Data Processing Agreement

Version 2026-11-08 · Last updated 8 November 2026

1. About this agreement

1.1 This Data Processing Agreement ("DPA") is between Studio Hedera, a sole proprietorship owned by IVY COMILANG VENENOSO, 5081-1 Toyoda, Iiyama-shi, Nagano, Japan ("we", "us"), and the business that uses Banto under our Terms of Service ("Customer").

1.2 This DPA forms part of the Terms of Service. It takes effect when the Customer accepts the Terms of Service (by creating its organization in Banto or by signing an order form). No separate signature is needed. If the Customer needs a signed copy, we will sign this version on request.

1.3 If documents conflict: (a) the SCCs and the UK Addendum, where they apply under clause 14, prevail over everything else; (b) on the protection of personal data, this DPA prevails over the Terms of Service; (c) on all other matters, including the service, fees, term and limits of liability, the Terms of Service prevail.

1.4 For Customers established outside Japan, the English version of this DPA is binding and prevails over the Japanese version. For Customers established in Japan, the Japanese version is binding and prevails. The SCCs and the UK Addendum apply in their official English text.

2. Definitions

2.1 "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR. Where another Data Protection Law uses equivalent terms (for example "business" and "service provider" in the CCPA, or a business handling personal information and an entrustee under the APPI), they apply in the same way.

2.2 In this DPA:

• "Customer Personal Data" means personal data that the Customer, its users or its guests put into Banto, or that Banto receives from services the Customer connects, and that we process on the Customer's behalf to provide Banto. It does not include the data in clause 3.3.
• "Data Protection Law" means the data protection laws that apply to the processing of Customer Personal Data under the Terms of Service, including, where they apply: Regulation (EU) 2016/679 ("GDPR"); the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); Japan's Act on the Protection of Personal Information ("APPI"); and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data while it is processed by us or our Sub-processors.
• "Sub-processor" means a third party we engage that processes Customer Personal Data. Services that the Customer connects or chooses itself are not Sub-processors (clause 8.6).
• "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, in force from 21 March 2022.

3. Roles

3.1 The Customer is the controller of Customer Personal Data, or a processor acting for its own controller (for example a property manager acting for property owners). We are the Customer's processor. Under the CCPA we are the Customer's service provider. Under the APPI the Customer entrusts us with the handling of personal data (Article 27(5)(i)).

3.2 Where the Customer is a processor, the Customer confirms that its controller has authorised the Customer's instructions, our appointment and our Sub-processors. The Customer is our only point of contact and passes on to its controller any information and notices under this DPA. We have no direct obligations to that controller, except under the SCCs where they apply.

3.3 We act as an independent controller, not as a processor, only for: (a) the names and contact details of the Customer's users, sign-in records, support conversations, billing and payment records, and records of how the service is used; and (b) processing of Customer Personal Data that is strictly necessary to keep Banto and its users secure (for example detecting and stopping abuse or attacks), to bill the Customer, or to comply with a law that applies to us. We handle this data under our Privacy Policy and Data Protection Law, and for no other purpose.

3.4 The Customer instructs us to create aggregated statistics about the use of Banto (for example the number of bookings handled, how often a feature is used, or response times) that do not identify any individual or the Customer. We may use these statistics to operate, secure and improve Banto. We do not try to identify anyone from them. They are not Customer Personal Data.

3.5 We do not sell Customer Personal Data, use it for advertising, or use it to build profiles of individuals for our own purposes.

4. The Customer's responsibilities

4.1 The Customer:

1. has a lawful basis for the processing, and gives guests, staff and other individuals the information that Data Protection Law requires, including where the data is stored and who our Sub-processors are. Banto shows guests a standard Guest Privacy Notice; the Customer checks that it is enough for the law that applies to the Customer and adds anything its own notices need;
2. makes sure its instructions, its settings and the services it connects comply with Data Protection Law, and obtains any consent needed, including for optional features it turns on (such as the AI passport check or automatic replies);
3. is responsible for the accuracy and quality of the data it and its users enter or connect, and collects only the data it needs. It does not put special categories of personal data (such as health or religion) into Banto unless this is necessary and lawful, for example a dietary or accessibility need that a guest shares;
4. manages its users, their roles and sign-in details, and the security of its own devices and of the services it connects;
5. carries its own legal duties as an accommodation business, such as the guest register, reports to the police or other authorities, and local taxes, and decides the retention periods its law requires (clause 12.4).

