Data Processing Agreement (DPA)

Annex to the Order Form between the Customer named in it and CampOne GmbH (Grondia).

Parties

This Data Processing Agreement (the “DPA”) is entered into between:

1. the party named as customer in the Order Form, with the legal form, address and register number or UID stated there (the “Customer”); and
2. CampOne GmbH, c/o Christoph Tonini, Habüelstrasse 112, 8704 Herrliberg, Switzerland, UID CHE-134.912.193, registered in the Commercial Register of the Canton of Zurich, which offers its services under the brand Grondia (“Grondia”).

The Customer and Grondia are each a “party” and together the “parties”.

Background

A. Grondia provides the Customer with the Grondia services (property management, booking engine, Hosted Websites and Booking Pages, point of sale, self check-in kiosk, Grondia Pay, channel manager, guest registration and authority reporting, AI Features and related services) under the Agreement.

B. In providing these services, Grondia processes personal data on behalf of the Customer. This DPA sets out the parties’ rights and obligations for that processing.

C. The structure of this DPA follows the standard contractual clauses between controllers and processors adopted by the European Commission in Implementing Decision (EU) 2021/915 under Art. 28(7) GDPR. This DPA is modelled on those clauses but does not adopt them word for word.

1. Definitions and interpretation

1.1 Capitalised terms that are not defined in this DPA have the meaning given in Grondia’s General Terms of Service (the “General Terms”).

1.2 In this DPA:

(a) “Applicable Data Protection Law” means all data protection laws that apply to the processing of Customer Personal Data under this DPA, in particular the Swiss Federal Act on Data Protection of 25 September 2020 (FADP) and its Ordinance (DPO), Regulation (EU) 2016/679 (GDPR) and the laws of the EU and EEA member states that supplement it, the GDPR as retained in the law of the United Kingdom (UK GDPR) and the Data Protection Act 2018, and the US State Privacy Laws defined in Annex 5, each as amended or replaced from time to time.

(b) “Customer Personal Data” means the Personal Data that Grondia processes on behalf of the Customer in providing the Services, as described in Annex 1.

(c) “controller”, “processor”, “data subject”, “processing”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR. Under the FADP, “controller” corresponds to “Verantwortlicher”, “processor” to “Auftragsbearbeiter” and “personal data breach” to “Verletzung der Datensicherheit”.

(d) “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by Grondia or a Sub-processor.

(e) “Sub-processor” means any processor engaged by Grondia that processes Customer Personal Data on behalf of Grondia in providing the Services. Grondia’s employees and individual contractors who work under Grondia’s direction are not Sub-processors.

(f) “Security Measures” means the technical and organisational measures described in Annex 2.

(g) “Restricted Transfer” means a transfer of Customer Personal Data to a country that is not recognised under the Applicable Data Protection Law as providing an adequate level of data protection, including onward transfers.

(h) “SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914, and “UK Addendum” means the International Data Transfer Addendum to those clauses issued by the UK Information Commissioner, each as described in Annex 4.

(i) “Business Day” means a day other than a Saturday, Sunday or public holiday in the Canton of Zurich.

1.3 Where the FADP or the UK GDPR applies, references in this DPA to provisions of the GDPR are to be read as references to the corresponding provisions of the FADP or the UK GDPR.

1.4 This DPA prevails over the General Terms and the Policies in all matters relating to the processing of Customer Personal Data. A provision of the Order Form prevails over this DPA only if it expressly names the provision of this DPA that it changes. Where the SCCs or the UK Addendum apply under Annex 4, they prevail over this DPA. Annex 5 prevails over the rest of this DPA for personal information governed by US State Privacy Laws.

2. Roles of the parties

2.1 Customer as controller. The Customer is the controller of the Customer Personal Data. Where the Customer processes Customer Personal Data as a processor on behalf of a third party (for example a management company that runs a campground for its owner), the Customer warrants that it is authorised by that controller to give the instructions in this DPA and to engage Grondia as its sub-processor; Grondia then acts as the Customer’s sub-processor and the Customer informs the controller of this DPA.

2.2 Grondia as processor. Grondia processes Customer Personal Data as processor on behalf of the Customer for the modules described in Annex 1.

2.3 Grondia as independent controller. Grondia processes the following Personal Data as an independent controller, under its own privacy notices and not under this DPA: data of the Customer’s contact persons, signatories and Authorised Users for contract management, billing, customer relationship management and communication; data of owners, directors, beneficial owners and signatories collected to onboard the Customer for Grondia Pay; data of visitors to Grondia’s own websites, including grondia.com; data of Grondia’s own staff; and Usage Data to the extent they do not identify a natural person. Where Usage Data identify an Authorised User or a guest (for example a user ID in a log entry), Grondia processes them as processor under this DPA for the operation and security of the Services and, where the Customer has opted in, to compute anonymous statistics under section 14. Grondia does not process Customer Personal Data as an independent controller for its own purposes (section 14.5). Where Grondia processes Personal Data contained in Customer Data to comply with a legal obligation that applies to Grondia itself, it does so as controller and only to the extent required by that obligation.

2.4 Payment institution. For Grondia Pay, the licensed payment institution named in the Payments Addendum processes payment and verification data as an independent controller under its own terms with the Customer. It is not a Sub-processor of Grondia. Grondia transmits Customer Personal Data to it on the Customer’s instruction as described in Annex 1, Module 8 and in the Payments Addendum.

