Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between KLB Solutions FZCO ("Worldie", "we", "us") and the Property ("Customer", "you") and applies whenever Worldie processes Personal Data on behalf of the Customer in the course of providing the Worldie Hospitality OS platform (the "Service").

Worldie acts as a Data Processor; the Customer is the Data Controller for guest data captured through the Service.

The subject matter of the processing is the operation of the Service. The duration of processing matches the term of the underlying agreement plus any retention period required by law or by the Customer's configuration.

Worldie processes Personal Data to provide guest messaging, AI-assisted concierge replies, ticketing, guest profiles, broadcast campaigns, analytics, and operational tooling. Processing is limited to what is necessary to deliver the Service.

Data subjects: the Customer's guests and the Customer's authorised users (staff, managers, owners).

Personal data: name, contact details, message content, channel metadata, booking and stay information, preferences, and any other data the Customer or its guests submit to the Service.

Worldie engages a small set of vetted sub-processors to operate the Service (cloud hosting, AI model providers, transactional email, messaging-channel APIs). The current list is published at /sub-processors and updated when changes occur. The Customer may object to a new sub-processor on reasonable data-protection grounds.

Worldie maintains technical and organisational measures appropriate to the risk, including encryption in transit, encryption at rest for sensitive data, role-based access controls, audit logging, and regular security reviews. See our security page for details.

Where Personal Data is transferred outside the UK / EEA, Worldie relies on the UK International Data Transfer Addendum or EU Standard Contractual Clauses (2021), with supplementary measures as required.

Worldie will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil the Customer's obligation to respond to data-subject requests under applicable law.

Worldie will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer data, and will provide reasonable cooperation to enable the Customer to meet its notification obligations.

On termination of the Service, Worldie will, at the Customer's choice, delete or return all Personal Data unless retention is required by law. See the data-deletion page for self-service options.

Worldie will make available all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, on reasonable notice and during business hours.

Questions about this DPA: adam@klb-solutions.com.