Terms of Service

1. Acceptance of Terms

By accessing, browsing, or using the Steganomos platform (the "Service") available at steganomos.com, or by creating an account, you ("Customer", "you", or "your") acknowledge that you have read, understood, and agree to be bound by these Terms of Service ("Terms"), together with our Privacy Policy, which is incorporated herein by reference.

If you are entering into these Terms on behalf of a company, organization, or other legal entity, you represent and warrant that you have the authority to bind that entity to these Terms. In such a case, "you" and "your" refer to that entity.

If you do not agree to these Terms, you must not access or use the Service. Your continued use of the Service after any changes to these Terms constitutes your acceptance of the revised Terms.

2. Definitions

The following terms have the meanings set forth below when used in these Terms:

• "Platform" or "Service" means the Steganomos software-as-a-service platform, including all features, tools, APIs, integrations, and related documentation.
• "Customer" means any individual or entity that registers for and uses the Service.
• "Customer Data" means all data, content, and information uploaded to, submitted through, or generated within the Service by the Customer, including but not limited to guest information, reservation data, financial records, and property details.
• "Property" means a hotel, vacation rental, bed-and-breakfast, resort, or other accommodation establishment managed through the Service.
• "Booking Revenue" means the gross total value of confirmed reservations processed through the Service, including accommodation tax, calculated at the time of guest check-out. Booking Revenue includes: the room rate, accommodation tax, and any ancillary charges processed through the platform. Booking Revenue excludes: Value Added Tax (VAT) charged on the accommodation service itself, and any amounts refunded to guests prior to check-out.
• "AI Features" means any artificial intelligence, machine learning, or automated decision-making capabilities provided within the Service.
• "rapidbounce", "we", "us", or "our" means collectively: (a) RAPIDBOUNCE TECHNOLOGY SERVICES S.M.P.C. (ΡΑΠΙΝΤΜΠΑΟΥΝΣ ΤΕΧΝΟΛΟΓΙΕΣ ΠΛΗΡΟΦΟΡΙΚΗΣ Μ.Ι.Κ.Ε.), VAT: EL-998277600, GEMI: 008879301000, Lechouriti 1 & Louvari 14, 12132 Peristeri, Athens, Greece — which owns the intellectual property of the Steganomos platform; and (b) SEAMROG TECHNOLOGIES LIMITED, VAT: IE-3588309SH | Company Number: 641356, Baldonnell Business Park, Dublin 22, Ireland — which is the billing entity that collects fees and operates the Stripe Platform account.
• "Organization" means a property management company or similar entity managing multiple Properties on behalf of third-party owners.

3. Description of Service

Steganomos is an AI-powered property management platform designed for the hospitality industry. The Service provides the following core capabilities:

• Property Management System (PMS): Reservation management, room inventory, guest profiles, check-in/check-out workflows, and calendar management.
• Unified Inbox: Multi-channel communication hub supporting email, WhatsApp, web chat, and booking platform messaging, with AI-powered suggestions and sentiment analysis.
• Revenue Intelligence: Rate management, yield optimization, competitive pricing analysis, and revenue forecasting tools.
• Invoicing and Payments: Automated invoice generation, payment processing (via Stripe), and financial reporting.
• Website Builder: Property website creation and management tools with integrated booking engine functionality.
• Competitor Intelligence: Market positioning analysis, competitive rate monitoring, and review sentiment tracking.
• Guest Intelligence: Guest profiling, satisfaction tracking, and communication history management.
• Automations: Workflow automation for repetitive tasks, including automated guest communications, housekeeping coordination, and reporting.
• Knowledge Base: Centralized information repository for property operations, powered by semantic search.
• Analytics and Reporting: Operational dashboards, performance metrics, and exportable reports.

We reserve the right to modify, update, or discontinue any feature of the Service at any time, with reasonable notice to affected Customers. We will provide at least thirty (30) days' notice before discontinuing any core feature listed above.