4.2 The Customer compensates us for damages, costs (including reasonable legal costs) and fines we suffer to the extent they are caused by the Customer's breach of clause 4.1.

5. Instructions

5.1 We process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to other countries, unless a law that applies to us requires otherwise. In that case we tell the Customer before the processing, unless that law prohibits it.

5.2 The Customer's instructions are the Terms of Service, this DPA, and the Customer's use and settings of Banto (including what its users do in the service and the services it connects). Any further instruction must be agreed in writing and may be subject to fees.

5.3 If we believe that an instruction breaks Data Protection Law, we tell the Customer. We do not have to follow that instruction and may suspend the affected processing until the Customer confirms or changes it. We do not give legal advice and do not have to check the Customer's instructions for lawfulness.

6. Confidentiality

6.1 Everyone we authorise to process Customer Personal Data is bound by confidentiality, by contract or by law.

6.2 We access Customer Personal Data only as needed to provide the service, fix problems, give support the Customer asks for, keep the service secure, or comply with law.

7. Security

7.1 We take the technical and organisational measures described in Annex 2, which are appropriate to the risk as required by Article 32 GDPR and Article 23 APPI.

7.2 We may change these measures over time, provided the overall level of protection does not go down.

7.3 The Customer is responsible for the security of what it controls: its users and their sign-in details, roles, devices and settings, the services it connects, and data it exports from Banto.

8. Sub-processors

8.1 The Customer gives us general written authorisation to use Sub-processors. The current list is in Annex 3.

8.2 We bind each Sub-processor by a written contract with data protection obligations that give at least the same level of protection as this DPA, as appropriate to the service it provides. We remain responsible to the Customer for our Sub-processors' performance of those obligations, as Data Protection Law requires and subject to clause 17.

8.3 We give notice at least 14 days before a new Sub-processor starts to process Customer Personal Data, by updating Annex 3 and by email to the owners of the Customer's organization. If we must replace a Sub-processor urgently (for security reasons, or because it stops providing its service), we may do so sooner and give notice as soon as we can.

8.4 Within the notice period, the Customer may object in writing on reasonable data protection grounds. We will discuss the objection in good faith and may offer an alternative, such as a setting that avoids the new Sub-processor. If we cannot resolve the objection, the Customer's only remedy is to end the affected service, or the contract, by written notice before the change takes effect, without any early termination charge. Fees already paid are not refunded except as the Terms of Service provide. If the Customer does not object within the notice period, it accepts the change.

8.5 On request, we give the Customer a copy or summary of the data protection terms of a Sub-processor contract; we may remove commercial information.

8.6 Services that the Customer connects or chooses itself, such as its booking system (PMS), channel managers and booking sites, smart locks, cleaning and operations services, and LINE, are not our Sub-processors. They receive data on the Customer's instructions under the Customer's own contracts with them, and we are not responsible for them. Features of a user's own device, such as the phone's speech recognition, are provided by the device maker under the user's own terms.

9. Requests from individuals

9.1 Banto includes tools the Customer can use to answer requests from individuals: guests can correct their details during online check-in; managers can export the guest register and erase a guest's personal data; staff can delete their own account.

9.2 If an individual contacts us directly about Customer Personal Data, we refer them to the Customer and do not answer the request ourselves, unless the law requires us to.

9.3 Where the tools are not enough, we help the Customer by appropriate technical and organisational measures, taking into account the nature of the processing. Help beyond the tools is at the Customer's reasonable cost, which we tell the Customer in advance, unless the request arises from our breach of this DPA.

10. Impact assessments and consultations

10.1 We give the Customer the information about our processing that it reasonably needs for a data protection impact assessment and for any prior consultation with a supervisory authority, mainly through this DPA, its Annexes and written answers to its questions. Further help is at the Customer's reasonable cost, which we tell the Customer in advance.

11. Personal Data Breaches

11.1 We notify the Customer without undue delay after we become aware of a Personal Data Breach.

11.2 The notice includes, as far as known at the time: the nature of the breach; the categories and approximate number of individuals and records concerned; the likely consequences; the measures taken or proposed; and a contact. We provide the rest of this information as it becomes available.

11.3 We send the notice by email to the owners of the Customer's organization and to any privacy contact the Customer has given us. The Customer keeps these addresses up to date.

