For business customers
Data Processing Agreement
Every property that uses InnRelay is the data controller for its own guests' personal data; ELVRIQ LTD acts as a data processor on that property's behalf. A signed Data Processing Agreement (DPA) sets out the terms of that processing relationship, in line with UK GDPR Article 28.
What our DPA covers
- The categories of personal data processed on your behalf, and the purposes of that processing
- Our security obligations and technical/organisational measures
- The sub-processors we use to deliver InnRelay, and how we manage changes to that list
- How we support you in responding to data subject requests
- Data breach notification commitments and timelines
- What happens to your data at the end of the relationship
Current sub-processors
InnRelay currently uses the following sub-processors to deliver the service:
- Supabase — application hosting, database and authentication
- Stripe — payment processing and subscription billing
- Resend — transactional email delivery, including staff invitations and guest-report notifications
We will update this list, and notify active customers of material changes, as our sub-processor relationships change.
Requesting a signed DPA
If you're a prospective or existing InnRelay customer and need a signed DPA — for your own compliance records, a security review, or as part of onboarding — contact us via our contact page and we'll send it over for signature.