Last updated: 23 March 2026
Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between THE SA RMAP LTD trading as CheckinGuide ("Processor", "we", "us") and the customer ("Controller", "you") who uses CheckinGuide to manage guest verification, identity documents, security deposits, and rental agreements.
1. Definitions
Terms used in this DPA have the meanings given to them in the EU General Data Protection Regulation (GDPR) 2016/679 and the UK Data Protection Act 2018 (UK-GDPR), including but not limited to: "Personal Data", "Processing", "Controller", "Processor", "Data Subject", and "Personal Data Breach".
2. Scope & Purpose of Processing
We process personal data on your behalf solely to provide the CheckinGuide services, which include:
- Guest identity verification: collecting and reviewing identity documents (passport, driving licence, national ID) and selfie images for verification purposes
- Security deposit management: processing payment card details via Stripe to create pre-authorisation holds or captured deposits
- Rental agreement e-signatures: collecting digital signatures, IP addresses, and browser metadata as part of legally binding rental agreements
- Guest communication: sending transactional emails (verification invitations, reminders, completion confirmations) via Resend
- AI-powered document screening: analysing uploaded identity documents using AI to detect document validity, perform face matching, and extract text
3. Categories of Personal Data
| Category | Examples | Sensitivity |
|---|---|---|
| Identity information | Full name, date of birth, nationality, document number | High |
| Identity documents | Passport images, driving licence photos, national ID scans | High |
| Biometric-adjacent data | Selfie images used for face-matching against ID documents | High |
| Contact information | Email address, phone number | Standard |
| Payment tokens | Stripe payment method IDs, payment intent IDs (not raw card numbers) | Standard |
| Booking details | Check-in/out dates, property name, booking reference | Standard |
| Technical metadata | IP addresses, browser user agents, timestamps | Standard |
| Signature data | Typed or drawn digital signatures on rental agreements | Standard |
4. Data Subjects
The data subjects whose personal data is processed under this DPA include:
- Guests: individuals making bookings at the Controller's properties who complete identity verification, deposit registration, and/or rental agreement signing
- Hosts (Controllers): property managers and owners who use CheckinGuide to manage their guest verification workflows
5. Processor Obligations
CheckinGuide as Processor shall:
- Process personal data only on documented instructions from the Controller, unless required by applicable law
- Ensure that persons authorised to process personal data are bound by appropriate confidentiality obligations
- Implement appropriate technical and organisational security measures as described in Section 6
- Not engage another processor (sub-processor) without prior written authorisation from the Controller, as described in Section 7
- Assist the Controller in responding to data subject requests (Section 11)
- Assist the Controller with data protection impact assessments where required
- Delete or return all personal data upon termination of services, at the Controller's choice (Section 9)
- Make available all information necessary to demonstrate compliance and allow for audits (Section 12)
6. Security Measures
We implement the following technical and organisational measures to protect personal data:
- Encryption in transit: all data transmitted via TLS 1.2 or higher
- Encryption at rest: database encryption using AES-256
- Access controls: Row-Level Security (RLS) policies ensuring data isolation between hosts; role-based access for internal staff
- Authentication: secure authentication with email verification, password hashing (bcrypt), and session management
- ID document storage: uploaded identity documents stored in isolated, encrypted storage buckets with time-limited signed URLs (no permanent public access)
- Payment data isolation: raw card numbers never touch our servers; all payment processing handled by Stripe (PCI-DSS Level 1 certified)
- Audit logging: comprehensive audit trail of all verification events, including IP addresses, timestamps, and user agents
- Infrastructure: hosted on enterprise-grade cloud infrastructure with automated backups, redundancy, and disaster recovery
- Monitoring: automated error tracking and security monitoring with alerting
7. Sub-Processors
CheckinGuide uses the following sub-processors to deliver its services. By agreeing to this DPA, the Controller provides general written authorisation for the use of these sub-processors. We will notify the Controller of any intended changes to sub-processors, giving reasonable opportunity to object.
