RORAIMA

IoT Marketplace

AUTHORIZED VENDOR AGREEMENT

(Authorized Supplier Service Agreement)

Version 1.6 – 11 October 2026

This Agreement supplements the General Terms and Conditions of Use and governs the relationship between the Operator and the Authorized Vendor in connection with the sale of IoT installation services, physical devices, and delegated device management through the Roraima marketplace.

Operator: Roraima — Startup di Dario Salaris, Via Firenze 16, 07039 Valledoria (SS), Italy

Article 1 – Scope and Relationship with General Terms

1.1. This Authorized Vendor Agreement (hereinafter, the “Agreement”) governs the specific terms under which the Authorized Vendor is permitted to sell installation services, physical IoT devices, receive Delegations from Device Owners, and use the additional Services provided by the Platform.

1.2. This Agreement supplements and forms an integral part of the General Terms and Conditions of Use (the “General Terms”). All defined terms used herein and not otherwise defined shall have the meaning ascribed to them in the General Terms. In the event of conflict, this Agreement shall prevail.

1.3. By completing the Authorized Vendor registration process and submitting the required documentation, the Authorized Vendor expressly accepts this Agreement in its entirety.

Article 2 – Eligibility, Authorization and Verification

2.1. To register as an Authorized Vendor, the applicant must: (a) be a natural or legal person registered in one of the 32 countries of the Stripe Europe region; (b) operate in the IoT sector as a device reseller, professional installer, or both; and (c) hold the requisite business registrations, professional certifications, and technical qualifications for their declared sub-type.

2.2. Sub-types. The Authorized Vendor must select one of the following sub-types upon registration:

2.3. Documentary verification. As part of the authorization process, the Authorized Vendor must provide, whatever the country in which it operates:

(a) VAT number: a valid VAT number, verified through the European VAT number database (VIES) or, if the database does not confirm it, through a document attesting it (certificate of assignment or company register extract showing it), uploaded in PDF/JPG/PNG format, max 10 MB, and reviewed by the Operator;

(b) Qualification declaration (for Installer and Both sub-types): the declaration, signed electronically on the Platform, by which the Authorized Vendor certifies that it is qualified, under the laws of the country in which it operates, to install the electrical and electronic systems required by the services offered, and undertakes to carry out every installation in compliance with those laws, to notify the Operator without delay of any suspension or revocation of the qualification, and to provide, upon request, a document proving it.

The Authorized Vendor may attach further documents, such as chamber of commerce registration (or equivalent), sales authorizations, entries in professional rolls or registers, and certifications; such documents are optional and do not replace the requirements of points (a) and (b).

2.4. Verification process. Upon submission, the Authorized Vendor’s profile enters “pending_review” status. If the VAT number is confirmed by the European VAT number database and, for Installer and Both sub-types, the declaration referred to in Article 2.3(b) has been signed, the authorization is approved automatically by the Platform; the Operator may at any time review it, request a document or suspend it. In all other cases, the Operator (or its designated agent) shall review the documentation and either approve or reject the application; the same applies where the VAT number has already been verified for another account. The Operator aims to complete the review within ten (10) business days but does not guarantee a specific timeframe. Until approval, the Authorized Vendor’s operational capabilities are restricted.

2.5. Profile states. The Authorized Vendor’s profile may be in one of the following states: (a) pending_review – initial state, limited capabilities; (b) active – fully operational; (c) rejected – application denied, with reasons communicated; (d) pending_upgrade – sub-type upgrade pending review. Each authorized activity (sales, installation) may also be in a grace period, pursuant to Article 10.1(a), or be suspended; a suspended activity does not allow the Authorized Vendor to operate, even if the profile remains active.

2.6. Sub-type changes. Upgrades (e.g., from Seller to Both) require submission of additional documentation and a new verification review. During review, the effective sub-type remains unchanged. Downgrades (e.g., from Both to Seller) take effect immediately, without verification; map visibility and related badges are removed automatically.

2.7. The Authorized Vendor must maintain all certifications, licenses, and business registrations valid and up to date throughout the term of this Agreement. The Operator may periodically request updated documentation. Failure to provide updated documentation within thirty (30) calendar days of request may result in suspension of the Authorized Vendor’s profile.

Article 3 – Subscription Plans and Fees

3.1. The subscription Plan available to the Authorized Vendor is the following:

Monthly Credits. The monthly Credits indicated in the table are assigned as Complimentary Credits, governed by Article 7.8 of the General Terms.

3.2. Subscription fees, payment processing, upgrade/downgrade rules, and fee modification procedures follow the same terms as set forth in Articles 3.2 through 3.4 of the Device Owner Service Agreement, mutatis mutandis.

Article 4 – Collections and Payouts

4.1. The Operator does not charge or withhold any Commission on the Authorized Vendor’s transactions, in accordance with Article 8.4 of the General Terms. The price paid by the Buyer accrues in full to the Authorized Vendor, net only of the fees applied by Stripe to the payment.

