after the relevant account’s last activity.
The rendered content of digest and alert emails is deleted 12 months after sending. The send record (recipients, subject, time sent and delivery status) is retained for operational history.
Audit log entries and operational records (transactions, drive and equipment logs, meter readings and anomalies) are retained for the duration of the subscription.
Error reports sent to our error monitoring provider are retained for 90 days.

At the end of the subscription, all personal data is exported and deleted in accordance with clause 9 of the Terms of Service.

Annex B — Authorised sub-processors

Sub-processor	Function	Location of processing
Supabase, Inc.	Database hosting and authentication (including any authentication emails sent by that service)	EU (Ireland, eu-west-1)
Vercel, Inc.	Application hosting and request logs	EU (Dublin, dub1)
Resend, Inc.	Transactional, authentication and digest email delivery, including invitation, account setup and password reset emails (recipient names, email addresses, email content)	United States / EU
Google LLC (Google Workspace)	Business email and support correspondence	EU / United States
Functional Software, Inc. (Sentry)	Error monitoring and service reliability: on a software fault, receives the error message and stack trace, the page or action involved, pseudonymous lodge and staff account identifiers, and the environment and release. No IP addresses, cookies, request contents, names, email addresses or staff free text are sent. Reports retained for 90 days.	EU (Germany)

Where the Customer’s staff share account setup links via WhatsApp, that sharing occurs directly from the staff member’s own device and WhatsApp account; WhatsApp is not engaged by us as a Sub-processor.

We do not currently engage any AI provider as a Sub-processor. If we do so in future, we will give notice in accordance with clause 4 of this DPA, and any personal data submitted to such a provider will be limited to what is necessary for the function described in Annex B.

Stripe, Inc. (payment processing) may be added as a Sub-processor in future in accordance with clause 4 of this DPA.

Annex C — Technical and organisational measures

Encryption of personal data in transit (TLS) and at rest.
Logical multi-tenant isolation: every query is scoped to a tenant identifier in the application layer, and row-level security is enabled on all database tables so that any credential other than the application’s is denied access by default.
Credential protection: PINs stored as bcrypt hashes; stored passwords encrypted with AES-256-GCM; invitation and setup tokens stored as hashes; automatic lockout after repeated failed PIN attempts.
Capability-based access control within the application, with permissions granted per user, and PIN-based access for field staff that requires no personal email address.
Append-only audit logging of administrative and data-modifying actions, including actor and timestamp.
Hosting on established cloud infrastructure providers (Supabase, Vercel) in EU data centres, with provider-managed physical security, redundancy and automated backups.
Access to production systems and customer data restricted to authorised personnel bound by confidentiality obligations, on a need-to-know basis.
Regular review of dependencies and security patches; secrets managed through environment-level configuration, not source code.