FARENIO Ecosystem — Terms, Policies & Agreements
DATA PROCESSING AGREEMENT (DPA)
Last updated: 19 September 2026
Effective date: 28 May 2026
Version: Consolidated 2026
This Data Processing Agreement ("DPA") (this “Agreement”) forms part of the wider FARENIO contractual framework governing access to and use of the FARENIO Ecosystem by Hosts, Property Managers, agencies, professional accommodation operators, Enterprise Customers and, where expressly applicable, consumers. The Agreement is operated by GQ VENTURES SAS, trading as FARENIO, and is governed by French law.
The wider FARENIO contractual framework comprises the following documents: Host Terms & Property Operations Agreement; Software-as-a-Service Subscription Agreement; PMS, Channel Manager & API Integration Terms; and Data Processing Agreement (“DPA”).
This Agreement applies only where GQ VENTURES SAS, trading as FARENIO, processes Personal Data on behalf of a Customer, Host, Property Manager, Agency or Enterprise Customer acting as Controller.
This Agreement supplements the FARENIO Master CGU/CGV and the applicable Order Form, subscription confirmation or service order.
In the event of inconsistency between the documents making up the FARENIO contractual framework, the following order of precedence applies to the subject matter concerned:
The Privacy Policy governs processing for which FARENIO acts as an independent Controller and does not replace the DPA where FARENIO acts as Processor.
This DPA applies only where GQ VENTURES SAS, trading as FARENIO, processes Personal Data on behalf of a Customer, Host, Property Manager, Agency or Enterprise Customer acting as Controller.
For such processing:
Controller: The Relevant Customer
Processor: GQ VENTURES SAS / FARENIO
The DPA forms a binding part of the applicable service contract.
FARENIO may separately act as Controller where it determines the purposes and essential means of processing, including where applicable for:
Such processing is governed by the FARENIO Privacy Policy and applicable law rather than by Controller instructions under this DPA.
FARENIO shall process Personal Data on documented instructions from the Controller, including instructions contained in the Agreement and authorised configuration of the Services, unless processing is required by Union or Member State law.
Where legally permitted, FARENIO shall inform the Controller before processing required by law.
FARENIO shall immediately inform the Controller if, in its opinion, an instruction infringes applicable European or Member State data-protection law.
The subject matter is the processing required to provide the subscribed FARENIO services.
Processing continues for the duration of the applicable Services and any limited period required for lawful return, deletion, backup expiry or mandatory retention.
Processor activities may include:
Purposes may include authorised:
The Controller is responsible for:
FARENIO shall ensure persons authorised to process Controller Personal Data are subject to appropriate confidentiality obligations.
Access shall be limited according to role and operational need.
Taking into account the state of the art, implementation costs, nature, scope, context and purposes of processing and risks to individuals, FARENIO shall implement appropriate technical and organisational measures.
The baseline measures are described in Annex II.
The Controller grants FARENIO general written authorisation to engage Sub-processors subject to this Article.
FARENIO shall:
Where an objection cannot reasonably be resolved, the parties shall seek an appropriate solution, which may include discontinuation of the affected service where necessary.
Personal Data subject to the GDPR shall not be transferred to a third country unless Chapter V GDPR requirements are satisfied.
Depending on the destination and recipient, safeguards may include:
Transfer Impact Assessments shall be undertaken where required.
Taking into account the nature of processing, FARENIO shall provide reasonable assistance to enable the Controller to respond to requests concerning:
Where FARENIO receives a request relating solely to Controller Data, it shall ordinarily refer the request to the Controller unless authorised or legally required to respond directly.
Taking into account the nature of processing and information available to it, FARENIO shall provide reasonable assistance concerning:
FARENIO shall notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Controller Personal Data.
To the extent information is available, the notification shall describe:
Information may be provided in phases where it cannot reasonably be supplied at the same time.
FARENIO shall document qualifying incidents and cooperate reasonably with the Controller.
At the Controller's choice, following termination of the relevant Services, FARENIO shall delete or return Personal Data processed on behalf of the Controller and delete remaining copies unless applicable law requires retention.
Deletion from backup systems may occur through established backup-expiry cycles provided the data remains protected and is not restored for ordinary operational use.
FARENIO shall make available information reasonably necessary to demonstrate compliance with the Processor obligations applicable under the GDPR.
The Controller may conduct or mandate proportionate audits where reasonably necessary.
Audits shall ordinarily:
These restrictions do not prevent urgent or legally required audits following a significant incident or regulatory request.
FARENIO shall maintain records required of processors by applicable data-protection law and cooperate with the competent Supervisory Authority as legally required.
Depending upon the subscribed Services:
Depending upon configuration:
Payment-card information shall not be treated as being directly processed by FARENIO where it is processed exclusively by an independent payment provider and is not accessible to FARENIO.
Special-category Personal Data is not intended to be routinely processed through the Services unless expressly authorised, necessary and supported by an appropriate Article 9 GDPR condition.
FARENIO shall maintain measures proportionate to applicable risks, including as appropriate:
FARENIO shall not represent a security certification as existing unless that certification has actually been obtained and remains valid.
FARENIO shall maintain a current register identifying, for each relevant Sub-processor:
Generic descriptions such as “cloud provider” or “AI provider” shall not replace identification of the actual Sub-processor in the operative register.
