Last updated 29 October 2026
Data processing addendum
Awrora is operated by UL CORP LTD. English is the controlling language of these documents.
This Data Processing Addendum (“DPA”) forms part of the agreement between UL CORP LTD (“Processor”) and the customer organization that uses Awrora (“Controller”) under the Terms of use. It applies when we process personal data on your behalf in the Service.
1. Roles
- Controller — your business: you decide why and how guest, staff operational, and other Customer Data are processed in your workspace.
- Processor — UL CORP LTD: we process Customer Data only to provide, maintain, and secure Awrora, and on your documented instructions (including configuration you set in the product).
- For account registration, billing identity, and our own website analytics, we act as an independent controller as described in the Privacy Policy.
2. Subject matter and duration
Subject matter: hosting and processing of Customer Data in hotel, restaurant, payments, messaging, channel, compliance, and related modules, including optional Mayday AI. Duration: for the term of your use of the Service plus deletion/return periods below.
3. Nature and purpose of processing
Storage, retrieval, transmission, display, backup, support troubleshooting, AI briefing (when enabled), channel sync you configure, and security monitoring — solely to deliver the Service you order.
4. Types of personal data and data subjects
- Data subjects — guests, booking contacts, staff users, and other individuals whose data you enter or import.
- Data types — identity and contact details, stay/booking data, messages, payment status (not full card PAN), ID/passport images where you upload them, device/technical logs tied to staff use, and similar operational records.
- Special categories (e.g. identity documents) are processed only because you choose to upload them for your lawful purposes; you must ensure a valid legal basis.
5. Controller instructions
Your instructions are: (a) process Customer Data to provide the configured Service; (b) follow settings, integrations, and exports you initiate; (c) comply with applicable law. We will inform you if an instruction appears unlawful (unless law prohibits notice).
6. Confidentiality and security
Personnel with access are under confidentiality obligations. We implement appropriate technical and organizational measures as summarized in Security.
7. Subprocessors
You authorize us to use subprocessors (hosting, storage, email, payments, AI, channel, messaging) necessary to run the Service. We remain responsible for their performance under this DPA. Material changes to core hosting regions or AI providers may be notified via product or email where feasible.
8. International transfers
Where Customer Data is transferred internationally, we use lawful transfer mechanisms (such as standard contractual clauses or equivalent) as required.
9. Assistance with data subject rights
Taking into account the nature of processing, we will assist you with reasonable requests to fulfill data subject rights (access, deletion, etc.), including in-product export tools where available. You remain responsible for verifying and responding to requests about your guests.
10. Breach notification
After becoming aware of a personal data breach affecting Customer Data, we will notify you without undue delay and provide information reasonably available to help you meet your notification duties.
11. Return and deletion
During the subscription you may export Customer Data using available tools. After termination or written request, we will delete or return Customer Data within a reasonable period, except copies retained in backups for a limited time or where law requires retention.
12. Audits
Upon reasonable written request, no more than once per year (unless a supervisory authority requires more), we will provide information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality and without exposing other customers’ data.
13. Liability and order of precedence
Liability under this DPA is subject to the limitations in the Terms. If there is a conflict about processing of Customer Data, this DPA prevails over the Terms on that topic; the Privacy Policy describes our independent controller activities.
14. Contact
DPA / privacy: Contact.