11.4 We take reasonable steps to contain the breach and reduce its effects, and we help the Customer with the notifications to supervisory authorities and individuals that Data Protection Law requires of it. For the APPI, our notice is the notice an entrustee gives under the proviso to Article 26(1), so that the Customer can report to the Personal Information Protection Commission and inform individuals.

11.5 Our notice and our help are not an admission of fault or liability. The Customer decides whether to notify authorities and individuals, unless the law requires us to do so ourselves.

11.6 Unsuccessful attempts and events that do not compromise the security of Customer Personal Data, such as blocked sign-in attempts or network scans, are not Personal Data Breaches.

12. Deletion and return

12.1 During the contract, the Customer can export and delete data with the tools in Banto.

12.2 The Customer should export the data it wants to keep before the contract ends. On the Customer's written request made within 30 days after the end, we provide one export of Customer Personal Data in a common machine-readable format (such as CSV or JSON) at no charge. This is how we return the data.

12.3 Within 90 days after the contract ends, we delete Customer Personal Data from Banto, unless a law requires us to keep it; in that case we keep it only for that purpose and period, protected under this DPA. Copies in backups are deleted as the backups expire, within a further 60 days. Records kept by Sub-processors expire on their own schedules (Annex 3). On request, we confirm the deletion in writing.

12.4 During the contract, Banto deletes some data automatically after the periods listed in Annex 1. These default periods follow Japanese law. The Customer is responsible for checking that they suit the law that applies to it, and tells us if it needs a different period or a pause (for example for a legal hold).

13. Information and audits

13.1 We make available the information necessary to demonstrate compliance with this DPA and Article 28 GDPR: this DPA and its Annexes, and written answers to the Customer's reasonable questions (for example a security questionnaire). Answers are free of charge once a year; further requests are at the Customer's reasonable cost. We may also rely on certifications and audit reports of our Sub-processors, such as Google Cloud's ISO/IEC 27001 certificates and SOC 2 reports.

13.2 The Customer first uses the information under clause 13.1. An audit or inspection, including on site, by the Customer or by an independent auditor it appoints takes place only: (a) when a supervisory authority or a law requires it; (b) after a Personal Data Breach affecting Customer Personal Data; or (c) when the information under clause 13.1 is not enough to demonstrate compliance with this DPA, or there are reasonable indications of non-compliance.

13.3 Audits under clause 13.2 follow these conditions:

1. no more than once in any 12 months, except under clause 13.2(a) or (b);
2. at least 30 days' written notice, with the proposed scope;
3. during our business hours (Japan time), without unreasonable disruption of our work, and remotely where that is enough;
4. under written confidentiality; an auditor must not be our competitor;
5. limited to our processing of the Customer's data, without access to other customers' data or to our Sub-processors' facilities (which are covered by their own reports);
6. the Customer bears its own costs and pays our reasonable costs, including our time at rates we tell the Customer in advance, unless the audit shows a material breach of this DPA by us;
7. the Customer gives us a copy of the audit report.

13.4 Where the SCCs apply, audits under Clause 8.9 of the SCCs are carried out in the way set out in this clause 13.

14. Where data is processed, and international transfers

14.1 Customer Personal Data is stored in the United States (Google Cloud: the database in the US multi-region, files in us-central1, daily backups in the US). It is also processed in Japan (by us, and by server functions in Google Cloud's Tokyo region) and where our Sub-processors operate (Annex 3).

14.2 European Economic Area. We are established in Japan, which the European Commission has found to provide an adequate level of protection (Commission Implementing Decision (EU) 2019/419). For personal data we receive from the EEA under that decision, we also follow the Supplementary Rules of Japan's Personal Information Protection Commission, including their rules on onward transfers. To the extent a transfer of Customer Personal Data from the EEA to us, or through us to a Sub-processor, is not covered by an adequacy decision, the SCCs apply and are incorporated into this DPA by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. The Customer is the data exporter and we are the data importer, with the selections in Annex 4.

14.3 United Kingdom. To the extent a transfer from the United Kingdom is not covered by UK adequacy regulations, the SCCs apply as in clause 14.2, as amended by the UK Addendum, which is incorporated into this DPA by reference with the selections in Annex 4.

14.4 Switzerland. To the extent a transfer from Switzerland is not covered by a Swiss adequacy finding, the SCCs apply as in clause 14.2, with the adjustments for the FADP in Annex 4.

14.5 Onward transfers. Where a Sub-processor processes Customer Personal Data in a country without an adequacy finding, we put in place a transfer mechanism recognised by Data Protection Law, such as the SCCs or, where the Sub-processor is certified, the EU–U.S. Data Privacy Framework and its UK and Swiss extensions.