Where applicable, FARENIO shall document:
Retention shall be determined according to the purpose and legal basis of the relevant processing.
Controller Data processed solely under this DPA shall ordinarily be retained for the duration of the Services and deleted or returned following termination subject to:
FARENIO's independent Controller records, including accounting, legal, fraud-prevention or compliance records, may be retained separately for applicable statutory periods.
FARENIO's incident process shall include:
The Controller remains responsible for determining whether notification to the competent Supervisory Authority or affected Data Subjects is required, except where FARENIO itself has a separate statutory notification obligation.
Nothing in this Agreement excludes or limits liability where exclusion or limitation is prohibited by applicable law.
Subject to that principle and except as otherwise agreed in an Order Form, neither party shall be liable to the other for indirect or consequential loss that was not reasonably foreseeable or for loss excluded by a valid contractual limitation.
Any contractual liability cap shall not apply where such limitation is prohibited by applicable law, including where relevant in cases involving fraud, wilful misconduct, liability that cannot legally be limited, or rights of Data Subjects under applicable data-protection law.
For professional Customers, the applicable liability cap shall be the cap specified in the relevant Order Form or commercial terms. In the absence of a specified cap, liability shall be assessed subject to the Agreement and applicable French law.
No limitation shall be interpreted so as to deprive an essential contractual obligation of its substance.
Force majeure shall be assessed in accordance with French law.
The affected party shall notify the other party as reasonably practicable and take reasonable measures to mitigate the consequences.
Third-party failure shall constitute force majeure only where the legal conditions for force majeure are actually satisfied.
Where a material breach is capable of remedy, the non-defaulting party may give written notice requiring remedy within a reasonable specified period.
Termination without a cure period may occur where permitted by law and justified by the seriousness of the breach, including certain fraud, security or unlawful-activity circumstances.
Termination does not extinguish accrued payment obligations, confidentiality obligations, data-protection obligations or provisions intended to survive termination.
Nothing in this Agreement authorises conduct contrary to mandatory French rules governing restrictive commercial practices, significant imbalance or abrupt termination of an established commercial relationship.
Where such mandatory rules apply, they prevail over inconsistent contractual provisions.
Where a Host or Customer qualifies as a consumer, nothing in this Agreement restricts mandatory rights under the French Consumer Code.
Applicable consumer information, withdrawal rights, mediation rights, renewal information, electronic termination rights and competent-court rules shall prevail over inconsistent provisions.
The parties shall first seek an amicable resolution of a dispute without preventing either party from seeking urgent or protective judicial relief.
Where FARENIO is legally required to provide access to consumer mediation, eligible consumers may refer unresolved disputes to the consumer mediator identified in FARENIO's Consumer Information and CGV after first submitting a written complaint to FARENIO in accordance with applicable requirements.
This Agreement is governed by French law, subject to mandatory protections that may apply to a consumer under applicable conflict-of-law rules.
For consumers, jurisdiction shall be determined by mandatory applicable law.
For professional parties that do not both contract in the capacity required for a valid jurisdiction clause under French procedural law, ordinary jurisdiction rules apply.
ONLY WHERE THE LEGAL CONDITIONS FOR AN ATTRIBUTIVE JURISDICTION CLAUSE ARE SATISFIED, INCLUDING WHERE ALL RELEVANT PARTIES CONTRACT AS COMMERÇANTS, THE PARTIES EXPRESSLY AGREE TO THE TERRITORIAL JURISDICTION OF THE COMPETENT COURTS WITHIN THE JURISDICTION OF PONTOISE, SUBJECT TO MANDATORY LAW.
FARENIO may amend contractual documentation for legal, regulatory, security, technical or operational reasons.
Material changes affecting existing professional subscriptions shall be notified within a reasonable period before taking effect unless immediate implementation is necessary because of law, security or an emergency.
Changes shall not retroactively deprive a party of accrued contractual rights.
Consumer contracts may be modified only in accordance with applicable consumer law.
If a provision is invalid, unlawful or unenforceable, it shall be ineffective only to the extent required by applicable law.
The remaining provisions shall continue to apply unless the invalid provision was essential to the contractual arrangement and applicable law requires a different result.
The Agreement may be concluded electronically.
FARENIO shall maintain appropriate evidence of contractual acceptance, including the applicable version of the terms, date of acceptance and relevant electronic records, in accordance with applicable law.
Where a separate signature or express consent is legally required, general Platform use alone shall not substitute for that requirement.
The Host or Customer shall be provided with the contractual documents applicable to the transaction before being bound, in a form appropriate to the transaction and applicable law.
Creation of an account alone does not constitute acceptance of every optional paid service.
A booking, subscription, PMS connection or API activation becomes subject to the contractual provisions specifically applicable to that functionality when validly accepted.
For professional or Enterprise Customers, an Order Form or separately executed agreement may supplement these Terms.
For processing governed by Article 28 GDPR, the Data Processing Agreement forms part of the binding contractual arrangement between the Controller and FARENIO.
We use cookies to improve your experience and analyze traffic. Choose how you’d like to proceed.
Your choice is saved — you won’t see this again. Privacy Policy