4.2. The Buyer’s payment is collected directly into the Authorized Vendor’s Stripe Connect account, without any deduction by the Operator; Articles 4.2 through 4.7 of the Device Owner Service Agreement apply mutatis mutandis.

4.3. The prudential exposure limit set out in Article 8.9 of the General Terms and Conditions of Use applies.

Article 5 – Sale of Installation Services

5.1. Authorized Vendors with the sub-type “Installer” or “Both” may list and sell professional IoT installation, configuration, and maintenance services through the Platform. Services are listed in a dedicated marketplace category.

5.2. Service description. Each service listing must include: (a) a clear and accurate description of the service; (b) the geographic area of availability (service radius); (c) estimated completion time; (d) the price, inclusive of all applicable taxes; and (e) any prerequisites or conditions.

5.3. Service radius. The Authorized Vendor shall define a maximum service radius (in kilometers), which determines the geographic area within which the Authorized Vendor offers on-site services. The Platform uses the Haversine formula for geographic filtering. The Authorized Vendor shall not accept orders outside their declared service radius.

5.4. Professional standards. The Authorized Vendor commits to performing all installation services in accordance with: (a) applicable national regulations for electrical, home automation, and IoT installations; (b) manufacturer specifications and recommendations; (c) professional best practices and safety standards; (d) any specific instructions provided by the Device Owner or Buyer; and (e) the obligation to register the customer’s devices in the account held by the customer with the manufacturer, to the exclusion of any account of its own, and to hand over full access to the customer upon completion of the work.

5.5. The Authorized Vendor is solely liable for the quality, safety, and legal compliance of the installation services provided. The Operator is not a party to the contract between the Authorized Vendor and the Buyer for installation services, and disclaims all liability for the performance or outcome thereof.

5.6. Insurance. The Authorized Vendor providing installation services shall maintain adequate professional liability insurance covering, at a minimum, damage to the customer’s property, personal injury, and faulty workmanship. Proof of insurance may be required as part of the verification process.

Article 6 – Sale of Physical IoT Devices

6.1. Authorized Vendors with the sub-type “Seller” or “Both” may list and sell physical IoT devices compatible with the Platform through the marketplace.

6.2. Product compliance. All physical devices listed must comply with: (a) applicable EU product safety legislation, including Regulation (EU) 2023/988 (General Product Safety Regulation – GPSR); (b) CE marking requirements; (c) Radio Equipment Directive 2014/53/EU; (d) applicable national safety standards for IoT and electrical devices; (e) any Extended Producer Responsibility (EPR) obligations in the country of sale; and (f) the pre-contractual information obligations on the data generated by the connected product laid down in Article 3 of Regulation (EU) 2023/2854, to be fulfilled in the product listing.

6.3. Shipping and fulfillment. The Authorized Vendor is solely responsible for shipping, packaging, delivery, and fulfillment of physical device orders. The Authorized Vendor shall clearly indicate shipping costs, estimated delivery times, and shipping zones in their product listings. Custom shipping rates and delivery times may be configured through the Platform.

6.4. Warranty. Physical devices sold through the Platform must comply with the EU legal guarantee of conformity (Directive (EU) 2019/771). The Authorized Vendor, as the seller, is responsible for honoring the legal guarantee. The Operator is not responsible for any warranty claims related to physical products.

6.5. Returns and withdrawals. Consumer purchases of physical devices are subject to the fourteen (14) day right of withdrawal set forth in Article 9 of the General Terms. The Authorized Vendor shall accept returns in accordance with applicable consumer protection law and shall process refunds within the timeframes prescribed by law.

6.6. Information on returns and guarantees. The Authorized Vendor selling physical devices shall state in its profile the address for the return of goods, the party bearing the direct cost of returning the goods in the event of withdrawal, and any commercial guarantee offered, together with its duration. The Platform displays such information in the product listing and in the order confirmation as pre-contractual information of the Authorized Vendor, which is solely responsible for its accuracy and completeness.

Article 7 – Delegations from Device Owners

7.1. The Authorized Vendor may receive Delegations from Device Owners through the Platform’s pairing code mechanism. By accepting a Delegation, the Authorized Vendor gains operational access to the delegating Device Owner’s IoT devices and Scenarios, subject to the limitations described below.

7.2. Permitted actions under Delegation: manage devices, create and edit Scenarios, test automations, access the delegating Device Owner’s dashboard (devices, scenarios, gateways, cloud accounts, products, audit log).

7.3. Prohibited actions under Delegation: delete devices, modify system device types, create IoT Products (this remains the exclusive prerogative of the Device Owner), sub-delegate access to third parties, self-delegate.

7.4. All actions performed by the Authorized Vendor under Delegation are recorded in the Platform’s audit log with full traceability (identity, timestamp, nature of action). The Authorized Vendor acknowledges and consents to such logging.

7.5. Delegations may be revoked at any time by the Device Owner, with immediate effect. Delegations are automatically revoked upon: (a) the Authorized Vendor’s profile becoming inactive; (b) the Authorized Vendor’s Account being suspended or terminated; or (c) the Device Owner’s Account being suspended or terminated.