4. Account Registration

4.1 Eligibility

To use the Service, you must:

• Be at least eighteen (18) years of age.
• Be the owner, operator, or duly authorized representative of the Property being registered.
• Provide accurate, current, and complete registration information.
• Have the legal capacity to enter into a binding agreement.

4.2 Account Security

You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account. You must:

• Choose a strong, unique password and keep it confidential.
• Notify us immediately at help@steganomos.com if you suspect any unauthorized access to your account.
• Ensure that all persons who access the Service through your account are aware of and comply with these Terms.

We will not be liable for any loss or damage arising from your failure to maintain the security of your account.

4.3 Account Accuracy

You agree to keep your account information accurate and up to date, including your contact details, property information, and billing details. Inaccurate information may result in service disruptions or suspension of your account.

4.4 Right of Withdrawal (Consumer Customers)

If you are entering into these Terms as a consumer (not acting in a professional or commercial capacity), you have the right to withdraw from these Terms within fourteen (14) calendar days of account registration, without providing any reason, in accordance with EU Directive 2011/83/EU.

To exercise your right of withdrawal, you must notify us at help@steganomos.com with a clear statement of your decision to withdraw.

However, by actively using the Service (including but not limited to: adding a property, creating a reservation, connecting a booking channel, or processing a payment), you expressly consent to the commencement of the Service before the expiry of the withdrawal period and acknowledge that you lose your right of withdrawal upon such use, in accordance with Article 16(a) of Directive 2011/83/EU.

If you withdraw before actively using the Service, we will delete your account and any data you have provided within fourteen (14) days of receiving your withdrawal notice.

5. Pricing and Payment

5.1 Transaction-Based Pricing

Steganomos operates on a transaction-based pricing model - not a fixed monthly subscription. You are charged based on actual booking revenue processed through the platform. If your property has no bookings in a given period (e.g., off-season), you pay nothing.

5.2 Pricing Tiers

The following pricing tiers apply (as of the date of these Terms):

• Free Tier: EUR 0 per month for properties with up to five (5) rooms. Subject to feature limitations as described in Section 6.
• Pro Tier: 8.25% of Booking Revenue, calculated and billed on a per-check-out basis. All platform features included. Revenue Protection Cap: total fees shall never exceed 20% of Booking Revenue in any billing period.
• Property Manager Tier: Starting from 7% of Booking Revenue, with volume-based discounts available for multi-property portfolios. Specific rates are agreed upon in writing. A 15% discount applies for annual payment commitments.

Feature availability per tier may be updated with thirty (30) days' notice. Current feature details are available at steganomos.com.

5.3 Revenue Protection Cap

5.4 Billing and Payment Processing

Payments are processed through Stripe Connect. The specific payment flow (including charge routing and fund settlement) is determined by the technical configuration of each Property's Stripe Connected Account. Each Customer must create and maintain a Stripe Connected Account subject to Stripe's Connected Account Agreement (https://stripe.com/connect-account/legal). Seamrog Technologies Limited collects an Application Fee (as specified in Section 5.2) which is automatically deducted by Stripe from each transaction. At no point does Seamrog or rapidbounce hold, control, or have access to guest funds beyond the Application Fee. All payment processing is performed by Stripe Technology Europe Limited (STEL), an Electronic Money Institution authorized by the Central Bank of Ireland.

All prices are stated in Euros (EUR) unless otherwise specified. Applicable taxes (including VAT) will be added to your invoices in accordance with Greek and European Union tax regulations.

5.5 Annual Payment

Customers who elect to pay annually (based on estimated revenue) receive a fifteen percent (15%) discount on their applicable tier rate. Annual payments are non-refundable except as required by applicable law.

5.6 Off-Season Zero Fees

During periods when your property receives no bookings through the platform, you will not be charged any fees. There are no minimum monthly charges, platform fees, or standing costs on the Free or Pro tiers.

