Data processing & GDPR
Who processes what, where, and on what basis.
A plain statement of how personal data moves through Aerandil, written for the person who has to sign the DPA and answer the questionnaire. It is kept consistent with the privacy policy and the security whitepaper, and we would rather you found a gap here than in a review.
01 · The two roles
ControllerThis website, enquiries and demos, our own staff, billing and support.We decide why and how that data is processed, and the privacy policy is our notice for it.Privacy policy ->
ProcessorEverything a hotel puts in the platform: its guests, bookings, bills, staff and messages.The hotel is the controller. Its lawful bases are its own, we act on its documented instructions, and the Data Processing Agreement sets the terms.Request the DPA ->
02 · What a hotel's tenant holdsAs processor
GuestsIdentity and contact details, stay and booking details, preferences the hotel records, marketing consent.
Bills and paymentsCharges, payments and refunds, and the payment token for a stored card. Card numbers never reach the platform: Stripe's hosted field and the terminal hold them.
StaffIdentity, role and sign-in, shifts and the housekeeping and maintenance work recorded against a name.
MessagesWhat the hotel and its guests send each other through the platform.
The recordWho changed what and when, as an append-only event log. Classified values are never written into it.
Special-category data is not required by any screen. Where a hotel records a guest's accessibility or dietary note it is free text the hotel chose to keep, and the product is designed not to ask for more than the stay needs.
03 · Where it livesUK · EU · US
Region, pinnedEvery tenant is pinned to a region, UK, EU or US, and the platform enforces it at placement, at relocation and when a cell boots. A cell in the wrong region refuses to start.
CloudAmazon Web Services, in the pinned region, on SOC 2 and ISO 27001 certified infrastructure. Encryption at rest is host-managed, with customer-manageable KMS keys.
In transitTLS is required everywhere. The platform speaks only rustls and rejects a downgrade.
The databaseVanilla Postgres, with every tenant fenced by forced, fail-closed row-level security. Isolation lives in the database, not only in the application.
04 · Sub-processorsCurrent list · changes announced 30 days ahead
| Who | What | Where |
|---|---|---|
| Amazon Web Services | Hosting and the managed database tier | The tenant's pinned region (UK, EU or US) |
| WorkOS | Single sign-on and multi-factor authentication for operators | US, under Standard Contractual Clauses |
| Stripe | Card payments, as the hotel's own connected account. Stripe is the hotel's payment processor and an independent controller for cardholder data | EU and US, under Stripe's own transfer terms |
| Adyen | Card terminals at the desk and in the restaurant (in test; added here before the first live terminal) | EU |
| Google Workspace | Our email, calendar and enquiry records | EU and UK data regions |
| Vercel | Hosting this website | Global edge; no customer data |
| Cloudflare | Domain name services and the bot check on the forms | Global edge; no customer data |
No AI model provider processes customer data in production today. When an agent feature ships to a customer, its provider is added to this list first, with the same notice.
05 · International transfers
We are a UK company and customer data stays in the region its tenant is pinned to. Where a sub-processor sits outside the UK or the EEA, the transfer rests on UK adequacy regulations, the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, with a transfer risk assessment where one is required. As we enter the EU market we appoint an EU representative.
06 · Rights and retention
Erasure (Article 17)A first-class action, per guest and for a whole tenant, with per-type retention windows. The event log is append-only, so personal data is kept out of it by construction rather than erased from it afterwards.
Export (Article 20)A guest's data as a structured export, from an endpoint, not a ticket.
Access, correction, restrictionThe hotel answers its guests from the record; we assist within the timeframe the DPA sets.
RetentionPer-category windows inside the platform; enquiry and account data as the privacy policy describes.
A guest exercises a right with the hotel, which is the controller; we assist. A visitor to this site, or anyone unsure who holds their data, can write to privacy@aerandil.com.
07 · If something goes wrong
We notify the controller without undue delay after becoming aware of a personal data breach, with what we know at the time, the likely consequences and the measures taken, and we keep updating until it is closed. The append-only record is what lets us say exactly what was touched. Security researchers reach us at security@aerandil.com.
08 · The documentsWhat a reviewer can ask for
Data Processing AgreementUK GDPR and EU GDPR terms, with the technical and organisational measures, the residency annex and the sub-processor annex. Available to customers and prospects under review.Request the DPA ->
Data protection impact assessmentCompleted on the platform's core processing in June 2026. Available under NDA to a customer's data protection lead.Request the DPIA ->
Security whitepaperThe controls in detail: identity, isolation, residency, encryption, audit, the supply chain and incident response.Read the whitepaper ->
Privacy policyOur notice as a controller: what we collect from visitors, prospects and customers, and why.Read the policy ->
Request a briefing
Bring your security
questionnaire.
We answer the questionnaire against the product, not a template. Bring yours and the people who have to sign off.
Request the DPAprivacy@aerandil.com for the DPA, the DPIA and the sub-processor notices.