| Sub-Processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Stripe, Inc. | Payment processing, security deposit holds, Stripe Connect payouts | USA (EU SCCs in place) | Payment tokens, customer IDs, deposit amounts |
| Google Cloud (Gemini AI) | AI-powered identity document screening, face matching, document text extraction | USA/EU (data processing per Google Cloud DPA) | ID document images, selfie images (processed transiently, not stored by Google) |
| Supabase | Database hosting, file storage, authentication, edge functions | EU (AWS eu-west region) | All application data including guest records, ID documents, booking data |
| Resend | Transactional email delivery (verification invitations, reminders, confirmations) | USA (EU SCCs in place) | Email addresses, guest names, email content |
| PostHog | Product analytics (anonymised usage data, not guest PII) | EU (PostHog Cloud EU) | Anonymised usage events, page views (no guest personal data) |
8. International Data Transfers
Where personal data is transferred to countries outside the UK/EEA that do not benefit from an adequacy decision, we ensure appropriate safeguards are in place, including:
- EU Standard Contractual Clauses (SCCs) with Stripe and Resend
- Google Cloud Data Processing and Security Terms (covering Gemini AI processing)
- UK International Data Transfer Agreement (IDTA) addenda where applicable
9. Data Retention & Deletion
Personal data is retained as follows:
- Identity documents: retained for the duration specified by the Controller's data retention settings (default: 90 days after check-out), then permanently deleted
- Booking records: retained for 12 months after check-out for dispute resolution, then anonymised or deleted
- Rental agreement signatures: retained for the Controller's specified period (default: 12 months) for legal compliance
- Payment tokens: Stripe payment method references retained only while an active hold exists; deleted upon release/capture
- Audit logs: retained for 24 months for security and compliance purposes
- AI processing: identity document images sent to Google Gemini AI are processed transiently and not retained by Google after processing
Upon termination of the Controller's account, all personal data is deleted within 30 days, except where retention is required by law.
10. Data Breach Notification
In the event of a personal data breach, CheckinGuide shall:
- Notify the Controller without undue delay and in any event within 48 hours of becoming aware of the breach
- Provide sufficient detail to enable the Controller to fulfil its own breach notification obligations to the supervisory authority and affected data subjects
- Take immediate steps to contain the breach and mitigate its effects
- Cooperate with the Controller's investigation and remediation efforts
- Document all breaches, including facts, effects, and remedial actions taken
11. Data Subject Rights
CheckinGuide will assist the Controller in responding to data subject requests including:
- Right of access: providing copies of personal data held
- Right to rectification: correcting inaccurate data
- Right to erasure: deleting personal data ("right to be forgotten")
- Right to restriction: restricting processing in certain circumstances
- Right to data portability: providing data in a structured, machine-readable format
- Right to object: ceasing processing where the data subject objects
Requests should be directed to the Controller (property host/manager) in the first instance. CheckinGuide will respond to Controller instructions within 10 business days.
12. Audits & Compliance
CheckinGuide shall make available to the Controller all information necessary to demonstrate compliance with this DPA and applicable data protection laws. The Controller may conduct audits, including inspections, subject to reasonable notice (minimum 30 days) and during normal business hours. The scope of audits shall be limited to the processing activities relevant to the Controller's data.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits either party's liability for breaches of data protection law to the extent that such limitation is not permitted by applicable law.
14. Term & Termination
This DPA shall remain in effect for the duration of the Controller's use of CheckinGuide services. Upon termination, the obligations in Section 9 (Data Retention & Deletion) shall apply.
15. Contact
For any questions regarding this Data Processing Agreement, please contact:
- Data Controller enquiries: Contact your property host/manager directly
- Data Processor enquiries:privacy@checkinguide.com
- Company: THE SA RMAP LTD, trading as CheckinGuide
- Registered in: England & Wales
This DPA is governed by the laws of England and Wales. If you require a signed copy of this DPA for your records, please contact us at privacy@checkinguide.com.