5.7 Late Payments

Invoices are due within thirty (30) days of issuance. Late payments may incur interest at a rate of one and a half percent (1.5%) per month or the maximum rate permitted by applicable law, whichever is lower. We reserve the right to suspend access to the Service if payment remains outstanding for more than forty-five (45) days.

5.8 Pricing Changes

We may modify our pricing with at least sixty (60) days' written notice. Existing Customers will be given the option to accept the new pricing or terminate their account. Any pricing changes will not apply retroactively to revenue already processed.

5.9 Refunds and Fee Adjustments

Refund decisions are made solely by the Customer (property owner/manager). Steganomos does not initiate, approve, or process guest refunds. The Customer is responsible for managing refund requests through their Stripe Connected Account.

If a refund is issued to a guest, the Customer may request a waiver of the corresponding Steganomos Application Fee by contacting help@steganomos.com. Steganomos will evaluate such requests on a case-by-case basis at its sole discretion. Approval of a fee waiver is not guaranteed.

If a fee waiver is approved, the Steganomos Application Fee for that transaction will be credited to the Customer's account. Stripe processing fees are subject to Stripe's own refund policy and are only waived if Stripe independently agrees to waive them. Steganomos has no control over Stripe's refund fee policy.

5.10 Organization Billing (Property Management Companies)

Where a Customer operates as a property management company or similar organization ("Organization") managing multiple Properties on behalf of third-party property owners, the following terms apply:

• (a) The billing relationship is between Seamrog Technologies Limited and the Organization. Individual Properties within the Organization do not receive separate invoices from Seamrog unless otherwise agreed in writing.
• (b) The Steganomos Application Fee is charged to the Organization based on the aggregate Booking Revenue of all Properties under its management.
• (c) The Organization is solely responsible for determining its own fee structure with its managed Properties. Steganomos is not party to any agreement between the Organization and its managed Properties, and has no visibility into or control over fees charged by the Organization to its Properties.
• (d) The Organization acts as the primary account holder and is responsible for all obligations under these Terms, including payment of fees, data protection compliance, and acceptable use, for all Properties and users under its account.
• (e) The Organization must ensure that all property owners whose Properties are managed through the Service are informed of and consent to the processing of their data in accordance with these Terms and the DPA in Annex A.

6. Free Tier

The Free Tier is available to properties with up to five (5) rooms and provides access to basic platform features. The following limitations apply:

• Maximum of five (5) rooms per property.
• Access to core PMS functionality (reservations, calendar, guest profiles).
• Limited access to AI-powered features and advanced analytics.
• Standard email support only (no priority support).
• Community access to knowledge base and documentation.

Free Tier accounts that remain inactive (no logins and no active reservations) for more than twelve (12) consecutive months may be suspended or deleted after thirty (30) days' written notice.

We reserve the right to modify the scope and limitations of the Free Tier with thirty (30) days' notice. If changes materially reduce Free Tier functionality, affected Customers will be given the option to upgrade or export their data before any changes take effect.

7. AI Services and Automated Features

7.1 Nature of AI Services

The Service incorporates artificial intelligence and machine learning capabilities, including but not limited to: automated guest communication suggestions, sentiment analysis, revenue optimization recommendations, competitor analysis, content generation, and smart categorization.

7.2 AI Disclaimer

7.3 No Liability for AI Outputs

We do not warrant the accuracy, reliability, or appropriateness of any AI-generated content, including but not limited to:

• Guest communication drafts and suggested replies.
• Pricing and revenue management recommendations.
• Competitor analysis and market intelligence reports.
• Sentiment scores and guest satisfaction assessments.
• Automated categorization and prioritization of messages.

You acknowledge that AI outputs may contain errors, biases, or inaccuracies. rapidbounce shall not be liable for any damages, losses, or adverse consequences resulting from reliance on AI-generated content without independent human verification.