2.5 Third-Party Services chosen by the Customer. Where the Customer connects a Third-Party Service to the Services (for example an accounting system, a payment service provider other than Grondia Pay, an access control or barrier system, an EV charging provider, a Channel, the Customer’s own mailbox or email server, or an authority’s reporting portal), Grondia transmits Customer Personal Data to that Third-Party Service on the Customer’s instruction. The provider of the Third-Party Service is not a Sub-processor of Grondia. The Customer is responsible for its own contract and legal basis with that provider. Grondia remains responsible for processing the data securely until it is handed over to the Third-Party Service.

3. Description of the processing

3.1 Subject matter and duration. The subject matter of the processing is the provision of the Services under the Agreement. The processing lasts for the Subscription Term and, after it ends, until the Customer Personal Data has been returned or deleted under section 15.

3.2 Nature, purposes, data and data subjects. The nature and purposes of the processing, the categories of Personal Data and the categories of data subjects are described in Annex 1, module by module.

3.3 Modules in use. Annex 1 applies to the modules that the Customer has ordered or activated. When the Customer activates or deactivates a module or a function within it, the description in Annex 1 for that module starts or stops applying accordingly.

4. Instructions

4.1 Documented instructions. Grondia processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless Grondia is required to process them by Swiss law, the law of the European Union or of an EU or EEA member state, or the law of the United Kingdom to which Grondia is subject. In that case, Grondia informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

4.2 What counts as an instruction. The Customer’s instructions are documented in (a) the Agreement and this DPA, (b) the Customer’s configuration and use of the Services, including the modules, functions, integrations and settings that the Customer or its Authorised Users activate and the actions they take in the Services, and (c) any further written instructions from a person authorised by the Customer, sent to the privacy contact in Annex 1, Part A.

4.3 Further instructions. Further instructions must be consistent with the Agreement and technically feasible within the Services. If following a further instruction requires work that goes beyond the functions of the Services, Grondia may make it subject to an agreement on effort and fees. Grondia documents further instructions it receives.

4.4 Instructions that infringe the law. Grondia informs the Customer immediately if, in its opinion, an instruction infringes Applicable Data Protection Law. Grondia may suspend the execution of that instruction until the Customer confirms or changes it in writing. Grondia is not obliged to carry out an instruction that it reasonably considers unlawful.

4.5 Responsibility for instructions. The Customer is responsible for the lawfulness of its instructions and for its configuration of the Services.

5. Obligations of the Customer

5.1 The Customer complies with its obligations as controller under Applicable Data Protection Law. In particular, the Customer:

(a) ensures that it has a legal basis for the processing of Customer Personal Data and, where required, obtains and records the consent of data subjects, for example for marketing messages, guest messaging by SMS or WhatsApp, and non-essential cookies and analytics on Hosted Websites and Booking Pages;

(b) informs data subjects about the processing as required by law, in particular by publishing a privacy notice on its Hosted Websites and Booking Pages;

(c) decides which statutory guest registration, tourist tax and statistics duties apply to it, checks the data it submits to authorities, and remains responsible for the submission even where the Services prepare or transmit it (Annex 1, Module 2);

(d) carries out any data protection impact assessment that applies to its processing, using the information that Grondia provides under section 11;

(e) enters into the Services only the Personal Data needed for its purposes, and does not enter special categories of personal data or data relating to criminal convictions except where it has a legal basis and the module is suitable for it;

(f) manages its Authorised Users, their roles and permissions, and the security settings under its control, including whether two-factor authentication is mandatory for its Authorised Users; and

(g) informs Grondia without undue delay if it detects errors or irregularities in the processing.

6. Confidentiality

6.1 Grondia grants access to Customer Personal Data only to members of its personnel who need access to provide, maintain, support or secure the Services, and only to the extent they need it. Grondia ensures that these persons have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that this obligation continues after their work for Grondia ends.

6.2 When Grondia staff access a Customer’s account in the Services for support, they use the support access function described in Annex 2, Part C, which logs each session. Grondia’s technical staff and Grondia’s AI-assisted support tooling can also read Customer Personal Data directly in the systems that run the Services where this is needed to investigate a support request, fix a defect or operate the Services (Annex 1, Part B; Annex 2, Part C).

7. Security of processing

7.1 Measures. Grondia implements and maintains at least the Security Measures described in Annex 2 to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks for the rights and freedoms of natural persons. This includes protection against a Personal Data Breach.

7.2 Changes. The Security Measures are subject to technical progress. Grondia may change them, provided that the overall level of protection is not reduced. Grondia documents material changes and makes the current version of Annex 2 available to the Customer on request.

7.3 Customer’s assessment. The Customer has reviewed the Security Measures, including the current state described in Annex 2 and the planned improvements in Annex 2, Part K, and considers them appropriate for the risks of its processing. The Customer is responsible for the security measures that are under its own control, including the protection of its Authorised Users’ credentials and devices and the configuration of user roles.

7.4 Sensitive data. The Services are not designed for special categories of personal data within the meaning of Art. 9 GDPR or sensitive personal data within the meaning of the FADP. Where the Customer nevertheless processes such data in the Services (for example health or accessibility information in free-text notes), Grondia applies the Security Measures to them, and the Customer applies any additional restrictions of access that the law requires through the permission settings of the Services.

8. Sub-processors

8.1 General authorisation. The Customer gives Grondia its general written authorisation to engage Sub-processors. The Sub-processors engaged on the date of this DPA are listed in Annex 3. Grondia provides the current list to the Customer on request.

