Data processing agreement (DPA)
Updated 03.11.2026
DRAFT – under review by The Host and a lawyer. This text may change before the official launch. Questions: info@thehost.al
Parties and roles
The property owner or manager (“Controller”) and The Host (“Processor”). This agreement applies automatically when the owner creates an account and accepts the Terms.
Subject matter
The Processor processes guest data only to reply on the property’s behalf on WhatsApp and the website, to manage reservations and to prepare the e-Albania export, following the Controller’s documented instructions.
Data categories
Name, phone number, messages, booking dates, nationality and other data the guest or owner shares. Special categories of data are not requested.
Processor obligations
Staff confidentiality; technical and organisational measures (encryption in transit, hashed passwords, restricted access, door codes only for verified guests); help with data-subject requests; notification without undue delay of any security breach.
Subprocessors
Google (Gemini), Upstash, Neon, Vercel, Meta (WhatsApp). The Controller is informed before a new subprocessor is added and may object.
Retention and deletion
Data is kept while the account is active. After the account is closed it is deleted, unless the law requires retention.
Governing law
Law no. 124/2024 of the Republic of Albania and, where applicable, Regulation (EU) 2016/679 (GDPR).