7.6. Duty of care. The Authorized Vendor shall exercise professional care and diligence when operating under Delegation. The Authorized Vendor shall not: (a) access devices beyond the scope of the Delegation; (b) collect or process personal data obtained through delegated access for any purpose other than the performance of the delegated tasks; or (c) take any action that could compromise the security or availability of the Device Owner’s devices.

7.7. The Authorized Vendor shall indemnify the Device Owner and the Operator against any claims arising from the Authorized Vendor’s acts or omissions while operating under Delegation.

Article 8 – Map Visibility and Service Area

8.1. Authorized Vendors with the sub-type “Installer” or “Both” are displayed on the Platform’s interactive supplier map. Map placement is determined by the Authorized Vendor’s declared location, service radius, and relevance to the Buyer’s search criteria.

8.2. The Authorized Vendor shall provide an accurate business location and service radius. Misrepresentation of location or service area may result in removal from the map and suspension of the profile.

8.3. The Operator reserves the right to adjust ranking and visibility on the map based on objective criteria, including but not limited to: subscription Plan level, customer satisfaction ratings, response time, and order completion rate. The Operator shall disclose the main ranking parameters in accordance with Regulation (EU) 2019/1150.

Article 9 – Regulatory and Professional Compliance

9.1. The Authorized Vendor is solely responsible for compliance with all applicable laws and regulations in their country of registration and in the countries where they sell products or provide services, including but not limited to:

(a) national regulations for electrical and home automation installations;

(b) professional licensing and certification requirements;

(c) product safety regulations (GPSR, CE marking, radio equipment directives);

(d) consumer protection laws;

(e) data protection laws (GDPR and national implementations);

(f) tax obligations (income tax, VAT, DAC7 reporting);

(g) Extended Producer Responsibility (EPR) registration and reporting obligations;

(h) anti-money laundering and anti-bribery regulations.

9.2. The Operator may request evidence of compliance at any time. Failure to demonstrate compliance may result in suspension or termination of the Authorized Vendor’s profile.

Article 10 – Suspension, Termination and Consequences

10.1. The provisions of Article 15 of the General Terms apply. In addition, the Operator may suspend or terminate the Authorized Vendor’s access specifically if: (a) the Authorized Vendor’s documentation, including the VAT number verification, expires or is revoked and is not renewed within thirty (30) calendar days of the expiry or revocation (grace period), during which the Authorized Vendor continues to operate; (b) the Authorized Vendor fails or refuses the periodic re-verification process; (c) the Authorized Vendor receives substantiated complaints regarding the quality or safety of installation services; (d) the Authorized Vendor’s professional license or certification is suspended or revoked by the issuing authority.

10.2. Effect of termination. Upon termination: (a) all active Delegations are revoked immediately; (b) the Authorized Vendor is removed from the supplier map; (c) pending orders for physical devices must be fulfilled or refunded; (d) pending orders for installation services must be completed or canceled with appropriate notice to the Buyer; (e) final Payout settlement follows the same terms as Article 11.3 of the Device Owner Service Agreement.

10.3. The Authorized Vendor may terminate this Agreement at any time by canceling their vendor subscription. Termination shall take effect at the end of the current billing period, subject to the completion of any pending orders.

Article 11 – Representations, Warranties and Indemnification

11.1. The Authorized Vendor represents and warrants that:

(a) the Authorized Vendor has the legal capacity and authority to enter into this Agreement;

(b) all information and documentation provided is accurate, current, and authentic;

(c) the Authorized Vendor holds all necessary licenses, certifications, and insurance;

(d) all products sold comply with applicable product safety and quality standards;

(e) all installation services are performed by qualified personnel in compliance with applicable regulations;

(f) the Authorized Vendor will comply with all applicable tax, consumer protection, and data protection laws;

(g) the Authorized Vendor will exercise professional care in all Delegation activities.

11.2. Without prejudice to Article 14 of the General Terms, the Authorized Vendor specifically agrees to indemnify, defend, and hold harmless the Operator from and against any claims arising from: (a) faulty installation work; (b) damage to property or persons during installation; (c) non-compliant or unsafe physical devices sold; (d) failure to honor warranty obligations; (e) unauthorized actions performed under Delegation; (f) expired or invalid professional certifications; and (g) any regulatory violations.

Article 12 – Data Protection and Processing Under Delegation

12.1. When operating under Delegation, the Authorized Vendor may access personal data of Buyers (e.g., through checkout extra information or device usage logs). The Authorized Vendor acknowledges that, with respect to such data, it acts as a data processor on behalf of the Device Owner (data controller), and shall:

(a) process personal data only for the purposes of performing the delegated tasks;

(b) not retain personal data beyond what is strictly necessary;

(c) implement appropriate technical and organizational security measures;

(d) not disclose personal data to third parties without authorization;

(e) cooperate with data subject access requests and deletion requests;

(f) notify the Device Owner and the Operator without undue delay in the event of a personal data breach.

12.2. With respect to personal data collected directly in the context of the sale of physical devices or installation services (e.g., Buyer name, delivery address, service location), the Authorized Vendor acts as an independent data controller and is solely responsible for GDPR compliance.

