GreetScribe Data Protection Addendum
Version: 2.0
Updated: 2026-09-20
Operator: Qevinto Oy
This Addendum forms part of an Order that incorporates it. Publication of a new version does not retrospectively amend an existing signed agreement. It governs Qevinto's processing of Customer Personal Data on the Customer's behalf.
1. Parties, roles and scope
The Customer is the controller of personal data processed for its guest-assistance and hospitality purposes. Qevinto Oy (Business ID 3583823-3, Sarkakatu 3 F23, 96460 Rovaniemi, Finland) is its processor.
Customer Personal Data means personal data Qevinto processes on the Customer's behalf through the Service. GDPR terms have their meanings under Regulation (EU) 2016/679.
Qevinto is a separate controller for its own business administration, statutory records and independently determined product-development purposes described in the Privacy Policy. That independent development is not an instruction under this Addendum and is not authorised by a general right to improve the Service. The standard service arrangement does not establish joint controllership.
2. Processing schedule
| Required element | Agreed processing |
|---|---|
| Subject matter | Operation of the Customer's GreetScribe guest assistance, knowledge content, configured integrations and related support. |
| Duration | The term of the processing services, followed by return/deletion and any legally required preservation under section 10. |
| Nature | Collection, recording, storage, retrieval, inference where enabled, organisation, authorised transmission, export and deletion. |
| Purposes | Answering guest questions, providing booking assistance, operating customer-selected flows, maintaining their reliability and security, and providing support on documented instructions. |
| Data subjects | Guests, customer personnel and people whose information the Customer lawfully supplies in content or support material. |
| Data types | Messages/replies, conversation/session identifiers and events, booking preferences and dates, occupancy, selected services, optional contact-request name/email/phone, customer content, relevant technical data and integration metadata. |
| Sensitive data | Not requested for the standard service. Free text can contain it; the parties must minimise and appropriately handle incidental sensitive data. No independent development right is created over it. |
| Customer rights and duties | Determine a lawful purpose/basis, give notices, provide lawful instructions and accurate information, manage authorised users/integrations, cooperate on rights/security matters, and exercise the information, audit and return/deletion rights below. |
3. Documented instructions
Qevinto shall process Customer Personal Data only on documented Customer instructions, including for international transfers, unless Union or Member State law requires otherwise. In that case Qevinto shall inform the Customer before processing unless that law prohibits notice on important public-interest grounds.
Instructions include the Order, this Addendum and the Customer's authorised service configuration and written support directions. Qevinto shall inform the Customer immediately if an instruction, in its opinion, infringes applicable data-protection law and shall not carry out that instruction while the issue remains unresolved.
Customer Personal Data must not be used for Qevinto's independent development, advertising, sale or model training under these processor instructions. Fixing the Customer's reported service defect on its instructions is distinct from building Qevinto's separate development dataset.
4. Personnel and security
Qevinto shall ensure that persons authorised to process the data are bound by confidentiality or an appropriate statutory duty and receive access only as necessary for their work.
Taking into account the state of the art, implementation costs, processing risks and the nature of the data, Qevinto shall implement appropriate Article 32 technical and organisational measures. The Security Statement describes the implemented architecture and its limits. The measures include tenant-scoped backend authorisation, separate control/runtime database access, supported multifactor/passkey authentication, managed secret access, input/origin checks, bounded external requests and layered abuse controls.
Qevinto shall evaluate the effectiveness of its measures. No particular certification, uninterrupted availability or instantaneous backup erasure is promised by this description. Material reductions in agreed protection require appropriate notice and handling under the agreement.
5. Subprocessors
The Customer gives general written authorisation to use the customer-data subprocessors in the Subprocessor List for their stated functions.
Qevinto shall give at least 30 days' advance written notice of an intended addition or replacement, describing its function, location and any material transfer change. The Customer may object on reasonable data-protection grounds within that notice period. Website publication alone does not replace notice to the Customer's designated contact.
The parties shall work in good faith to resolve an objection through information, safeguards or a reasonable alternative. Qevinto shall not route the affected Customer Personal Data through the proposed provider while a timely objection remains unresolved. If no reasonable solution is available, either party may end the affected processing service before the change, with a proportionate refund of unused prepaid fees for that service.
