INTRODUCTION

I.- That Check-in Scan and the client maintain a professional collaboration relationship, whereby Check-in Scan makes available to the client the Check-in Scan , which facilitates compliance with the obligations of notification, documentation and registration established by the regulations applicable to the accommodations for tourist purposes.

II.- That to term the aforementioned services, the client requires CHECK-IN SCAN to communicate information from the check-in process to its provider in charge of the PMS integration process, hereinafter, the provider.

III- that for this reason and in compliance with the provisions of article 28 of Regulation (EU) 2016/679 of the European Parliament and the Council, of April 27, 2016, regarding the protection of natural persons in regards to the process Organic 3/2018, of December 5, to protect personal data and guarantee of digital rights (LOPDGDD) CHECK-IN SCAN and the client freely agree to regulate the data communication process, in accordance with the clauses established in this addendum.

1. Definitions

For the best understanding of this addendum, the following concepts are detailed below:

Customer : natural or legal person to whom it provides the Check-in Scan . The natural person who accepts this addendum in the name of the legal/physics person who provides the service, states that it has sufficient seizure and/or authorization to link said entity/professional.

Check-in Scan : Legal person who provides the CECK-IN CUSTOMER SERVICE: Check-in Scan , SL, NIF: B-93578862. Registered office: Boulevard de la Cala, Local 1, La Cala de Mijas, CP 29649, Mijas (Málaga). Telephone: +34 951 82 98 60. Email: info@checkinscan.com .

Supplier: Legal person who provides the PMS integration service to the client. 

RGPD : Regulation (EU) 2016/679, of the European Parliament and the Council of April 27, 2016, regarding the protection of natural persons in regards to the processing of personal data and the free circulation of these data or any other legislation promulgated by the European Union on the same matter in the future

Personal data : all information about a natural person identified or identifiable; Any person whose identity can be determined, directly or indirectly, in particular through an identifier, such as a name, an identification number, location data, an online identifier or one or several elements of the physical, physiological, genetic, psychic, economic, cultural or social identity will be considered identifiable.

Responsible for the treatment: natural or legal person, public authority, service or other organism that, alone or together with others, determine the aims and means of treatment. For the purposes of this addendum, the figure of responsible for customer treatment is attributed.

Treatment manager : natural or legal person, public authority, service or other agency that treats personal data on behalf of the treatment. For the purposes of this addendum, the figure in charge of the treatment to CHECK-IN SCAN and the supplier is attributed.

General conditions : terms and conditions applicable to the use of the service with a transverse character, regardless of the subscription modality selected by the client for access to the service.

INTEGRATION INSTRUCTIONS SPECIFICATIONS Facilitated to CHECK-IN SCAN by the client or, failing that, by the provider on behalf of the client, in order to coordinate the integration process.

Treatment : Any operation or set of operations on personal data or sets of personal data, either by automated procedures or not, such as the collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of access, comparison or interconnection, limitation, suppression or destruction; as described in the European regulations or in applicable data protection laws.

Confidential Information : All information, documentation or data that any of the parties provides to the other in the development and execution of the service, in

2. OBJECT

The purpose of this addendum is to regulate the terms of the data communication process by CHECK-IN SCAN, to the supplier within the framework of the provision of services by CHECK-IN SCAN to the client, in the terms established in the general conditions of the hiring.

The client is considered responsible for the treatment, being who determines the aims of processing and use of personal data by CHECK-IN SCAN in the context of the provision of services between the parties.

On the other hand, CHECK-IN SCAN deals with the personal data of the guests in accordance with the client's instructions and only to the extent that such treatment is necessary for the correct provision of the services or to comply with the applicable legislation, all as in charge of the treatment of the client.

Within the framework of the provision of services between the parties, the client requires CHECK-IN SCAN that facilitates the customer supplier, the necessary data to coordinate the PMS integration process.