Article 13 – Governing Law and Final Provisions

13.1. This Agreement shall be governed by and construed in accordance with the laws of Italy, in accordance with Article 18 of the General Terms.

13.2. The provisions of the General Terms regarding amendments (Article 17), dispute resolution (Article 16), force majeure (Article 19.3), and severability (Article 19.1) apply mutatis mutandis to this Agreement.

13.3. This Agreement, together with the General Terms, the Privacy Policy, and any applicable policies, constitutes the entire agreement between the Authorized Vendor and the Operator with respect to the subject matter hereof.

Acceptance

By completing the Authorized Vendor registration process, uploading the required documentation, and selecting a subscription Plan, the Authorized Vendor confirms that they have read, understood, and accepted this Authorized Vendor Agreement in its entirety, in conjunction with the General Terms and Conditions of Use and the Data Processing Agreement (Article 28 GDPR) set out in the Appendix, which forms an integral part of this Agreement.

Last updated: 11 October 2026

Previous version: 1.5 – 5 October 2026

© 2026 Roraima – All rights reserved.

Access data processing — igloohome smart locks (Singapore)

Where the Authorized Vendor operates smart locks on behalf of an Owner under a Delegation and access is managed via igloohome, the processing involves Igloocompany Pte. Ltd. (Singapore), a non-EU provider. The Authorized Vendor and the delegating Owner must ensure a valid legal basis exists before any guest personal data is provided to igloocompany, and the Authorized Vendor must safeguard the igloohome account and API credentials used. The Roraima Platform minimises the data sent to igloohome, transmitting only a neutral booking reference (e.g. "Roraima #<booking id>") and never the guest's name or contact details. Access events received via an active Wi-Fi bridge are processed solely for security and dispute-resolution purposes. Igloocompany declares compliance with the GDPR and UK GDPR in addition to Singapore's PDPA; transfers outside the EEA rely on the adequate safeguards declared by the provider. Further details are set out in the Roraima Privacy Policy.

Appendix – Data Processing Agreement (Article 28 GDPR)

Appendix to the contracts of the Roraima platform — an integral part of the contract to which it is attached. The text of this Agreement, including its Annexes, is included in the content of the contract page: acceptance of the contract includes the Agreement in the version included in the accepted text.

Recitals

When a Vendor uses the Roraima platform to manage bookings and stays, the platform collects and processes personal data of the Vendor's guests: personal details, identity documents, mandatory communications to the authorities, access codes. For these data the controller is the Vendor — because the law places the relevant obligations on the Vendor (notification of guests to the Italian State Police (Polizia di Stato), tourism statistical surveys, tourist tax) and it is the Vendor who decides how to manage its own guests. Roraima is the instrument: it processes those data on behalf of the Vendor and in accordance with the Vendor's instructions.

This Agreement governs that relationship pursuant to Article 28 of Regulation (EU) 2016/679 (the "GDPR"). In the event of conflict with the general clauses of the contracts to which it is annexed, this Agreement prevails for data protection matters (in particular, it supplements and further specifies Article 12.2(b) of the General Terms and Conditions).

1. Parties and roles

1.1. The parties are:

• the Vendor (the party that has entered into the Service Contract for Owners), acting as controller of the personal data of its own guests and of the persons staying at its properties;
• Dario Salaris — «Roraima — Startup di Dario Salaris», Via Firenze 16, 07039 Valledoria (SS), Italy, privacy contact privacy@roraima.io (the "Operator"), acting as processor.

1.2. What this Agreement does NOT cover. The following remain outside its scope, because they have a different controller:

• data for which the Operator determines purposes and means on its own account (platform accounts, marketplace orders, technical logs, conversational assistants used by the Vendor itself): for those data the Operator is the controller and the Privacy Notice applies;
• data that the Vendor collects as an independent controller (extra information at checkout, Article 9 of the Contract; data collected in person at the property);
• data that external service providers process as independent controllers (for example Stripe for anti-fraud checks and vendor identification, or the lock manufacturers with respect to the account the Vendor holds with them — Article 9 of this Agreement).

1.3. Authorized Suppliers under delegation. Where the Vendor delegates an Authorized Supplier (Article 6 of the Contract), the Supplier processes the data it accesses as a processor of the Vendor, on the terms already laid down by Article 12 of the Contract for Authorized Suppliers. The Operator is not answerable for the conduct of the delegated Supplier, but records the Supplier's data-modifying actions in the platform's activity log.