8.2 Notice of changes. Grondia informs the Customer at least 30 days in advance of any intended addition or replacement of a Sub-processor. The notice is sent by email to the privacy contact named by the Customer in Annex 1, Part A (or, if none is named, to the Customer’s notice email address under the Order Form). The notice states the name of the Sub-processor, the service it provides, the Customer Personal Data concerned, the processing location and the transfer mechanism.

8.3 Objection. The Customer may object to an intended change in writing within 30 days after receiving the notice, on reasonable grounds relating to data protection. The parties then discuss the objection in good faith. Grondia may propose a reasonable alternative, for example not using the new Sub-processor for the Customer’s data or a change in configuration.

8.4 Remedy. If the parties do not agree on a solution within 30 days of good-faith discussion after the objection, the Customer may terminate the affected Services, or the Agreement if the affected Services cannot reasonably be separated, by written notice given within a further 30 days, with effect on the date stated in the notice. Grondia refunds prepaid Fees for the terminated Services for the period after the date on which the new Sub-processor began to process Customer Personal Data or, if later, the date on which the objection was received. No termination charge applies. This termination right is the Customer’s sole remedy for an objection to a Sub-processor.

8.5 Urgent replacement. If Grondia must replace a Sub-processor at short notice to protect the security or availability of the Services (for example because a Sub-processor ceases to provide its service or suffers a security incident), Grondia may engage the replacement before the end of the notice period. Grondia then informs the Customer as soon as possible, and sections 8.3 and 8.4 apply from the date of that notice.

8.6 Contracts with Sub-processors. Grondia engages each Sub-processor by a written contract that imposes on it the same data protection obligations as those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Grondia selects Sub-processors with care and checks their guarantees before engaging them. At the Customer’s request, Grondia provides a copy of the data protection terms of a Sub-processor contract; Grondia may redact commercial information and may refer to the terms the Sub-processor publishes.

8.7 Liability. Grondia remains fully liable to the Customer for the performance of each Sub-processor’s data protection obligations, within the limits of section 16.

8.8 Disappearance of Grondia. Where possible on commercially reasonable terms, Grondia agrees with its Sub-processors that, if Grondia has factually disappeared, ceased to exist in law or become insolvent, the Customer may require the Sub-processor to return or delete the Customer Personal Data.

8.9 Third-Party Services. Section 8 does not apply to Third-Party Services chosen by the Customer (section 2.5) or to the payment institution (section 2.4).

9. International transfers

9.1 Locations. On the date of this DPA, Grondia’s core database, backups and application servers are located in Switzerland. Customer Personal Data are also processed in the EEA, the United Kingdom and the United States by the Sub-processors stated in Annex 3. Grondia does not promise processing only in Switzerland; changes of location are notified under section 8. In particular, website content and website form submissions are stored in the website content management system hosted by a Sub-processor outside Switzerland, and delivery and edge providers process connection data and data in transit worldwide.

9.2 Instruction and safeguards. The Customer instructs Grondia to transfer Customer Personal Data to the Sub-processors and locations listed in Annex 3. Grondia transfers Customer Personal Data to a third country only in accordance with Chapter V GDPR, Art. 16 and 17 FADP and Chapter V UK GDPR, as applicable. Annex 4 sets out the transfer mechanisms.

9.3 Change of the legal framework. If a transfer mechanism on which Grondia relies is invalidated or no longer suffices, Grondia relies on an alternative mechanism that is available under Annex 4 and informs the Customer within 30 days. If no alternative mechanism is available, Grondia suspends the affected transfer or the Customer may terminate the affected Services under section 8.4.

9.4 Requests from public authorities. If a public authority requests access to Customer Personal Data, Grondia (a) does not disclose Customer Personal Data unless it is legally compelled to do so, (b) informs the Customer of the request without delay, unless the law prohibits this, (c) reviews the legality of the request and challenges it where there are reasonable grounds to consider it unlawful, (d) discloses only the minimum amount of data required, and (e) documents the request and its response. Section 4.1 applies to disclosures required by law.

10. Assistance with data subject requests

10.1 Taking into account the nature of the processing, Grondia assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer’s obligation to respond to requests from data subjects to exercise their rights under Applicable Data Protection Law (in particular access, rectification, erasure, restriction, data portability and objection).

10.2 The Services contain functions that allow the Customer to find, correct, export and erase Customer Personal Data, including a function to erase a guest’s personal data in bookings and guest profiles on request. This erasure function does not yet cover guest registration and self check-in records (Annex 2, Part K). Where a request cannot be fulfilled with these functions (for example an export of the data of a guest who has no guest account, or the erasure of guest registration and self check-in records), Grondia provides the relevant data to the Customer, or carries out the erasure, within 10 Business Days after a written request.

10.3 If Grondia receives a request directly from a data subject in relation to Customer Personal Data, it does not answer it except to refer the data subject to the Customer, and it forwards the request to the Customer within 2 Business Days, unless the Customer has authorised Grondia to answer such requests.

10.4 Assistance through the standard functions of the Services and under sections 10.2 and 10.3 is included in the Fees. Grondia may charge reasonable fees at the rates in the Order Form for further assistance that requires substantial manual work, unless the request results from a breach of this DPA by Grondia.

