About this Addendum
This Data Processing Addendum forms part of the agreement between AtithiBook ("Processor", "we") and the property using AtithiBook ("Data Fiduciary", "you"). It reflects India's Digital Personal Data Protection Act 2023. Where you collect and process your guests' personal data through AtithiBook, you are the Data Fiduciary and AtithiBook acts as your Data Processor.
What we process, and why
AtithiBook processes guest personal data — names, phone numbers, email addresses, nationality, and stay details — solely to provide the booking-management service on your documented instructions. We do not use guest data for our own purposes and we do not sell it.
Our obligations as Processor
— Process guest data only to provide the service to you and on your instructions.
— Apply reasonable security safeguards: encryption in transit (TLS) and at rest, per-property data isolation (row-level security), and access controls.
— Assist you, so far as we reasonably can, in responding to your guests' data-rights requests (access, correction, erasure).
— Notify you without undue delay if we become aware of a personal-data breach affecting your guests' data, with the information you need to meet your own reporting duties.
— Delete or return guest data on termination, subject to any retention required by law (for example, tax records).
Sub-processors
We use the following sub-processors to deliver the service. We will give you notice before adding a new one that materially changes how guest data is processed.
— Supabase — cloud database + file storage — hosted in Mumbai, India
— Vercel — application hosting / content delivery
— OpenAI or Anthropic — reads text you send us to interpret: guest enquiries you paste in or forward to your AtithiBook enquiry address, spoken bookings if you use the "Speak a booking" feature, and onboarding forms or booking lists you upload when setting up
— Resend — only if enabled — sends transactional email (e.g. CA register, team invites)
— WhatsApp / Meta — only if enabled — sends booking messages
— Your chosen OTA channel manager — only if you enable OTA sync
Your obligations as Data Fiduciary
— Obtain any consent, and provide any notice, your guests are entitled to for the data you collect through AtithiBook.
— Give only lawful instructions, and enter only data you are permitted to process.
Where data is stored
Guest data is stored in India (Mumbai). Some sub-processors may process limited data outside India as part of delivering the service; we use providers that offer appropriate safeguards.
Execution
This Addendum forms part of your subscription agreement. The property name, effective date and signatures are completed for each property when that agreement is signed.
Contact
Data-protection questions: hello@atithibook.com
Phone: +91 9742377973