7.4 AI and Data Usage

To provide and improve AI Features, we may process Customer Data through machine learning models. We do not use your Customer Data to train AI models that would benefit other customers, unless the data has been fully anonymized and aggregated. Your property-specific data remains confidential and is never shared in identifiable form with competing properties.

7.5 Human Oversight

Certain AI Features operate in a "draft" mode, meaning AI-generated responses are held for staff review before being sent to guests. You may configure your AI settings to require manual approval for all automated communications. We strongly recommend maintaining human oversight for all guest-facing AI communications.

8. Data Ownership and Processing

8.1 Your Data

You retain full ownership of all Customer Data uploaded to, created within, or processed through the Service. Nothing in these Terms transfers ownership of your data to rapidbounce.

8.2 License to Process

By using the Service, you grant rapidbounce a limited, non-exclusive, worldwide license to access, process, store, and display your Customer Data solely for the purposes of:

• Providing, maintaining, and improving the Service.
• Generating AI-powered insights and recommendations for your Property.
• Creating anonymized, aggregated statistics for platform improvement (your data will never be individually identifiable in such aggregations).
• Complying with applicable legal obligations.

This license terminates when you delete your Customer Data or when your account is terminated, subject to any legally required retention periods.

8.3 Data Portability

You may export your Customer Data at any time through the platform's export features (including CSV export and GDPR data export). Upon account termination, you will have thirty (30) days to export your data before it is permanently deleted from our systems, subject to applicable legal retention requirements.

8.4 Data Security

We implement industry-standard security measures to protect your Customer Data, including encryption in transit and at rest, regular security audits, and access controls. For details on our data protection practices, please refer to our Privacy Policy.

9. Intellectual Property

9.1 Platform Ownership

The Service, including all software, algorithms, user interfaces, designs, documentation, trademarks, logos, and other materials associated with Steganomos, are the exclusive property of rapidbounce and are protected by applicable intellectual property laws. These Terms do not grant you any ownership rights in the Service.

9.2 License to Use

Subject to your compliance with these Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Service for your internal business purposes related to the management of your Property or Properties.

9.3 Your Content

You retain all intellectual property rights in the content you create, upload, or provide through the Service, including property descriptions, photographs, marketing materials, and guest communications. You grant us a license to display and process such content only as necessary to provide the Service.

9.4 Feedback

If you provide us with feedback, suggestions, or ideas regarding the Service, you grant us a perpetual, irrevocable, royalty-free license to use, modify, and incorporate such feedback into the Service without any obligation to you.

10. Acceptable Use Policy

You agree to use the Service only for lawful purposes and in accordance with these Terms. You shall not:

• Use the Service for any illegal, fraudulent, or unauthorized purpose.
• Upload or transmit any malicious code, viruses, or harmful content.
• Attempt to gain unauthorized access to the Service, other accounts, or related systems.
• Scrape, crawl, or use automated tools to extract data from the Service beyond the APIs and export features we provide.
• Reverse engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Service.
• Sublicense, resell, or redistribute access to the Service without our prior written consent.
• Use the Service in a manner that could damage, disable, or impair the Service or interfere with other Customers' use.
• Misrepresent your identity or your authority to act on behalf of a Property.
• Store or transmit content that infringes on the intellectual property rights of third parties.
• Use the Service to send unsolicited bulk communications (spam) to guests or other parties.
• Circumvent or disable any security features or access controls of the Service.

Violation of this Acceptable Use Policy may result in immediate suspension or termination of your account, at our sole discretion and without prior notice.

11. Service Level Agreement

11.1 Uptime Commitment

We target a platform availability of ninety-nine point nine percent (99.9%) measured on a monthly basis ("Uptime Target"). This target represents a performance goal and is not a contractual guarantee. Failure to meet the Uptime Target does not entitle the Customer to service credits, financial compensation, or any other remedy beyond our commitment to use reasonable efforts to restore availability as quickly as possible.