11. Assistance with security, impact assessments and authorities

11.1 Taking into account the nature of the processing and the information available to it, Grondia assists the Customer in ensuring compliance with its obligations regarding the security of processing, the notification of Personal Data Breaches, data protection impact assessments and prior consultation of supervisory authorities (Art. 32 to 36 GDPR; Art. 8, 22, 23 and 24 FADP). In particular, Grondia provides the module descriptions in Annex 1, the Security Measures in Annex 2 and, on request, information that the Customer needs for an impact assessment of the guest registration, kiosk identity document and AI modules.

11.2 Grondia keeps a record of the categories of processing activities it carries out on behalf of its customers where Applicable Data Protection Law requires it.

11.3 Grondia cooperates, on request, with a supervisory authority in the performance of its tasks. Assistance under this section 11 is included in the Fees as far as it consists of providing existing documentation; section 10.4 applies to further work.

12. Personal Data Breach

12.1 Notice. Grondia notifies the Customer without undue delay after becoming aware of a Personal Data Breach. Grondia aims to give this notice within 48 hours after becoming aware of the breach.

12.2 Content. The notice contains, to the extent available: (a) a description of the nature of the breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of records concerned; (b) the name and contact details of a contact point at Grondia; (c) the likely consequences of the breach; and (d) the measures taken or proposed by Grondia to address the breach and mitigate its possible adverse effects. Where it is not possible to provide all information at the same time, Grondia provides it in phases without undue further delay.

12.3 Response. Grondia takes reasonable steps to contain, investigate and remedy the breach and to mitigate its effects, and documents each Personal Data Breach, including the facts, its effects and the remedial action taken.

12.4 Notifications by the Customer. The Customer is responsible for notifying supervisory authorities and data subjects where Applicable Data Protection Law requires it. Grondia assists the Customer with the information available to it. Grondia does not notify supervisory authorities or data subjects of a breach affecting Customer Personal Data on the Customer’s behalf without the Customer’s prior consent, unless Grondia is itself legally obliged to do so.

12.5 Channel. Grondia sends notices to the privacy contact named in Annex 1, Part A by email and, where possible, also shows them in the Services. A notice is not an acknowledgement of fault or liability.

12.6 Incidents on the Customer’s side. If a security incident originates in the Customer’s area of responsibility (for example compromised credentials of an Authorised User), Grondia assists the Customer on request; section 10.4 applies to the costs.

13. Information and audits

13.1 Principle. Grondia makes available to the Customer all information necessary to demonstrate compliance with its obligations under Art. 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or by an auditor mandated by the Customer, in accordance with this section 13.

13.2 Documents and questionnaires first. The Customer first relies on (a) this DPA and its Annexes, (b) the documentation Grondia makes available on request, such as summaries of security assessments and penetration tests, and certifications and reports of Sub-processors, and (c) written answers to a reasonable security or data protection questionnaire, which Grondia answers within 30 days. The Customer may send a questionnaire once per Contract Year and, in addition, after a Personal Data Breach.

13.3 On-site or remote audits. If the information under section 13.2 is not sufficient to demonstrate compliance, if a supervisory authority requires it, or after a Personal Data Breach, the Customer may carry out an audit, including an inspection, under the following conditions: (a) no more than once in any period of 12 months, except where a supervisory authority requires it or after a Personal Data Breach; (b) with at least 30 days’ written notice that describes the scope of the audit; (c) during normal business hours, for no more than 2 Business Days, and without unreasonable disruption of Grondia’s operations; (d) by the Customer or by an independent auditor who is bound by confidentiality and is not a competitor of Grondia; and (e) without access to the data of other customers or to information that is subject to confidentiality obligations of Grondia towards third parties. Audits of Sub-processors are carried out by means of their audit reports and certifications, unless the Sub-processor permits otherwise.

13.4 Costs. Each party bears its own costs of an audit. For an on-site or remote audit under section 13.3, the Customer also reimburses Grondia’s reasonable costs at the rates in the Order Form, unless the audit reveals a material breach of this DPA by Grondia.

13.5 Supervisory authorities. Section 13.3(a) and section 13.4 do not limit audits by a competent supervisory authority.

13.6 Results. Grondia remedies non-compliance identified in an audit within a reasonable period. The audit report is Confidential Information of Grondia.

14. Anonymous statistics on the Customer’s instruction

14.1 Opt-in in the Order Form. If the Customer opts in to benchmarks and product analytics in the Order Form, the Customer instructs Grondia, as its processor, to compute anonymous aggregate statistics from the Customer Personal Data for the following purposes only (the “Statistics Purposes”): (a) product analytics, that is, statistics on how the Services are used; and (b) benchmarks across campgrounds, that is, statistics that compare the Customer’s figures with anonymous aggregates of other campgrounds that have also opted in. This opt-in is a documented instruction under section 4. Without an opt-in in the Order Form, Grondia computes no such statistics from the Customer’s data. The Customer may withdraw its opt-in at any time in writing or in the settings of the Services, with effect for future computations; Grondia then stops including the Customer’s data in new computations within 30 days.

14.2 Only anonymous aggregates are kept. Grondia computes the statistics within the Customer’s data and keeps only the aggregate results, which identify no natural person (section 14.8). Benchmarks that are shown to other customers or published combine data from at least 5 campgrounds and never show figures of an identifiable campground. Grondia limits the data used to what each purpose requires and restricts access to the persons who carry out the computation.