1.4. Managers under mandate (three-party chain). Where a manager-Vendor administers properties of another Owner under a management mandate granted within the platform:

• the owner remains the controller of the data of the guests of its own properties;
• the manager processes those data on behalf of the owner, from the grant of the mandate until its revocation (both recorded by the platform; revocation is technically effective from the moment it is recorded). Until the grant and revocation functions are available in the panel, the owner requests them from the Operator (privacy@roraima.io), which carries them out without delay and in any event within 24 hours;
• in processing the owner's data, the manager undertakes to: use them solely for the performance of the mandate; not retain them longer than necessary; adopt appropriate security measures; not disclose them; cooperate on data subjects' requests; and notify the owner and the Operator without undue delay in the event of a breach. Acceptance of this Agreement by both of them constitutes the conclusion, in electronic form, of the instrument required by Article 28(3) GDPR between owner and manager for the processing falling within the scope of the mandate;
• the Operator remains the owner's processor; actions performed by the manager within the platform, within the limits of the mandate, count as instructions of the owner within the meaning of Article 3;
• the platform guarantees: separation of data by company; safeguards that cannot be circumvented (the manager cannot touch the owner's profile, credentials or payment proceeds); and the recording of every data-modifying action of the manager, together with the manager's identity.

1.5. Owners outside the platform. Where the Vendor processes guest data as a processor on behalf of a third-party owner who is not a vendor on the platform, the Operator acts as a sub-processor within the meaning of Article 28(4) GDPR, and the Vendor warrants that its agreement with the owner permits the terms of this Agreement.

2. Subject matter, duration, nature and purposes of the processing

2.1. The Operator processes on behalf of the Vendor the categories of data and of data subjects described in Annex 1, which forms an integral part of this Agreement. In summary, the processing operations are: collection of guests' personal details and pre-arrival information; verification of guests' identity (video message, or processing of document photographs on the property's mini-PC, with biometric comparison between face and document); compilation and transmission of the guest notification records (schedine alloggiati) to the Italian State Police; generation of the files for the regional statistical surveys; calculation and collection of the tourist tax into the Vendor's account; generation and revocation of physical access codes; sending of communications to guests on behalf of the Vendor; delivery to the Vendor of the documents uploaded by the buyer during order verification.

2.2. Special categories of data and minors. Identity verification involves a biometric comparison (Article 9 GDPR) performed exclusively on the mini-PC installed at the property, using local models: no external artificial intelligence service receives the images. Minors are never subjected to biometric processing: for minors, only the textual data necessary to meet legal obligations are collected.

2.3. Duration. The processing lasts for the duration of the contractual relationship, without prejudice to the retention periods set out in Annex 1 and to the legal obligations that survive termination (Article 11).

2.4. Two modes of operation, two responsibilities. The Vendor acknowledges the following distinction, which delimits what the Operator is answerable for:

• Alloggiati Web: the Operator transmits. Using the property credentials supplied by the Vendor, the platform compiles the guest notification and sends it directly to the portal of the Italian State Police. Transmission is initiated only if the Vendor has recorded the arrival, the data for the travel party are complete, and the guests' identity has been verified (or confirmed in person by the Vendor, where video verification has been waived); otherwise the platform alerts the Vendor but does not transmit.
• Statistical surveys (ISTAT): the Operator only prepares. The platform generates the file in the format required by the Region; it is the Vendor who downloads it and personally uploads it to the regional portal using the Vendor's own credentials. No automatic transmission takes place.

2.5. Recipient authorities. The Italian State Police and the statistical bodies receive the data as recipient authorities designated by law: they do not process on behalf of either party and are not sub-processors.

3. Instructions of the Vendor (Article 28(3)(a))

3.1. Configuration constitutes instruction. The Vendor's documented instructions are given through the configuration of the vendor panel, which the platform records and retains. In particular:

• by activating guest-notification compliance for a property and entering the credentials issued by the Italian State Police, the Vendor instructs the Operator to collect guests' personal details and to transmit the guest notifications for that property;
• if the Vendor activates nothing, the Operator transmits nothing and data collection falls back to the minimum profile;
• the switch that includes bookings imported from external calendars (Airbnb, Booking.com and the like) in the mandatory notifications is off until the Vendor turns it on for the individual property;
• the erasure period for the data of the person who made the booking is not currently left to the Vendor: it is a fixed platform term, 730 days from departure, the same for everyone, and the Operator provides no feature to change it. Under no circumstances does the processing fall below a mandatory minimum of 180 days, needed to cover payment chargeback windows. Should the Operator make the term configurable by the Vendor in future, the Vendor's choice will constitute an instruction in all respects within that minimum, and this Agreement will be updated accordingly;
• the collection profile follows the activations: as long as a company has no compliance service enabled, the platform automatically applies the minimum collection profile (essential data only); enabling even one service extends the collection to the data required by the Italian obligations for all of the company's facilities.

3.2. The Operator processes the data only on those documented instructions, including with regard to transfers of data to third countries or international organizations (Article 9), unless required to do otherwise by Union or Italian law to which the Operator is subject: in that case, the Operator informs the Vendor of that requirement before processing, unless the law prohibits it.

3.3. Manifestly infringing instructions. If, in the Operator's opinion, an instruction infringes the GDPR or other data protection provisions, the Operator shall immediately inform the Vendor and may suspend the execution of that instruction.

3.4. Who may give instructions, and how. Instructions are valid if given by the Vendor through its own panel, by one of its authorized users, by an Authorized Supplier within the scope of the delegation (Article 1.3), or by a manager within the scope of the mandate (Article 1.4). Instructions that cannot be given through the panel may be given in writing to privacy@roraima.io by the account holder: the Operator confirms their receipt and feasibility and retains the exchange as a documented instruction.