14.6 Japan. For Customers subject to the APPI: the Customer's provision of personal data to us is an entrustment under Article 27(5)(i) and does not need the individuals' consent for that reason. Where Sub-processors in other countries handle the data, we rely on each of them having a system that meets the standards of the Personal Information Protection Commission's Rules through its contract with us (Article 28(1)); we take the measures needed to ensure that this continues, including periodic checks (Article 28(3)); and we give the Customer the information it needs for its supervision of us (Article 25) and to answer individuals: the countries, information on their personal data protection systems, and the Sub-processors' measures. The countries are listed in Annex 3. The United States has no comprehensive federal data protection law; some states have their own laws.

14.7 Other countries. Where another Data Protection Law requires a transfer mechanism, the SCCs apply with the adjustments that law requires, or another mechanism we offer that the law recognises.

14.8 If a transfer mechanism is invalidated or replaced, we may switch to another valid mechanism, and the Customer will cooperate in putting it in place.

15. United States

15.1 For Customer Personal Data subject to the CCPA or similar US state privacy laws, we act as the Customer's service provider or processor. We: (a) do not sell or share it (as those laws define these words); (b) do not retain, use or disclose it for any purpose other than the business purposes in clause 15.2, or outside the direct business relationship with the Customer, except as those laws allow; (c) do not combine it with personal information we receive from others, except as those laws allow; (d) comply with the obligations those laws place on us and give it the level of privacy protection they require; and (e) tell the Customer if we can no longer meet these obligations. The Customer may take reasonable and appropriate steps, under clauses 11 and 13, to make sure we use the data in line with its obligations and to stop and remedy unauthorised use. We certify that we understand and will comply with this clause.

15.2 The business purposes are providing, maintaining, securing and supporting Banto for the Customer, as described in Annex 1.

16. Requests from public authorities

16.1 If a public authority asks us for Customer Personal Data, we refer it to the Customer where we can. If we must disclose data, we tell the Customer first unless the law prohibits it, and we disclose only what is legally required. Where the SCCs apply, we also follow Clause 15 of the SCCs.

17. Liability

17.1 Our liability under this DPA, and under the SCCs to the extent the SCCs allow, is subject to the limits in clause 10 of the Terms of Service, and all of these together form one limit: our total liability under the Terms of Service, this DPA and the SCCs is limited to the fees the Customer paid us in the 12 months before the event, and we are not liable for lost profits or indirect damage, except in cases of wilful misconduct or gross negligence.

17.2 A fine imposed on the Customer by a supervisory authority is not recoverable from us, except to the extent it was caused by our breach of this DPA, and then only within clause 17.1.

17.3 Nothing in this DPA limits liability to data subjects, or any other liability, that Data Protection Law or the SCCs do not allow to be limited.

18. Term and changes

18.1 This DPA applies for as long as we process Customer Personal Data, including after the contract ends until the deletion in clause 12.

18.2 We may change this DPA under clause 13 of the Terms of Service: we announce changes in the service at least 30 days before they take effect, unless the change is required by law or does not disadvantage the Customer. Changes to the list of Sub-processors follow clause 8. A change never lowers the protection that Data Protection Law requires, and never overrides the SCCs.

18.3 Each version of this DPA carries a version number on this page.

19. Law and court

19.1 This DPA is governed by the laws of Japan. The Nagano District Court has exclusive jurisdiction in the first instance, as in the Terms of Service.

19.2 The SCCs are governed by the law and courts chosen in Annex 4, and the UK Addendum by the laws of England and Wales. This clause does not limit the right of data subjects to bring claims before the courts or supervisory authorities that Data Protection Law gives them.

20. Contact

20.1 Notices and questions about this DPA: privacy@bantohq.com, Studio Hedera, 5081-1 Toyoda, Iiyama-shi, Nagano 389-2411, Japan.

Annex 1 — Description of the processing

Subject matter and duration

Providing Banto, the operations service for accommodations, under the Terms of Service; for the term of the contract and until deletion under clause 12.

Nature and purpose

Hosting and storing data; importing and syncing bookings from the booking system the Customer connects; online check-in and the guest register; checking identity documents (and, if the Customer turns it on, an AI check of passport images); sending and receiving guest messages and email; AI reply drafts, translation and extraction of guest requests; creating and assigning tasks; staff scheduling, attendance, team chat, journal and voice calls; door codes for connected smart locks; push notifications; support; backups; and automatic deletion.