14.3 Limits. Grondia does not (a) sell or rent Customer Personal Data or the results; (b) use them for advertising, including advertising of Grondia’s own products to Guests; (c) disclose Customer Personal Data to third parties for the Statistics Purposes (Sub-processors engaged under section 8 are not third parties); (d) build profiles of Guests across customers, or link data about the same Guest received from different customers; (e) use them to train, retrain or fine-tune AI models, whether Grondia’s own models or those of third parties; or (f) use them to take decisions about individual Guests or Authorised Users.

14.4 Excluded data. Grondia never uses for the Statistics Purposes: guest registration data and identity document data, wherever they are stored, including copies in guest profiles (Annex 1, Modules 1, 2 and 3); payment data (tokens, shopper references, card brand and last four digits, IBAN and other bank details); names, email addresses, phone numbers, postal addresses, dates of birth, licence plates, access codes and credentials; the content of messages, call audio, transcripts and free-text notes; IP addresses beyond transient use; and special categories of personal data.

14.5 No use for Grondia’s own purposes. Grondia does not use Customer Personal Data for its own purposes as an independent controller. Any such use would require a written amendment to this DPA for a specific purpose, signed by both parties.

14.6 Retention. Working extracts prepared for a computation are deleted when the computation is complete and at the latest after 30 days. Anonymous aggregate results contain no Personal Data and may be kept without time limit. Section 15 applies to the Customer Personal Data.

14.7 Information of Guests and Authorised Users. The Customer decides whether and how its privacy notices mention the statistics. The Security Measures in Annex 2 apply to the computation.

14.8 Anonymised data. Data that are anonymised to the standard of Recital 26 GDPR, so that no person can be identified from them by means reasonably likely to be used, are not Personal Data. Pseudonymised data are not anonymised. Grondia does not attempt to re-identify anonymised data.

14.9 US State Privacy Laws. For Customer Personal Information governed by a US State Privacy Law, Annex 5 applies to the Statistics Purposes and prevails over this section 14.

15. Return and deletion

15.1 During the Subscription Term. The Customer can export Customer Personal Data at any time in a structured, commonly used and machine-readable format through the export functions of the Services, or by request under the General Terms. The Customer can delete Customer Personal Data at any time through the functions of the Services, subject to section 10.2. The Services contain a function for automatic anonymisation after a retention period set by the Customer; this function is currently switched off (Annex 1, Module 1; Annex 2, Part K).

15.2 After the end of the Agreement. After the end of the Agreement, the Customer can export Customer Personal Data during the Export Period of 30 days under the General Terms. Grondia deletes or anonymises the Customer Personal Data within 30 days after the end of the Export Period, unless Swiss law, the law of the European Union or of an EU or EEA member state, or the law of the United Kingdom requires Grondia to store them. Backups that contain Customer Personal Data age out and are overwritten or deleted in the normal backup cycle within 90 days after deletion.

15.3 Earlier deletion. The Customer may instruct Grondia in writing to delete Customer Personal Data before the end of the Export Period.

15.4 Data that must be retained. Where Grondia must retain Customer Personal Data by law, it restricts their processing to the purpose of that obligation, keeps them confidential, and deletes them when the obligation ends.

15.5 Restored backups. If Grondia has to restore a backup that contains Customer Personal Data that were deleted before, it deletes them again without undue delay.

15.6 Confirmation. Grondia confirms the deletion to the Customer in writing on request.

15.7 Switching. For EU Customers, the Exit and Switching Annex governs the switching process and prevails over this section 15 to the extent of any conflict.

16. Liability

16.1 Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the General Terms, including the same liability cap. No separate or higher cap applies to breaches of data protection obligations.

16.2 Section 16.1 does not limit either party’s liability to data subjects under Art. 82 GDPR or under the third-party beneficiary rights of the SCCs. Under Art. 82(2) GDPR, Grondia as processor is liable for damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to the lawful instructions of the Customer.

16.3 Where both parties are liable to a data subject for the same damage, each party bears, in their internal relationship, the part of the compensation that corresponds to its share of responsibility for the damage.

17. US State Privacy Laws

Where Customer Personal Data include personal information of consumers who are residents of a US state with a US State Privacy Law, Annex 5 applies in addition to this DPA.

18. Term, suspension and termination

18.1 This DPA takes effect when the Order Form is signed and remains in force for as long as Grondia processes Customer Personal Data.

18.2 This DPA ends with the Agreement. The obligations that by their nature apply after the end of the Agreement, in particular sections 6, 9.4, 12, 13, 15 and 16, continue to apply until the Customer Personal Data have been deleted or returned.

18.3 If Grondia breaches its obligations under this DPA, the Customer may instruct Grondia to suspend the affected processing until Grondia complies again. If Grondia does not restore compliance within a reasonable period, and in any case within one month after the suspension, the Customer may terminate the affected Services by written notice. Section 8.4 applies to the refund of prepaid Fees.

18.4 Grondia may terminate the affected Services if the Customer insists on an instruction that infringes Applicable Data Protection Law after Grondia has informed it under section 4.4.

19. Governing law and jurisdiction

19.1 This DPA is governed by the substantive law of Switzerland, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods.

19.2 The exclusive place of jurisdiction for all disputes arising from or in connection with this DPA is the City of Zurich, Switzerland.

19.3 Sections 19.1 and 19.2 do not apply where the SCCs, the Swiss adaptations or the UK Addendum under Annex 4 provide otherwise, and they do not restrict the rights of data subjects under Applicable Data Protection Law.