Note: Under the transaction-based pricing model, periods of platform unavailability do not generate Booking Revenue and therefore do not incur fees.

11.2 Exclusions

The following are excluded from Uptime calculations:

• Scheduled maintenance windows, which will be announced at least forty-eight (48) hours in advance and, where possible, performed during low-traffic hours (02:00 - 06:00 EET).
• Downtime caused by factors outside our reasonable control, including internet outages, third-party service failures, and force majeure events.
• Outages resulting from Customer actions, including misconfiguration of integrations.
• Performance degradation caused by excessive or abusive usage patterns.

11.3 Support

We provide customer support during business hours (Monday to Friday, 09:00 to 18:00 EET, excluding Greek public holidays) via email. Pro and Property Manager tier Customers receive priority support with a target initial response time of four (4) business hours. Free Tier Customers receive standard support with a target initial response time of two (2) business days.

11.4 Incident Communication

In the event of a significant service disruption, we will notify affected Customers via email and, where available, through in-platform notifications. We will provide regular status updates until the issue is resolved.

12. Third-Party Integrations

The Service integrates with various third-party services, including but not limited to payment processors (Stripe), communication platforms (WhatsApp, Mailgun), booking channels (Booking.com), and cloud infrastructure providers (Google Cloud Platform). These integrations are subject to the following:

• Third-party services are governed by their own terms of service and privacy policies, which you are responsible for reviewing and accepting independently.
• We are not responsible for the availability, accuracy, or performance of third-party services.
• Changes to third-party APIs or services may impact feature availability, and we will work to address such changes promptly but cannot guarantee uninterrupted integration functionality.
• Your use of third-party integrations may require you to maintain separate accounts and subscriptions with those providers.

13. Termination

13.1 Termination by Customer

You may terminate your account at any time by contacting us at help@steganomos.com or through the account settings within the platform. Upon termination:

• You will remain responsible for any outstanding fees accrued prior to the termination date.
• You will have thirty (30) days from the date of termination to export your Customer Data.
• After the thirty (30) day export period, your Customer Data will be permanently deleted from our systems, except where retention is required by applicable law.

13.2 Termination by rapidbounce

We may terminate or suspend your account under the following circumstances:

• For Cause: Immediately, if you materially breach these Terms, including violations of the Acceptable Use Policy, non-payment of fees for more than forty-five (45) days, or fraudulent activity.
• For Convenience: With sixty (60) days' written notice, if we decide to discontinue the Service entirely.

In all cases of termination by us, you will be provided the thirty (30) day data export period described above.

13.3 Survival

Sections relating to Intellectual Property, Limitation of Liability, Indemnification, Governing Law, and any accrued payment obligations shall survive termination of these Terms.

14. Limitation of Liability

14.1 Cap on Liability

To the maximum extent permitted by applicable law, the total aggregate liability of rapidbounce for any and all claims arising out of or relating to these Terms or the Service shall not exceed the total fees paid by you to rapidbounce during the twelve (12) months immediately preceding the event giving rise to the claim.

For Free Tier Customers, our total aggregate liability shall not exceed fifty Euros (EUR 50).

14.2 Exclusion of Damages

To the maximum extent permitted by applicable law, rapidbounce shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to:

• Loss of profits, revenue, business, or anticipated savings.
• Loss of data or data corruption (beyond our obligation to maintain reasonable backups).
• Loss of goodwill or reputation.
• Cost of procurement of substitute services.
• Damages arising from decisions made based on AI-generated recommendations.
• Damages arising from guest dissatisfaction or complaints.

These limitations apply regardless of the theory of liability (contract, tort, negligence, strict liability, or otherwise) and even if rapidbounce has been advised of the possibility of such damages.

14.3 Disclaimer of Warranties

The Service is provided on an "as is" and "as available" basis. To the maximum extent permitted by applicable law, rapidbounce disclaims all warranties, whether express, implied, or statutory, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free operation.