3. Customer obligations

In the context of data communication by CHECK-IN SCAN to the supplier, the client is obliged to:

1. Ensure that access to personal data of guests by the supplier occurs exclusively within the framework of the provision of services entrusted by the client, only and exclusively for this purpose and only to the extent that said access is strictly necessary for the provision of the contracted services.
2. Ensure that the supplier adopts the reasonably adequate measures, as prescribed by the applicable data protection legislation, to maintain the integrity and safety of personal data to which they have access as a result of data communication made by CHECK-IN SCAN.
3. Keep CHECK-IN SCAN unscathed to possible responsibilities arising from data communication by CEHCK-IN Scan to the supplier, provided that such communication occurs within the framework of the instructions provided to CHECK-IN SCAN or based on the integration instructions provided by the client or, failing that, by the supplier, in name and on behalf of the client.
4. Regulate with the supplier the obligations that it must assume as person in charge of data processing client ownership.

4. CHECK-IN SCAN obligations

On the other hand, in the data communication process to the supplier, CHECK-IN SCAN is obliged to:

1. Follow the instructions established in integration instructions, and not provide excessive or not necessary information, based on the specifications indicated in said document. However, Check-in Scan will have no obligation to provide data whose collection and treatment were not expressly provided in the general conditions of hiring that govern the relationship between Check-in Scan and the client .
2. Maintain the duty of secret regarding personal data to which you have access by virtue of this commission, even after its purpose ends.
3. Ensure that CHECK-IN SCAN staff with customer data access undertakes to respect confidentiality and comply with the measures indicated in this document.
4. Notify in writing to the client, without improper delay and, in any case, before the maximum period of 48 hours, the violations of the safety of the personal data in their charge of which he has knowledge, together with all the relevant information for the documentation and communication of the incidence. Notification will not be necessary when it is unlikely that such security violation constitutes a risk to the rights and freedoms of natural persons. If it is available, at least, the following information will be facilitated:

1. 1. Description of the nature of the violation of the security of personal data, including, when possible, the categories and the approximate number of affected interested parties, and the categories and the approximate number of records of personal data affected.
   2. The name and contact data of the data protection delegate or from another point of contact in which more information can be obtained.
   3. Description of the possible consequences of the violation of the safety of personal data.
   4. Description of the measures taken or proposals to remedy the violation of the safety of personal data, including, if applicable, the measures taken to mitigate the possible negative effects.

If it is not possible to facilitate information simultaneously, and to the extent that it is not, the information will be gradually facilitated without improper delay. It corresponds to the client to communicate in the shortest possible time the violations of the security of the data to the control authority and, where appropriate, to the interested parties, when the violation is likely to suppose a high risk for them. However, the parties may agree otherwise, in cases where the gap affects the internal operation of Check-in Scan, beyond the object of the commission.

5. Security measures

The data communication process by CHECK-IN SCAN to the supplier will be carried out based on the provisions of the integration instructions, in order to allow data communication without compromising the safety and confidentiality of the treated information.

Check-in Scan will adopt technical and organizational measures to guarantee information security, based on the criteria marked by the applicable data protection legislation, in order to protect personal data assigned and avoid their revelation or improper alteration or unauthorized access to them, given the state of technology, the nature of stored data and the risks to which they are exposed, they already come from human action or natural environment.

However, Check-in Scan cannot guarantee that the provider environment or systems enabled for data communication, comply with the appropriate security measures, taking into account the status of the technique, application costs, as well as nature, scope, context and the purposes of treatment.

6. Exemption of responsibility

Check-in Scan will not be responsible in any case:

• Of compliance by the supplier of its obligations as responsible for the processing of personal data of the client.
• Of the application by the supplier of appropriate technical and organizational measures to guarantee the security, confidentiality, availability and resilience of the information provided by Check-in Scan.
• Of the loss, alteration or inaccuracy of the information as a result of the provision of services by the supplier to the client.

The client expressly recognizes that CHECK-IN SCAN does not maintain a legal link with the supplier and exempts CHECK-IN SCAN from any responsibility that the supplier could demand within the framework of its legal relationship with the client.

7. Applicable legislation and competent courts

In this is not provided for in this contract, as well as in the interpretation and resolution of the conflicts that may arise between the parties as a result, the Spanish legislation will apply. For the resolution of any controversy that could be derived from this contract, both parties will be submitted to the jurisdiction of the courts of Malaga, expressly renouncing any other jurisdiction that could correspond to them.

And for the record, and in proof of conformity by both parties, this document is signed by duplicate in the place and date indicated in the heading.

Final modification date: 04/02/2025