ARAVIA — Data Processing Agreement

Version: 1.0
Effective date: April 2026

1. Parties

This Data Processing Agreement (“Agreement”) is entered into between:

(1) Operator (“Controller”)
and
(2) Azornexus, Lda (“Processor”), with registered address at:
Estrada Regional N6, Ribeira Seca de Vila Franca do Campo
São Miguel, Azores, Portugal
Email: [email protected]

This Agreement forms part of the terms governing the use of the ARAVIA platform.

2. Purpose

This Agreement governs the processing of personal data by Azornexus on behalf of the Operator in connection with the ARAVIA platform.

3. Roles of the Parties

  • The Operator acts as the Data Controller
  • Azornexus acts as the Data Processor

The Operator determines the purposes and means of processing personal data.

Azornexus processes personal data only on behalf of and in accordance with the instructions of the Operator.

4. Subject Matter and Duration

This Agreement applies for the duration of the Operator’s use of the ARAVIA platform.

Processing relates to booking management, customer interaction, and platform functionality.

5. Nature and Purpose of Processing

Azornexus processes personal data to:

  • Enable booking of services
  • Manage reservations and customer data
  • Provide CRM functionality
  • Send transactional communications (e.g. booking confirmations and updates)
  • Maintain platform security and performance

6. Types of Personal Data

The Processor may process the following personal data:

  • Full name
  • Email address
  • Phone number
  • Booking details (date, time, number of participants)
  • Optional information provided by customers
  • Payment status and transaction identifiers

Azornexus does not process or store payment card details.

7. Categories of Data Subjects

  • Customers making bookings
  • Operator users (staff accounts)

8. Instructions

Azornexus shall process personal data only on documented instructions from the Operator, including those provided through the use of the platform.

9. Obligations of the Processor

Azornexus shall:

  • Process personal data only in accordance with this Agreement
  • Ensure that access to personal data is limited to authorized personnel
  • Ensure confidentiality of all processed data
  • Implement appropriate technical and organizational security measures
  • Assist the Operator in fulfilling data subject rights requests where applicable
  • Notify the Operator without undue delay in the event of a personal data breach
  • Delete or return personal data upon termination of services, unless required by law to retain it

10. Sub-processors

The Operator authorizes Azornexus to engage the following sub-processors:

  • DigitalOcean (hosting and database)
  • Cloudflare (network and security)
  • Mollie (payments)
  • Better Stack (logging and monitoring)
  • Resend (transactional email delivery)
  • ipwho.is (IP-based location lookup for user experience)

Azornexus ensures that sub-processors are subject to appropriate data protection obligations.

11. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), Azornexus ensures that appropriate safeguards are in place, including Standard Contractual Clauses where applicable.

12. Data Retention

Azornexus processes and retains personal data in accordance with the Operator’s instructions and applicable legal obligations, including:

  • Booking data: up to 10 years
  • Cancelled or incomplete bookings: up to 2 years
  • Logs: up to 3 days

13. Assistance to the Controller

Azornexus shall assist the Operator in:

  • Responding to requests from data subjects
  • Ensuring compliance with applicable data protection laws
  • Providing necessary information to demonstrate compliance

14. Security Measures

Azornexus implements appropriate technical and organizational measures, including:

  • Encrypted data transmission (HTTPS)
  • Access control and authentication mechanisms
  • Infrastructure security through trusted providers

15. Audit and Compliance

Azornexus shall make available reasonable information necessary to demonstrate compliance with this Agreement.

16. Liability

Each party is responsible for its own compliance with applicable data protection laws.

17. Governing Law

This Agreement is governed by the laws of Portugal.

18. Acceptance

By creating an account or using the ARAVIA platform, the Operator agrees to this Data Processing Agreement.