Data Processing Agreement (Banaki Office)

1. Contracting parties and formation

The controller is the business that uses Banaki Office (you, the host). The processor is Kogge Digitalagentur, owner Morris Mehnert (sole proprietorship), Memellandstraße 2, 24537 Neumünster, Germany, email moin@kogge.digital, VAT ID DE305783265, operator of Banaki (banaki.app). Further details are in the Imprint.

This agreement is an annex to the Terms and Conditions for Hosts. It is formed when you accept those terms or use Banaki Office, in electronic form (Art. 28(9) GDPR). You can access and save it on banaki.app at any time.

2. Subject matter and duration

Banaki processes personal data on your behalf insofar as you use Banaki Office: the front desk with booking management, the payment links and the website booking (widget). The agreement applies for as long as you use Banaki Office. It does not apply to guest data from bookings made through the banaki.app platform, where Banaki processes data under Section 16 of the Host Terms and the Privacy Policy.

3. Nature and purpose of the processing

Banaki stores, organises and displays the data, transmits it to the parties involved in the booking (for example by email to the guest and the business) and deletes it. The purpose is to carry out the booking, payment and management of the stay for you. Banaki processes the data only for this purpose.

4. Types of data and categories of data subjects

The types of data are guest master data, contact data, stay and booking data, data from the registration form, payment data without card data, and communication with guests. Banaki does not receive card data, the guest enters it directly with Stripe.

The data subjects are guests, travelling companions, prospects in the widget and employees of your business with access to Banaki Office.

5. Instructions

Banaki processes the data only on your documented instructions. Your instructions are this agreement, your use of Banaki Office with your settings and, where necessary, a message by email to moin@kogge.digital. Banaki records instructions in Office or by email.

If Banaki considers an instruction to be unlawful, Banaki informs you without undue delay. Banaki may suspend execution until you confirm or change the instruction (Art. 28(3) third subparagraph GDPR). If Union or Member State law requires processing, Banaki informs you beforehand, unless that law prohibits it.

6. Confidentiality

Banaki obliges all persons with access to the data to maintain confidentiality, or they are subject to a statutory duty of confidentiality. The obligation continues after their work ends.

7. Technical and organisational measures

Banaki takes the measures under Art. 32 GDPR that are set out in Annex 1. Banaki develops them further and may change them as long as the level of protection does not decrease.

8. Sub-processors

You give Banaki general authorisation to use the sub-processors listed in Annex 2. Banaki binds them by contract to the same data protection obligations that apply in this agreement.

If Banaki wants to add or replace a sub-processor, Banaki announces this by email at least 30 days in advance. Within this period you may object for an important reason under data protection law. If the parties cannot agree and Banaki cannot provide the service without the new provider, you may terminate Banaki Office without notice.

Stripe is not a sub-processor. Stripe processes payment data as an independent controller on the basis of your contract with Stripe.

9. Assistance

Banaki assists you with appropriate technical and organisational measures in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection). If a data subject contacts Banaki directly, Banaki forwards the request to you and does not answer it itself.

Banaki also assists you with your obligations under Art. 32 to 36 GDPR: security of processing, notification of personal data breaches, data protection impact assessment and consultation of the supervisory authority. Banaki provides you with the necessary information for this.

10. Personal data breaches

If Banaki becomes aware of a personal data breach that affects your data, Banaki reports it to you without undue delay (Art. 33(2) GDPR). The report contains, as far as known, the nature of the breach, the data and persons affected, possible consequences and the measures taken or proposed. You, as the controller, handle the notification to the supervisory authority and the communication to the data subjects.

11. Evidence and audits

On request, Banaki gives you the information and documents you need to verify compliance with this agreement. You may also audit on site or have an auditor bound to confidentiality audit for you. You announce an audit with reasonable notice, as a rule at least 14 days in advance, and you do not disrupt Banaki's operations more than necessary. The audit does not extend to the data of other businesses. If the audit causes only little effort, each side bears its own costs. If it causes considerable effort for Banaki, you reimburse the reasonable costs. If the audit finds a breach, Banaki bears the costs.

12. Third countries

Banaki processes the data in Germany and the European Union. A transfer to a third country takes place only if the requirements of Chapter V GDPR are met. The only third country at present is the USA, to Functional Software, Inc. (Sentry) under Annex 2.

13. Deletion and return

After you stop using Banaki Office, you can export your data in Office. Banaki deletes the data 30 days after the end, unless you instruct otherwise. They disappear from the backups as soon as these are overwritten, after 30 days at the latest. Statutory retention obligations remain unaffected. Data that Banaki has to retain for this reason is blocked by Banaki and used only for that purpose.

14. Liability

Liability is governed by Art. 82 GDPR. Otherwise Section 19 of the Host Terms applies.

15. Precedence

If this agreement and the Host Terms contradict each other on data protection matters, this agreement prevails. Otherwise the Host Terms apply, including for governing law and place of jurisdiction (Section 25).

Annex 1: Technical and organisational measures

Hosting. The data is stored on servers of Hetzner Online GmbH in Germany.

Encryption. The connection between browser and server is encrypted with TLS.

Backups. Banaki backs up the database regularly. Deleted data disappears from the backups after 30 days at the latest.

Access control. Access to data runs through roles and permissions. Banaki administrators log in with a second factor.

Logging. Banaki logs access to the servers and errors of the application.

Separation. The data of the businesses is logically separated. A business sees only its own data.

Deletion concept. Banaki deletes data according to the periods in this agreement and in the Privacy Policy (Section 25 there).

Updates. Banaki keeps the operating system, software and dependencies up to date and installs security updates promptly.

Annex 2: Sub-processors

As of: 11 November 2026

This English version is a translation. In case of any discrepancy, the German version prevails.