20. Final provisions

20.1 Amendments. Amendments to this DPA must be made in writing. Grondia may amend this DPA with 30 days’ written notice to the extent required to comply with changes in Applicable Data Protection Law or with a decision of a competent supervisory authority or court. If such an amendment materially reduces the Customer’s rights, the Customer may terminate the affected Services under section 8.4 before the amendment takes effect.

20.2 Notices. Notices under this DPA are sent to the privacy contacts in Annex 1, Part A. Each party informs the other of changes to its contacts.

20.3 Severability. If a provision of this DPA is invalid or unenforceable, the remaining provisions remain in force. The parties replace the invalid provision with a valid provision that comes as close as possible to its purpose. Where Applicable Data Protection Law requires a provision that this DPA lacks, that provision applies as if it were included.

20.4 Language. If the English and the German versions of this DPA differ, the English version prevails.

20.5 Signature. This DPA may be signed electronically, including as part of the Order Form.

Signatures

CampOne GmbH is bound only by the signatures of both persons named above for it, who each have collective signature by two under the entry in the Commercial Register of the Canton of Zurich. The second Customer column is used where the Customer’s register entry or articles require two signatures.

Annex 1: Description of the processing

Part A: Parties and contacts

Part B: General description

Categories of data subjects (all modules). Guests of the Customer (people who book, stay, register, buy or communicate, including accompanying persons and children), people who send enquiries, holders of seasonal or annual pitch contracts and their co-users, visitors of Hosted Websites and Booking Pages, the Customer’s Authorised Users (employees, board members, volunteers, contractors), and callers to the Customer’s phone concierge where activated.

Frequency. Continuous, for the Subscription Term.

Storage location. Core database, file storage, backups and application servers in Switzerland. Other locations only as set out for each Sub-processor in Annex 3.

Support. When the Customer or its Authorised Users send support requests, including screenshots and documents, Grondia processes the Customer Personal Data contained in them to answer the request and fix defects. To investigate a request, Grondia’s support staff and Grondia’s AI-assisted support tooling may also read the Customer’s data in the Services, including guest data. The support Sub-processors are listed in Annex 3 (Google, Linear and Anthropic). Authorised Users should hide guest data in screenshots where it is not needed for the request.

Anonymous statistics (only on opt-in in the Order Form). Where the Customer has opted in, Grondia computes anonymous aggregate statistics from the Customer Personal Data for product analytics and benchmarks across campgrounds, as its processor and on its instruction (section 14). Only anonymous aggregates are kept; benchmarks combine at least 5 campgrounds; the data are not sold, not used for advertising, not disclosed to third parties, not combined into profiles of Guests across customers and not used to train AI models. Guest registration and identity document data, payment data, contact data, message content, free-text notes and special categories of personal data are excluded (section 14.4). Grondia does not use Customer Personal Data for its own purposes as an independent controller (section 14.5).

Retention in general. The Customer decides how long Customer Personal Data are kept, within the functions of the Services and its legal duties. At the end of the Agreement, section 15 applies.

Part C: Description per module

Module 1: Bookings, guest profiles and guest communications

Module 2: Guest registration and authority reporting

The following table is informational. It describes duties that the Services are designed to support. The Customer remains responsible for determining which duties apply to it, in particular under cantonal, regional and municipal law, and for checking which functions the Services offer for its country.

Module 3: Kiosk and self check-in, identity document extraction

Module 4: Accounts of the Customer’s staff

Module 5: Hosted Websites, Booking Pages, cookies and analytics

Module 6: Channel manager and synchronisation with Channels

Module 7: AI Features

Module 8: Payment metadata

Module 9: Point of sale and fiscal signing

Annex 2: Technical and organisational measures

Annex 2 describes Grondia’s technical and organisational measures, including measures that are planned and not yet in place. It forms part of this DPA as attached to the Order Form. Grondia does not publish it on its website for security reasons and provides it to customers and prospective customers on request to hello@grondia.com.

Annex 3: Sub-processors

Part A: Sub-processors engaged on the date of this DPA

The Customer authorises the following Sub-processors (section 8.1). “Only if activated” means that the Sub-processor receives Customer Personal Data only when the Customer uses the module or function concerned. Transfer mechanisms are explained in Annex 4. “DPF” means the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, to the extent the Sub-processor is certified for them.

Part B: Recipients that are not Sub-processors

For transparency, Grondia lists recipients that receive Customer Personal Data but are not Sub-processors, and providers that do not receive Customer Personal Data.

Annex 4: International transfers

1. Overview

2. SCCs between the Customer and Grondia (fallback)

2.1 Incorporation. If and as long as a transfer of Customer Personal Data from the Customer to Grondia is a Restricted Transfer under the GDPR (for example because the adequacy decision for Switzerland is withdrawn or suspended), the SCCs are incorporated into this DPA by reference and apply as follows:

(a) Module 2 (controller to processor) where the Customer is a controller; (b) Module 3 (processor to processor) where the Customer is a processor (section 2.1 of the DPA).

The Customer is the data exporter and Grondia the data importer.

2.2 Options chosen.

2.3 Annexes of the SCCs. Annex I.A (list of parties) is completed with Annex 1, Part A of this DPA; Annex I.B (description of the transfer) with Annex 1, Parts B and C; Annex I.C (competent supervisory authority) with section 2.2 above; Annex II (technical and organisational measures) with Annex 2; Annex III (list of sub-processors) with Annex 3.