Qevinto shall impose data-protection obligations on each subprocessor equivalent to the relevant obligations in this Addendum, including sufficient guarantees for appropriate measures. Qevinto remains responsible to the Customer for performance of those obligations as required by Article 28(4).
6. International transfers
Qevinto shall not transfer Customer Personal Data outside the EEA without documented authority and an applicable GDPR Chapter V mechanism. Before relying on standard contractual clauses, Qevinto shall assess whether supplementary safeguards are necessary and implement them as required.
A hosting region does not by itself establish the location of all provider support or onward processing. Qevinto shall make relevant transfer information and safeguards available on request, subject to lawful confidentiality protections. Customer-directed external integrations are documented separately from Qevinto-appointed subprocessors.
7. Assistance and rights requests
Taking into account the nature of processing, Qevinto shall assist the Customer with appropriate technical and organisational measures to respond to data-subject requests. It shall pass relevant guest requests to the Customer without undue delay and shall not decide the Customer's response unless authorised or legally required.
Qevinto shall assist with security, breach notification, data-protection impact assessments and prior consultation under Articles 32–36, considering the information available to it. A public self-service deletion button is not required for a request to be submitted; requests can be routed through contact@qevinto.com.
8. Personal-data breaches
Qevinto shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
The notification shall describe, as information becomes available, the nature of the breach, categories and approximate numbers of affected people and records, a contact point, likely consequences and measures taken or proposed. Missing information may be supplied in phases without undue further delay. Qevinto shall cooperate with the Customer's investigation and statutory notifications.
A service error or suspected security event is not necessarily a Personal Data Breach. Qevinto shall assess incidents rather than equating every technical alert with a reportable breach.
9. Information and audits
Qevinto shall make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, by the Customer or its mandated auditor.
The parties may agree reasonable notice, confidentiality, security, scheduling and non-disruption safeguards. Existing evidence and remote review should be used where sufficient. Restrictions must not defeat the statutory right, prevent a necessary incident-related audit or restrict a supervisory authority. Any reasonable charges for additional assistance or an unusually burdensome audit shall be agreed in advance and must not make the right ineffective.
10. Return, deletion and backups
At the Customer's choice, Qevinto shall return or delete Customer Personal Data after the processing services end, and delete existing copies, unless Union or Member State law requires retention. Qevinto shall disclose the legal requirement where permitted.
The Customer should request an export before ordinary retention removes the underlying records. An export request does not imply that previously expired data can be recovered. The parties shall arrange a secure return format and prompt completion of the exit instructions.
Backup copies remain protected, restricted to recovery/legal necessity and expire through their applicable rotation. They are not retained for independent development. If a backup is restored, applicable deletion instructions must be reapplied before resumed ordinary processing. Qevinto shall confirm completion and identify any remaining legally required or rotating-backup copies and their disposal basis.
11. Retention instructions
Ordinary guest conversation, session and contact-request/outbox data use a default 30-day retention clock from creation with a daily purge of eligible expired records. A configured explicit instruction or preservation restriction can change a record's treatment. A record excluded from deletion has no automatic expiry unless separately configured.
There is no universal 24-month retention rule. Qevinto shall not treat a missing expiry or a technical hold as a legal permission for indefinite storage. Longer retention needs a documented lawful instruction or legal requirement and periodic review.
Operational, account, audit and backup data have separate purposes and lifecycles described in the Privacy Policy. Provider credentials must be revoked/deleted when no longer required. Separate copies for Qevinto's independent development are outside this processor schedule and subject to the Privacy Policy's additional restrictions.
12. AI and customer-controlled integrations
Scaleway Generative APIs provides the standard AI inference path. Requests include the current question, system instructions and selected knowledge content; optional embedding retrieval also processes the text being embedded. Identifying information in that content can be transmitted. See the AI Use Policy.
Customers remain responsible for the external booking/payment systems they select and their instructions for sharing information with those systems. GreetScribe does not collect guest payment-card details or decide booking/payment acceptance.
13. Priority, changes and contact
This Addendum takes priority for Customer Personal Data processing where a general commercial provision conflicts with it. Nothing here restricts a data subject's or supervisory authority's statutory rights.
Changes to an accepted Addendum require the agreement's applicable amendment mechanism; publishing a new page alone does not replace it. Subprocessor changes follow section 5.
Contact: contact@qevinto.com. Previous published version.