4. Obligations and rights of the Vendor

4.1. Obligations. The Vendor, as controller:

• warrants that it has a valid legal basis for the processing entrusted to the Operator, including a condition of lawfulness under Article 9(2) GDPR for the biometric identity verification of adult guests who consent to it;
• provides guests with the information required by Articles 13-14 GDPR. Since 3 August 2026 the guest's digital journey carries, on the Vendor's behalf, the complete Article 13 information and the explicit consent for biometric matching and for the video, shown before the corresponding collection and recorded as evidence (text shown, its digest, version, language and time). The Operator undertakes to keep those texts available and to preserve that evidence, and to keep at least one alternative to biometric matching available and free of detriment for the guest — human-reviewed video or in-person verification — since the consent would not be freely given without it. One adjacent path is declared as not yet covered: the "access right" journey still allows an identity video without a recorded consent (identity-verification impact assessment, document 05);
• is responsible for the lawfulness of the instructions it gives and for the accuracy of the data it uploads;
• activates the compliance functions only for properties it legitimately manages, and keeps with due care the credentials it entrusts to the platform.

4.2. Rights. The Vendor is entitled to: give and amend instructions (Article 3); object to new sub-processors (Article 7.2); receive assistance with data subjects' rights, personal data breaches and impact assessments (Article 10); choose between return and erasure of the data upon termination (Article 11); and verify compliance with this Agreement (Article 12).

5. Authorized persons and confidentiality (Article 28(3)(b))

5.1. The Operator ensures that the persons authorized to process the data have committed themselves to confidentiality, and limits their access to what is necessary.

6. Security (Article 28(3)(c) — Article 32 GDPR)

6.1. The Operator adopts and maintains all the measures required by Article 32 GDPR, appropriate to the risk and to the nature of the data processed (including data under Article 9), among them: encryption of the most sensitive data, both at rest and in transit; separation of data by company, so that one vendor's panel cannot reach another vendor's data; minimization of the data shared with external providers; access control and logging of sensitive operations.

6.2. Access by support staff to the Vendor's configuration data takes place only under a specific permission granted by the Vendor, which the Vendor may revoke at any time from their panel and which in any event expires automatically after 7 days, with every action logged.

6.3. A more detailed description of the measures is made available to the Vendor on request, in the manner set out in Article 12.

7. Sub-processors (Articles 28(2) and 28(3)(d))

7.1. General authorization. The Vendor gives its general authorization for the Operator to engage the sub-processors listed in Annex 2. From the effective date of this Agreement, the up-to-date list is maintained on the "Sub-processors" page of the website.

7.2. Updates. To add or replace a sub-processor, the Operator updates that page and notifies Vendors at least 15 days before the new provider receives any data. The Vendor may object on justified data protection grounds; if the objection cannot be resolved, the Vendor may withdraw from the affected service before activation. Changes to the list follow this procedure and do not require a fresh acceptance of this Agreement.

7.3. Same guarantees. With each sub-processor the Operator concludes a contract imposing data protection obligations equivalent to those of this Agreement. The Operator remains fully liable to the Vendor for the performance of the sub-processors.

7.4. Who is NOT a sub-processor. The following are not sub-processors, and the Vendor acknowledges this: the recipient authorities (Article 2.5); the technical providers that receive no personal data of guests (including the cloud services of the manufacturers of the connected locks, to which the platform sends only access codes, validity windows and a neutral booking reference — never the guest's name, contact details or documents); and the independent controllers (such as Stripe for the checks required by law, and the manufacturers with which the Vendor holds its own account — Article 9).

8. Recipients chosen by the Vendor

8.1. The platform allows the Vendor to connect external services of the Vendor's own choosing: calendars of booking portals (Airbnb, Booking.com, Vrbo or other addresses configured by the Vendor), webhooks to the Vendor's own systems, personal API interfaces, the Vendor's own Home Assistant instance, the Vendor's own MQTT broker. In these cases the recipient is determined by the Vendor: the configuration constitutes an instruction to send data to, or receive data from, that service, and the choice and security of the recipient are the Vendor's responsibility.

8.2. The Operator applies the platform's technical protections to these connections (address checks, limits, logging) but is not answerable for the processing carried out by the service chosen by the Vendor.

9. Transfers outside the European Economic Area

9.1. The data processed on behalf of the Vendor reside in the European Union. Certain sub-processors involve transfers outside the EU, subject to the safeguards indicated in Annex 2 (EU-US Data Privacy Framework certification and/or Standard Contractual Clauses).

9.2. No personal data of guests are transferred to the non-EU lock manufacturers (Article 7.4). The credentials the Vendor uses with those manufacturers belong to the Vendor's own contractual relationship with them: in respect of those credentials, the manufacturer is an independent controller and its own terms and privacy notice apply.