2.4 Relationship to this DPA. The SCCs prevail over this DPA where they conflict. The provisions of this DPA on audits (section 13), sub-processors (section 8), deletion (section 15) and liability (section 16) describe how the parties perform the corresponding clauses of the SCCs and do not restrict the rights of data subjects or the powers of supervisory authorities under the SCCs.

3. Transfers by Grondia to Sub-processors

3.1 Primary mechanism. For each Sub-processor outside Switzerland and the EEA, Grondia concludes the SCCs (Module 3, processor to processor), with the Swiss adaptations under section 4 and the UK Addendum under section 5, unless an adequacy decision covers the transfer. Where a Sub-processor in the United States is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), the UK Extension to it or the Swiss-US Data Privacy Framework (on which the United States is listed as adequate for certified organisations in Annex 1 of the Swiss Data Protection Ordinance since 15 September 2024), Grondia also relies on that certification, to the extent the certification covers the transfer.

3.2 Data Privacy Framework appeal. The EU-US Data Privacy Framework was upheld by the General Court of the European Union on 3 September 2025 (Case T-553/23, Latombe v Commission). An appeal is pending before the Court of Justice (Case C-703/25 P). Grondia therefore does not rely on the Data Privacy Framework alone and keeps the SCCs in place for every US Sub-processor, so that transfers can continue under the SCCs if the Data Privacy Framework is annulled or suspended. In that case, Grondia reviews its transfer impact assessments within 30 days and informs the Customer under section 9.3 of the DPA.

3.3 Transfer impact assessment. For each Restricted Transfer to a Sub-processor, Grondia assesses the laws and practices of the destination country, the nature of the data and the supplementary measures (in particular encryption in transit, data minimisation and, for AI and messaging providers, the limitation to the data needed for the function). Grondia is completing these assessments in writing (Annex 2, Part K) and makes a summary available to the Customer on request once they are completed.

3.4 Onward transfers. Grondia requires each Sub-processor to make onward transfers only under a mechanism that is recognised under Applicable Data Protection Law.

4. Swiss adaptations

Where a transfer is subject to the FADP, the SCCs are standard data protection clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) within the meaning of Art. 16(2)(d) FADP and apply with the following adaptations, in line with the FDPIC’s guidance of 27 August 2021 as last amended on 12 February 2025:

(a) the FDPIC is the competent supervisory authority under Clause 13 insofar as the transfer is governed by the FADP; where the transfer is governed by both the FADP and the GDPR, the supervision under Clause 13 applies in parallel;

(b) for transfers governed only by the FADP, the governing law under Clause 17 is Swiss law and the courts under Clause 18(b) are the courts of the City of Zurich; for transfers governed by both laws, section 2.2 applies;

(c) the term “member state” in the SCCs is not to be interpreted in a way that excludes data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c), and the Swiss courts are an alternative place of jurisdiction for such data subjects;

(d) references to the GDPR are to be understood as references to the FADP insofar as the transfer is governed by the FADP.

5. UK Addendum

5.1 Where a transfer is subject to the UK GDPR and is a Restricted Transfer, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued under section 119A(1) of the Data Protection Act 2018 and in force since 21 March 2022 (the “UK Addendum”), or any version that replaces it, applies and is incorporated by reference, completed as follows:

5.2 The Mandatory Clauses of the UK Addendum (Part 2) apply. Where the transfer is to a Sub-processor in the United States that participates in the UK Extension to the Data Privacy Framework, Grondia may also rely on the Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028, in force since 12 October 2023).

5.3 The Data (Use and Access) Act 2025 replaced the transfer rules of the UK GDPR with a “data protection test” (Art. 44A to 49A UK GDPR, in force since 5 February 2026). The UK regulator’s guidance states that the current versions of the International Data Transfer Agreement and the Addendum continue to be used. Grondia will adopt an updated version issued by the UK regulator when it applies.

6. Non-personal data and government access

Grondia provides information on its measures against unlawful international governmental access to non-personal data under Art. 28(1) of the EU Data Act as set out in the General Terms. Section 9.4 of the DPA applies to requests for Customer Personal Data.

Annex 5: US state privacy terms

1. Scope and definitions

1.1 This Annex applies where Customer Personal Data include personal information or personal data of consumers who are residents of a US state that has a comprehensive consumer privacy law that applies to the Customer (each a “US State Privacy Law”), including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq., the “CCPA”) and its regulations (Cal. Code Regs. tit. 11, 7000 et seq., the “CCPA Regulations”).

1.2 Terms used in this Annex such as “business”, “service provider”, “contractor”, “consumer”, “personal information”, “sell”, “share”, “business purpose”, “deidentified”, “controller” and “processor” have the meanings given in the applicable US State Privacy Law. “Customer Personal Information” means the Customer Personal Data that are personal information or personal data under a US State Privacy Law.

1.3 This Annex prevails over the rest of the DPA for Customer Personal Information. Where the rest of the DPA gives consumers or the Customer more protection, it continues to apply.

2. California: service provider terms

2.1 Role. The Customer is a business and Grondia is a service provider within the meaning of Cal. Civ. Code 1798.140(ag). The Customer discloses Customer Personal Information to Grondia only for the limited and specified business purposes described in section 2.2.

