Data Processing Agreement

Last Updated: October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Use or other written or electronic agreement (the "Agreement") between Rovekey Limited ("Rovekey" or "Data Processor") and the Customer ("Customer" or "Data User / Controller") for the use of the Rovekey platform.

1. Definitions

  • "Customer Data" means all data, including Personal Data, submitted, stored, or generated by the Customer or its authorized users within the Rovekey platform.
  • "Personal Data" means any data relating directly or indirectly to a living individual from which it is practicable for the identity of the individual to be directly or indirectly ascertained, as defined under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").
  • "Sub-processor" means any third party engaged by Rovekey to process Customer Data in connection with the platform.

2. Roles and Scope of Processing

2.1 Roles of the Parties: For the purposes of this DPA, the Customer acts as the Data User (or Data Controller) and Rovekey acts as the Data Processor processing Personal Data on behalf of the Customer.

2.2 Documented Instructions: Rovekey shall process Personal Data solely to provide the Services in accordance with the Agreement and Customer’s documented instructions. Rovekey will not process Customer Data for its own independent purposes.

2.3 Customer Obligations: The Customer represents and warrants that it has established all necessary lawful bases, provided all required notices (including Personal Information Collection Statements), and obtained all necessary consents under the PDPO to allow Rovekey to process the Personal Data.

2.4 Application of Singapore Law: Where the Customer or the Customer Data is subject to the Singapore Personal Data Protection Act 2012 ("PDPA"), Customer acts as the "Organization" and Rovekey acts as the "Data Intermediary" processing Personal Data on the Customer's behalf pursuant to this Agreement. Any references to Data User/Controller or Data Processor shall be construed accordingly.

3. Security Measures (PDPO DPP 4)

3.1 Technical and Organizational Measures: Rovekey shall implement and maintain commercially reasonable technical and organizational measures to protect Personal Data against unauthorized or accidental access, processing, erasure, loss, or use.

3.2 Architecture: These measures include, but are not limited to, encryption in transit and at rest, principle-of-least-privilege access controls, and strict database Row Level Security (RLS) policies to ensure logical isolation of Customer Data within Rovekey’s multi-tenant architecture.

4. Sub-processing

4.1 General Authorization: The Customer provides general written authorization for Rovekey to engage third-party Sub-processors to deliver the Services.

4.2 Sub-processor Registry: A current list of authorized Sub-processors, their roles, and processing locations is maintained at rovekey.com/legal/subprocessors.

4.3 Notice of Changes: Rovekey will notify the Customer (via email or in-app notice) at least thirty (30) days prior to authorizing any new Sub-processor. If the Customer has a reasonable, data-protection-related objection to the new Sub-processor, the Customer must notify Rovekey within this 30-day period. If the parties cannot resolve the objection, the Customer may terminate the Agreement without penalty.

4.4 Liability: Rovekey remains fully liable for all acts or omissions of its Sub-processors to the extent Rovekey would be liable under this DPA.

5. Cross-Border Data Transfers

Rovekey hosts and processes data using cloud infrastructure that may be located outside of Hong Kong. Rovekey ensures that any cross-border transfer of Personal Data complies with the PDPO. Where applicable, Rovekey incorporates the Recommended Model Contractual Clauses (RMCs) issued by the Hong Kong PCPD, and ensures recipients are bound by legally enforceable obligations to provide a standard of protection comparable to the PDPO and the Singapore PDPA.

6. Data Subject Rights

If Rovekey receives a Data Access Request or Data Correction Request directly from an individual (e.g., a hotel guest or staff member) regarding Customer Data, Rovekey will promptly redirect the individual to the Customer. Rovekey will provide the Customer with the necessary platform tooling to fulfill such requests but will not respond to the request directly unless legally compelled to do so.

7. Data Breach Notification

In the event of a confirmed security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data (a "Data Breach"), Rovekey will:

  • Notify the Customer without undue delay (and in no event later than 48 hours) after becoming aware of the Data Breach, to ensure the Customer can meet its own statutory reporting deadlines.
  • Take commercially reasonable steps to mitigate the effects and minimize any damage resulting from the Data Breach.
  • Provide the Customer with sufficient information to fulfill any mandatory breach reporting obligations under applicable law.

8. Deletion and Return of Data (PDPO DPP 2)

8.1 Retention Limits: Rovekey shall not retain Personal Data for longer than is necessary to fulfill the purposes of the Agreement.

8.2 Right to Erasure: Upon termination or expiration of the Agreement, or upon the Customer's written request, Rovekey will securely delete or anonymize all Customer Data across its primary databases and active systems, subject to technical limitations of automated backup cycles (which will be overwritten or deleted in the ordinary course of business).

9. Audits and Inspections

Upon the Customer's written request, Rovekey will make available information reasonably necessary to demonstrate compliance with this DPA. This obligation is typically satisfied by providing access to Rovekey’s security documentation, architecture overviews, or third-party security certifications. If such documentation is insufficient to demonstrate compliance, the Customer may conduct an audit at its own expense, subject to reasonable confidentiality and operational restrictions.

10. General Provisions

10.1 Conflict: In the event of any conflict between this DPA and the Agreement, the provisions of this DPA shall prevail with respect to the processing of Personal Data.

10.2 Governing Law: This DPA shall be governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region.