10. Assistance to the Vendor (Article 28(3)(e)-(f))

10.1. Data subjects' rights. If a guest exercises a right (access, rectification, erasure, restriction, portability, objection), the addressee of the request is the Vendor, as controller. The Operator assists the Vendor: it carries out the rectifications and erasures requested by the Vendor within 30 days of the request and confirms the outcome in writing, indicating any data retained under a legal obligation and the applicable period (a guest notification already transmitted to the Italian State Police, or a data item still within a mandatory retention period, cannot be erased before that period expires). If a request reaches the Operator directly, the Operator forwards it to the Vendor without responding on the merits, save for any agreed assistance.

10.1-bis. Data retained for defence, not under a legal obligation. For bookings imported from an external channel (Airbnb, Booking.com and the like), an erasure requested by the data subject does not delete the encrypted copy of the channel's original message: it is the only evidence of what the channel communicated and is retained for the establishment, exercise or defence of legal claims (Article 17(3)(e)), in the interest of both the Vendor and the Operator. The operational copies of that data — the guest's name, email and language as supplied by the channel — are erased along with everything else. The retained copy is deleted when the booking's ordinary retention period expires. The Operator discloses this exception to the guest in the wording of the erasure button and to the Vendor in the panel; the Vendor takes it into account when responding to the data subject.

10.2. Personal data breaches. The Operator notifies the Vendor without undue delay of any personal data breach affecting data processed on the Vendor's behalf of which it becomes aware, providing the relevant information required by Article 33(3) GDPR (nature of the breach, categories and approximate number of data subjects, likely consequences, measures taken or proposed) and updating it as it becomes available. The notification is sent to the Vendor's email address registered in the panel. The Operator documents every breach and makes the documentation available to the Vendor for the purposes of Articles 33 and 34; notifying the supervisory authority and the data subjects remains a decision of the Vendor, which the Operator assists.

10.3. Impact assessments and the supervisory authority. The Operator assists the Vendor, insofar as within its remit, with data protection impact assessments (Article 35) and with any consultations with the supervisory authority (Article 36), making its relevant technical documentation available.

11. Return and erasure (Article 28(3)(g))

11.1. During the relationship. The Operator erases the data upon expiry of the periods set out in Annex 1, without prejudice to periods determined by law or by the Vendor's instructions.

11.2. Upon termination: the Vendor chooses. Upon termination of the relationship, the Operator asks the Vendor, through the panel or at the contact details on record, whether it prefers the return or the erasure of the data processed on its behalf. On request, the Operator returns all the data — including the compliance records — in a structured, readable format, within 30 days. If no choice is made within 60 days of termination, the Operator proceeds with erasure. Erasure extends to the copies held by sub-processors; data contained in backup copies are extinguished through the normal backup rotation cycle and in the meantime are neither restored nor used, except where required by law.

11.3. Exceptions. The following are excepted: (a) data whose retention is imposed on the Operator by an obligation under Union or Italian law, retained only for the period and purpose required by law; (b) the records of the compliance tasks performed through the platform (outcomes, dates, receipt identifiers — without the underlying content), which the Operator retains as an independent controller, for the protection of its own rights, for the period indicated in the Privacy Notice.

11.4. Upon the Vendor's written request, the Operator certifies that erasure has been completed.

12. Audits and information (Article 28(3)(h))

12.1. The Operator makes available to the Vendor the information necessary to demonstrate compliance with Article 28 — including the record of processing activities (processor section), the description of the security measures and the up-to-date list of sub-processors — and allows for and contributes to audits within the meaning of Article 28(3)(h).

12.2. The ordinary arrangement is one documentary audit per year, on reasonable notice. The Vendor retains the right to an inspection, directly or through an appointed auditor who is not a competitor of the Operator, where: (a) the documentation proves insufficient in the Vendor's reasoned judgment; (b) a personal data breach affecting the Vendor has occurred; (c) a supervisory authority so requires. The inspection takes place on 30 days' notice (shortened in the event of a breach), during business hours, under a confidentiality undertaking, and with a scope that excludes the data of other vendors (the platform is shared). The costs of audits beyond the annual documentary audit are borne by the Vendor, unless the audit establishes a failure by the Operator to comply.

12.3. Data-modifying operations performed by Authorized Suppliers under delegation or by managers under mandate are recorded by the platform together with the identity of the person performing them; the Vendor may at any time request an extract from the Operator, which provides it within 7 days.

13. No secondary use

The Operator does not use the data of the Vendor's guests for its own purposes: no profiling, no advertising, no disclosure or sale to third parties, no training of artificial intelligence models. This undertaking is an essential part of this Agreement.

14. Liability

14.1. Each party is liable for damage in accordance with Article 82 GDPR: the Operator for the damage caused by processing where it has not complied with the obligations the GDPR places on processors, or where it has acted contrary to the Vendor's lawful instructions; the Vendor for the remainder.

14.2. The indemnities and limitations of liability set out in the contracts to which this Agreement is annexed remain unaffected, to the extent that they are compatible with mandatory data protection law.