We do not warrant that the Service will meet all of your requirements, that results obtained from the Service will be accurate or reliable, or that defects in the Service will be corrected within any specific timeframe.

15. Indemnification

You agree to indemnify, defend, and hold harmless rapidbounce and its officers, directors, employees, agents, and affiliates from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or relating to:

• Your use of the Service or any activity under your account.
• Your violation of these Terms or any applicable law or regulation.
• Your infringement of any intellectual property or other rights of any third party.
• Any content or data you upload, submit, or transmit through the Service.
• Your interactions with guests, suppliers, or other third parties conducted through the Service.
• Any claim by a guest or third party related to your Property or its operations.

We will promptly notify you of any such claim and will provide reasonable assistance (at your expense) in the defense of such claim. You shall not settle any claim without our prior written consent.

16. Force Majeure

Neither party shall be liable for any failure or delay in performing its obligations under these Terms where such failure or delay results from circumstances beyond the affected party's reasonable control, including but not limited to:

• Natural disasters, epidemics, or pandemics.
• Acts of war, terrorism, civil unrest, or government sanctions.
• Power outages, internet disruptions, or telecommunications failures.
• Cyberattacks, including distributed denial-of-service (DDoS) attacks.
• Changes in applicable laws, regulations, or government orders.
• Failures of third-party service providers (including cloud infrastructure providers).

The affected party shall use reasonable efforts to mitigate the impact of the force majeure event and resume performance as soon as practicable. If a force majeure event continues for more than ninety (90) days, either party may terminate these Terms with immediate effect upon written notice.

17. Privacy and Data Protection

17.1 GDPR Compliance

rapidbounce is committed to compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation - "GDPR") and applicable Greek data protection law (Law 4624/2019). In the context of the Service:

• You act as the Data Controller for guest personal data processed through your use of the Service.
• rapidbounce acts as the Data Processor, processing personal data on your behalf and in accordance with your documented instructions.

17.2 Data Processing Agreement

The Data Processing Agreement set forth in Annex A of these Terms governs the processing of personal data by rapidbounce on behalf of the Customer, in compliance with Article 28 of the GDPR. By accepting these Terms of Service, the Customer also accepts the terms of the DPA. No separate signature or request is required.

17.3 Data Location

Customer Data is stored within the European Economic Area (EEA), specifically in Google Cloud Platform data centers located in Europe (europe-west1 region). We do not transfer personal data outside the EEA without appropriate safeguards as required by the GDPR.

17.4 Data Retention

We retain Customer Data for the duration of your account and for the thirty (30) day post-termination export period. Communication data (messages) are subject to a ninety (90) day automated retention policy for GDPR compliance. Financial records are retained in accordance with applicable Greek tax legislation. For full details, please refer to our Privacy Policy.

17.5 Your Obligations

As the Data Controller for guest data, you are responsible for ensuring that your collection and use of guest personal data through the Service complies with applicable data protection laws, including obtaining necessary consents and providing required privacy notices to your guests.

18. Modifications to Terms

We reserve the right to modify these Terms at any time. If we make material changes, we will:

• Provide at least thirty (30) days' written notice via email to the address associated with your account.
• Post the updated Terms on the Service with a revised "Last updated" date.
• Where required by applicable law, seek your affirmative consent to the modified Terms.

Your continued use of the Service after the effective date of the modified Terms constitutes your acceptance of the changes. If you do not agree to the modified Terms, you must stop using the Service and may terminate your account in accordance with Section 13.

Non-material changes (such as corrections of typographical errors, clarifications, or changes to contact information) may be made without prior notice.

19. Governing Law and Jurisdiction

These Terms shall be governed by and construed in accordance with the laws of the Hellenic Republic (Greece), without regard to its conflict of law provisions.

Any disputes arising out of or relating to these Terms or the Service that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of the courts of Athens, Greece.