Data subjects

Guests and their companions; the Customer's staff, managers and owners who use Banto; property owners and other contacts of the Customer; contact persons at the Customer's suppliers.

Categories of personal data

Special categories of data

None are intended. Guests may share health, accessibility or dietary information in requests or messages. Passport images are not used for face matching or other biometric identification. Safeguards: a second layer of encryption for identity documents, access limited to managers, a record of each time a passport copy is opened, automatic deletion, and the AI passport check is off unless the Customer turns it on.

Frequency

Continuous, for as long as the Customer uses Banto.

Default retention periods

Annex 2 — Technical and organisational security measures

• Encryption: all connections use TLS; data is encrypted at rest by Google Cloud; identity document images, files of past guest registers and the connection keys of connected services are encrypted a second time by the application, with a key kept separately from the data.
• Access control: each user sees only what their role allows, enforced on the server; the strictest records (identity documents, pay rates, guest registers) are limited to managers; each time a passport copy is opened it is recorded; guest links use unguessable tokens that expire and can be revoked; front-desk tablet sessions end after 30 minutes.
• Personnel: one person is responsible for the system and its access; access is given only as needed and under confidentiality.
• Availability and recovery: daily backups kept for 60 days; point-in-time recovery for 7 days; deletion protection on the database; deleted files recoverable for 7 days.
• Minimisation and deletion: automatic deletion after the periods in Annex 1; a tool to erase one guest's personal data on request.
• Monitoring and incidents: logs, health checks and alerts; a written incident procedure (contain, assess, notify, review).
• Changes: changes are reviewed and tested before release and released only through a controlled procedure.
• AI: AI providers are used through their paid business services, under terms that do not allow them to use the content to train their models; AI output is a suggestion for people to check; the AI passport check is off by default and does not do face matching.
• Facilities: we run no servers of our own; data is held in Google Cloud data centres, which hold ISO/IEC 27001 certification and SOC 2 reports.

Annex 3 — Sub-processors

List as of 8 November 2026. Changes are announced under clause 8.3.

Not Sub-processors (clause 8.6): the services the Customer connects, such as its booking system (for example Beds24 or Hostfully), smart locks (for example SwitchBot or TTLock), cleaning and operations services, and LINE. Card payments for our own fees, when offered, are handled by Stripe as a provider for our billing; Stripe does not receive Customer Personal Data.

Annex 4 — Selections for the SCCs, the UK Addendum and Switzerland

EU SCCs

• Module 2 where the Customer is a controller; Module 3 where the Customer is a processor.
• Clause 7 (docking clause): not used.
• Clause 9(a): Option 2, general written authorisation; notice period as in clause 8.3 of this DPA (at least 14 days).
• Clause 11(a): the optional independent dispute resolution body is not used.
• Clause 13 and Annex I.C: the competent supervisory authority is the one determined under Clause 13(a) for the Customer.
• Clause 17: Option 1; the law of Ireland.
• Clause 18(b): the courts of Ireland.
• Annex I.A: the data exporter is the Customer (details as in its Banto account; role: controller or processor; activities: use of Banto). The data importer is Studio Hedera (details in clause 1.1; contact privacy@bantohq.com; role: processor; activities: providing Banto). Acceptance of the Terms of Service counts as signature on the date of acceptance.
• Annex I.B is Annex 1, Annex II is Annex 2, and Annex III is Annex 3 of this DPA.
• Clauses 8.5 (deletion), 8.6(c) (breach notice) and 8.9 (audits) are carried out as in clauses 12, 11 and 13 of this DPA, to the extent consistent with the SCCs.

UK Addendum

• Table 1: the parties and their details are as in Annex I.A above; the start date is the date this DPA takes effect.
• Table 2: the Approved EU SCCs are the SCCs incorporated by this DPA, with the modules and selections above.
• Table 3: Annexes 1, 2 and 3 of this DPA.
• Table 4: the importer may end the UK Addendum as set out in its Section 19.
• Part 2 (Mandatory Clauses) of the UK Addendum applies as issued by the Information Commissioner.

Switzerland

• For transfers governed by the FADP, references to the GDPR are read as references to the FADP, and the competent supervisory authority is the Federal Data Protection and Information Commissioner.
• The term "Member State" in the SCCs does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence (Clause 18(c)).