guidely

Data Processing Addendum

Last updated August 2026

This Data Processing Addendum (“DPA”) forms part of the guidely Terms of Service between guidely and you, the host. It applies whenever guidely processes personal data about your guests on your behalf. Where it conflicts with the main terms on how guest data is processed, this DPA wins. Terms like personal data, processing, controller, processor, data subject, responsible party and operator carry the meanings given by the GDPR and South Africa's POPIA, as each applies to you.

1. Roles

You are the controller (responsible party under POPIA) of your guests' personal data. guidely is the processor (operator) acting for you. You decide what guest data you collect and why. guidely processes it to run the service for you.

2. Your instructions

guidely processes guest personal data only to provide the service under the terms, and on your documented instructions, which include the settings and features you switch on in the product. guidely will tell you if it believes an instruction breaks data-protection law.

3. What is processed

  • Purpose: providing the guidely service, which can include the guide, guest messaging, ordering, extras, check-in, registration and feedback.
  • Duration: for as long as your account is active, plus any retention set out in the Privacy Policy.
  • Data subjects: your guests.
  • Types of data: names, contact details (email, phone), language, messages, orders and requests, ratings and feedback, arrival and check-in details, and, where you switch on the registration form, home address, date of birth, nationality, ID or passport number, and signature.

4. Confidentiality

guidely keeps guest personal data confidential and makes sure the people who process it are bound by confidentiality.

5. Security

guidely keeps appropriate technical and organisational measures to protect guest personal data, including encryption in transit, access controls, and hosting on Google Cloud and Firebase. No online system is perfectly secure, but data is protected with reasonable care.

6. Sub-processors

You give guidely general authorisation to use the sub-processors below to deliver the service. Each only receives what it needs. guidely stays responsible for their compliance, will give you notice of any new sub-processor, and you may object on reasonable data-protection grounds.

  • Google (Firebase and Google Cloud) - hosting, database, sign-in, file storage, Maps and Places, and Cloud Translation.
  • Google (Gemini API) - AI concierge answers and content drafting, using the content and questions provided.
  • Polar - host subscription billing, as merchant of record.
  • Stripe - guest card payments, charged to the host's own Stripe account.
  • Resend - transactional and guest-journey emails.
  • Your connected PMS or channel manager (such as Mews, Apaleo or Cloudbeds) - the reservation data you choose to sync.

7. Guest rights

guidely will help you respond to your guests' requests to see, correct, delete or export their data, so far as the service allows. Because you are the controller, guests should contact you first. Where guidely receives a request directly, it will pass it to you.

8. Data breaches

guidely will notify you without undue delay after becoming aware of a personal-data breach affecting your guests' data, with the information you reasonably need to meet your own notification duties.

9. International transfers

Some sub-processors run servers outside your country, including in the EU and the US, so guest data may be processed abroad. guidely relies on appropriate safeguards for those transfers where the law requires them.

10. Deletion and return

When you delete a guide or your account, or the terms end, guidely deletes or returns the guest personal data it holds for you, except anything it must keep by law. Check-in and registration details are cleared on the schedule in the Privacy Policy.

11. Audit and information

guidely will give you the information reasonably needed to show it meets this DPA, and will allow audits to the extent the law requires, on reasonable notice and terms.

12. Term

This DPA lasts as long as guidely processes guest data for you, and for guest data it prevails over anything inconsistent in the main terms.

Contact

guidely is operated by guidely (Pty) Ltd (registration number 2026/676044/07), South Africa. Data questions: hello@useguidely.co.