2.2 Business purposes. Grondia processes Customer Personal Information only for the following business purposes: providing the Services described in the Agreement and Annex 1 (including hosting, storage, booking and payment administration, communication with guests on the Customer’s behalf, guest registration and authority reporting, and AI Features activated by the Customer); maintaining and improving the quality and security of the Services, including detecting security incidents and protecting against malicious, deceptive, fraudulent or illegal activity; debugging to identify and repair errors; and creating deidentified or aggregated data. For the Statistics Purposes in section 14 of the DPA (only where the Customer has opted in), Grondia uses Customer Personal Information only internally to compute deidentified or aggregate consumer information on the Customer’s instruction, and not to perform services for another person; cross-campground benchmarks use deidentified or aggregate consumer information only, and Grondia does not combine Customer Personal Information with personal information received from other customers for them.

2.3 Restrictions. Grondia:

(a) does not sell or share Customer Personal Information;

(b) does not retain, use or disclose Customer Personal Information for any purpose other than the business purposes specified in section 2.2, including for any commercial purpose other than those business purposes, unless the CCPA and the CCPA Regulations expressly permit it;

(c) does not retain, use or disclose Customer Personal Information outside the direct business relationship between Grondia and the Customer;

(d) does not combine Customer Personal Information with personal information that it receives from or on behalf of another person, or collects from its own interaction with the consumer, except as permitted by the CCPA and the CCPA Regulations;

(e) does not use Customer Personal Information for cross-context behavioural advertising.

2.4 Compliance and level of protection. Grondia complies with the obligations that apply to it as a service provider under the CCPA and the CCPA Regulations and provides the same level of privacy protection as the CCPA requires of businesses, including by cooperating with the Customer in responding to and complying with consumer requests made under the CCPA (section 10 of the DPA), by implementing reasonable security procedures and practices appropriate to the nature of the personal information (Annex 2) to protect it from unauthorised or illegal access, destruction, use, modification or disclosure, and by providing the information and assistance the Customer reasonably needs for any cybersecurity audit, risk assessment or requirement on automated decision-making technology that the CCPA Regulations impose on the Customer.

2.5 Customer’s rights to ensure compliance. The Customer may take reasonable and appropriate steps to ensure that Grondia uses Customer Personal Information in a manner consistent with the Customer’s obligations under the CCPA, including through the information and audit rights in section 13 of the DPA and through a questionnaire, review or assessment at least once every 12 months.

2.6 Notice of inability to comply. Grondia notifies the Customer no later than 5 business days after it determines that it can no longer meet its obligations under the CCPA or the CCPA Regulations.

2.7 Remediation. Upon notice, including a notice under section 2.6, the Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Information, including by instructing Grondia to suspend the processing concerned (section 18.3 of the DPA).

2.8 Consumer requests. The Customer informs Grondia of any consumer request made under the CCPA that Grondia must comply with, and provides the information Grondia needs to comply with it. Grondia complies with such requests within the functions of the Services and section 10 of the DPA.

2.9 Subcontractors. Grondia notifies the Customer of each Sub-processor that processes Customer Personal Information (Annex 3 and section 8 of the DPA) and binds each of them by a written contract that imposes the same restrictions as this section 2.

2.10 Deidentified data. Where Grondia receives or creates deidentified data from Customer Personal Information, Grondia (a) takes reasonable measures to ensure that the data cannot be associated with a consumer or household, (b) publicly commits to maintain and use the data only in deidentified form and not to attempt to reidentify them, except to test its deidentification processes, and (c) contractually obliges any recipient to comply with these requirements.

2.11 Certification. Grondia certifies that it understands the restrictions in this section 2 and will comply with them.

3. Other US states: processor terms

3.1 Role. Under the US State Privacy Laws of states other than California (for example Virginia, Colorado, Connecticut, Utah, Texas and Oregon), the Customer is a controller and Grondia is a processor.

3.2 Processor duties. Grondia:

(a) processes Customer Personal Information only on the Customer’s documented instructions (section 4 of the DPA), which set out the nature and purpose of the processing, the type of data and the duration of the processing (Annex 1);

(b) ensures that each person processing Customer Personal Information is subject to a duty of confidentiality (section 6 of the DPA);

(c) engages a subcontractor only under a written contract that requires the subcontractor to meet the obligations of Grondia with respect to the personal data, after giving the Customer an opportunity to object (section 8 of the DPA);

(d) at the Customer’s direction, deletes or returns all Customer Personal Information at the end of the provision of services, unless retention is required by law (section 15 of the DPA);

(e) makes available to the Customer all information in its possession necessary to demonstrate its compliance with the applicable US State Privacy Law, and allows and cooperates with reasonable assessments by the Customer or its designated assessor, or alternatively arranges for a qualified and independent assessor to assess its policies and technical and organisational measures and provides a report of that assessment on request (section 13 of the DPA);

(f) assists the Customer, taking into account the nature of the processing and the information available to it, in responding to consumer rights requests, in meeting its obligations for the security of processing and the notification of a breach of security of the system, and in carrying out data protection assessments (sections 10 to 12 of the DPA).

3.3 Sensitive data. The Customer obtains any consent that a US State Privacy Law requires before it processes sensitive data (for example precise geolocation or government identifiers where a state law classifies them as sensitive) through the Services.

4. No sale or sharing by the Customer through the Services

The Services do not add advertising cookies, pixels or other cross-context behavioural advertising technologies to Hosted Websites and Booking Pages (Annex 1, Module 5). If the Customer adds such technologies through its own configuration, the Customer is responsible for any notice, opt-out and contract that the US State Privacy Laws require.