Notwithstanding the foregoing, nothing in these Terms shall prevent either party from seeking injunctive or other equitable relief in any court of competent jurisdiction to prevent irreparable harm.

For Customers located within the European Union, nothing in these Terms affects your rights under applicable EU consumer protection legislation, including your right to bring proceedings in the courts of your country of residence.

20. Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, severed from these Terms. The remaining provisions shall continue in full force and effect.

The failure of either party to enforce any right or provision of these Terms shall not constitute a waiver of such right or provision.

21. Entire Agreement

These Terms, together with our Privacy Policy and any other policies or agreements referenced herein, constitute the entire agreement between you and rapidbounce regarding the use of the Service. These Terms supersede all prior or contemporaneous communications, proposals, and representations, whether oral or written, relating to the Service.

No amendment or waiver of any provision of these Terms shall be effective unless made in writing and signed by an authorized representative of rapidbounce.

Any terms or conditions included in a purchase order, invoice, or similar document issued by you that conflict with or add to these Terms are expressly rejected and shall have no force or effect.

22. Contact Information

If you have any questions, concerns, or requests regarding these Terms of Service, please contact us:

Annex A: Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the Customer (Data Controller) and rapidbounce (Data Processor) and governs the processing of personal data in connection with the Steganomos platform.

A.1 Subject Matter and Duration

The subject matter of this DPA is the processing of personal data by rapidbounce on behalf of the Customer for the purpose of providing the Steganomos platform services. The duration of the processing corresponds to the duration of the Customer's use of the Service.

A.2 Categories of Data Subjects

• Guests and prospective guests of the Customer's Property or Properties.
• Employees and staff of the Customer.
• Business contacts and partners of the Customer.

A.3 Types of Personal Data

• Guest data: names, email addresses, phone numbers, nationality, passport/ID details (where provided for check-in), booking details, payment references, communication history, preferences.
• Staff data: names, email addresses, roles, access credentials.
• Financial data: invoice details, transaction references, billing addresses, VAT numbers.

A.4 Sub-Processors

The Customer authorizes the use of the following sub-processors:

A.5 Objection to New Sub-Processors

rapidbounce will notify the Customer at least thirty (30) days before engaging a new sub-processor. The Customer may object to the new sub-processor within thirty (30) days of notification by providing written notice to help@steganomos.com. If the Customer objects and rapidbounce cannot reasonably accommodate the objection, the Customer may terminate the affected Service with no penalty.

A.6 Data Deletion

Upon termination of the Service, rapidbounce will delete all Customer personal data within thirty (30) days, unless retention is required by applicable law. The Customer will have the opportunity to export their data prior to deletion as described in Section 13.1 of the Terms.

A.7 Audit Rights

The Customer has the right to audit rapidbounce's compliance with this DPA once per calendar year, with at least thirty (30) days' prior written notice. Audits shall be conducted during normal business hours and shall not unreasonably interfere with rapidbounce's operations. rapidbounce may satisfy audit requests by providing relevant certifications, audit reports, or other documentation demonstrating compliance.

A.8 Technical and Organizational Measures

rapidbounce implements the following technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR:

• Encryption at rest: All data is encrypted at rest using AES-256 encryption via Google Cloud Platform's default encryption.
• Encryption in transit: All data in transit is protected using TLS 1.2 or higher.
• Access controls: Google Cloud IAM (Identity and Access Management) with principle of least privilege. Role-based access controls (RBAC) for all platform users.
• Data location: All Customer Data is stored exclusively within the European Economic Area (EEA), specifically in Google Cloud's europe-west1 (Belgium) region.
• Regular security audits: Periodic review of access logs, security configurations, and vulnerability assessments.
• Backup and disaster recovery: Automated daily backups with point-in-time recovery capabilities. Backups are stored within the EEA.
• Incident response: Documented incident response procedures with notification to affected Customers within seventy-two (72) hours of becoming aware of a personal data breach, as required by Article 33 of the GDPR.