15. Term, amendments and final provisions

15.1. This Agreement remains in force for as long as the Operator processes personal data on behalf of the Vendor, and comes to an end upon the final erasure or return of the data (Article 11).

15.2. Amendments follow the same form as the contracts to which this Agreement is annexed: publication of a new version, notice, and acceptance recorded by the platform. Acceptance covers this Agreement and its Annexes in the version included in the accepted text; updates to the list of sub-processors follow Article 7.2. Recorded acceptances preserve the accepted text and are never rewritten.

15.3. Italian law applies; the courts of Sassari have jurisdiction, without prejudice to any mandatory venue provided by law. In the event of divergence between the language versions, the English text prevails, without prejudice to any non-derogable protections attaching to the Vendor's own language.

Annex 1 — Description of the processing

Annex 2 — Authorized sub-processors (as at the date of this Agreement)

The up-to-date list, with per-provider detail, is maintained on the "Sub-processors" page of the website from the effective date of this Agreement.

UNITED KINGDOM ADDENDUM

The following provisions apply exclusively to Users who reside in the United Kingdom.

Article 1 – Applicability

1.1. This Addendum applies to Authorized Vendors whose habitual residence or place of establishment is in the United Kingdom, and supplements the Authorized Vendor Agreement and the UK Addendum to the General Terms.

Article 2 – Product Safety and Compliance

2.1. References to the EU General Product Safety Regulation (GPSR, Regulation (EU) 2023/988) and CE marking in the Authorized Vendor Agreement shall, for UK Authorized Vendors, be read as references to the UK Product Safety framework, including the General Product Safety Regulations 2005 (as amended) and UKCA marking requirements.

2.2. UK Authorized Vendors selling physical IoT devices must ensure compliance with the Electrical Equipment (Safety) Regulations 2016, the Radio Equipment Regulations 2017, and applicable BSI standards.

2.3. References to Extended Producer Responsibility (EPR) obligations shall be read as references to the UK EPR for packaging (Environment Act 2021) and the UK WEEE Regulations.

Article 3 – Installation Services (UK-specific)

3.1. UK Authorized Vendors providing IoT installation services involving electrical work must comply with BS 7671 (IET Wiring Regulations) and, where applicable, be registered with a competent person scheme (e.g., NICEIC, NAPIT, ELECSA) for self-certification under Part P of the Building Regulations (England and Wales) or equivalent requirements in Scotland/Northern Ireland.

Article 4 – Consumer Warranty

4.1. References to the EU legal guarantee of conformity (Directive (EU) 2019/771) shall, for UK consumers, be read as references to the Consumer Rights Act 2015, in particular the provisions on goods (sections 9–17), digital content (sections 33–41), and services (sections 48–52).

Article 5 – Tax Compliance

5.1. UK Authorized Vendors must comply with HMRC requirements, including UK VAT obligations and the Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023.

Acceptance

This UK Addendum to the Authorized Vendor Agreement is accepted as part of the vendor onboarding process.

© 2026 Roraima – All rights reserved.

SWITZERLAND ADDENDUM

The following provisions apply exclusively to Users who reside in Switzerland.

Article 1 – Applicability

1.1. This Addendum applies to Authorized Vendors whose habitual residence or place of establishment is in Switzerland, and supplements the Authorized Vendor Agreement and the Switzerland Addendum to the General Terms.

Article 2 – Product Safety and Compliance

2.1. References to GPSR and CE marking in the Authorized Vendor Agreement do not directly apply in Switzerland. Swiss product safety is governed by the PrSG (Product Safety Act) and PrSV (Product Safety Ordinance). However, devices bearing CE marking are generally accepted in Switzerland under the Mutual Recognition Agreement (MRA) with the EU for certain product categories.

2.2. Swiss Authorized Vendors must comply with the NIV (Niederspannungs-Installationsverordnung / Ordinance on Low-Voltage Installations) for electrical installation work and must hold valid ESTI (Federal Inspectorate for Heavy Current Installations) authorizations where required.

Article 3 – Installation Services (Switzerland-specific)

3.1. Swiss Authorized Vendors providing electrical installation services must hold a valid installation permit (Installationsbewilligung) issued by ESTI, in accordance with the NIV. The Operator may require proof of such authorization as part of the verification process.

Article 4 – Consumer Warranty

4.1. References to the EU legal guarantee of conformity (Directive (EU) 2019/771) shall be read as references to Articles 197–210 OR (Swiss Code of Obligations). Note that the standard Swiss warranty period for movable goods is two (2) years from delivery (Article 210 OR).

Article 5 – Tax and Customs

5.1. Swiss Authorized Vendors are responsible for Swiss VAT compliance under the MWSTG, including registration and reporting obligations.

5.2. For physical devices shipped from Switzerland to EU customers, the Swiss Authorized Vendor is responsible for customs declarations and export procedures. Import VAT and customs duties in the destination country are the responsibility of the recipient unless DDP (Delivered Duty Paid) terms apply.

Acceptance

This Switzerland Addendum to the Authorized Vendor Agreement is accepted as part of the vendor onboarding process.

© 2026 Roraima – All rights reserved.