RORAIMA

IoT Marketplace

DEVICE OWNER SERVICE AGREEMENT

(Owner Agreement)

Version 1.9 – 11 October 2026

This Agreement supplements the General Terms and Conditions of Use and governs the relationship between the Operator and the Device Owner (Owner) in connection with booking or rental services that may include access to IoT controls, and with Equipment and Space Use Services, through the Roraima marketplace.

Operator: Roraima — Startup di Dario Salaris, Via Firenze 16, 07039 Valledoria (SS), Italy

Article 1 – Scope and Relationship with General Terms

1.1. This Device Owner Service Agreement (hereinafter, the “Agreement”) governs the specific terms under which the Device Owner (as defined in the General Terms and Conditions of Use) is authorized to list and offer booking or rental services that may include access to IoT controls and Equipment and Space Use Services, manage Delegations, and use the additional Services provided by the Platform.

1.2. This Agreement supplements and forms an integral part of the General Terms and Conditions of Use (the “General Terms”). All defined terms used herein and not otherwise defined shall have the meaning ascribed to them in the General Terms. In the event of conflict between this Agreement and the General Terms, this Agreement shall prevail to the extent of the inconsistency.

1.3. By selecting a Plan and completing the vendor onboarding process, the Device Owner expressly accepts this Agreement in its entirety.

Article 2 – Eligibility and Onboarding

2.1. To register as a Device Owner, the applicant must: (a) be a natural or legal person registered in one of the 32 countries of the Stripe Europe region; (b) lawfully own or have legitimate control over at least one IoT device capable of being registered on the Platform; and (c) provide accurate and complete information during the registration process.

2.2. Required information. The Device Owner shall provide, at a minimum: legal name (or business name), tax identification number (where applicable), Primary Place of Business address, contact email, phone number, and any additional information required by the Platform or by Stripe for KYC (Know Your Customer) purposes. The company phone number provided in the profile is shown to the guest on the page of their booking, so that the guest may contact the Device Owner during identity verification.

2.3. The Device Owner must create and maintain an active Stripe Connect account linked to their Platform Account. Failure to maintain an active Stripe Connect account shall result in the automatic disabling of all Products listed by the Device Owner. The Operator reserves the right to suspend the Device Owner’s Account until the Stripe Connect account is reactivated.

2.4. The Device Owner acknowledges that the Operator and/or Stripe may perform identity verification, credit checks, and compliance screening as part of the onboarding process and on an ongoing basis. The Device Owner agrees to cooperate fully with such verification.

2.5. Non-professional vendors. Registration as a Device Owner is also permitted for natural persons offering booking or rental services outside a business or professional activity (for example, occasional hosts without a VAT number). The Device Owner shall correctly indicate their status, professional or non-professional, among the information referred to in Article 2.2 and keep it up to date; such status is relevant for the purposes of the information obligations towards Buyers provided for by law. The status declaration must reflect the Device Owner's actual situation: under EU law the qualification as trader depends on objective factors (regularity, organisation, profit-making purpose), and falsely claiming not to be a trader is a prohibited commercial practice (point 22 of Annex I to Directive 2005/29/EC). Where the Device Owner qualifies as a consumer under applicable law, the mandatory protections provided in their favour remain unaffected, including the right to withdraw from this Agreement within fourteen (14) days of its conclusion — it being understood that withdrawal does not affect obligations already undertaken towards Buyers with confirmed bookings — and the consumer jurisdiction under Article 18.3 of the General Terms.

Article 3 – Subscription Plans and Fees

3.1. The subscription Plan available to the Device Owner is the following:

Monthly Credits. The monthly Credits indicated in the table are assigned as Complimentary Credits, governed by Article 7.8 of the General Terms.

3.2. Where the Plan provides for a fee, it is debited to the Device Owner’s accounting balance, which may be consulted in the “Accounting” section of the panel (the “Balance”), in the full amount upon activation of the Plan and, thereafter, at the beginning of each billing period. The amount debited is due from the time of the debit and is paid from the panel, by payment card, on the Operator’s payment page. The Operator does not withhold the fee from the Device Owner’s receipts, which are credited directly to the latter’s Stripe account. Where the Balance is negative, the Operator shall notify the Device Owner by email and in the panel, stating the amount due and the payment deadline, which is seven (7) calendar days from the sending of the notice. If that deadline expires without payment, the Operator shall deactivate all of the Device Owner’s Product listings. If the unpaid amount includes Plan fees, the Operator shall also assign the Device Owner to the free Plan corresponding to their category of vendor, and the unpaid fees relating to the abandoned Plan shall be deemed extinguished. The Account is neither suspended nor deactivated: the Device Owner may reactivate their Product listings within the limits of the Plan to which they are assigned and may again select a paid Plan, on the terms in force at that time. If the Balance remains negative for amounts other than the fee, the Product listings shall remain deactivated until such amounts are paid.

3.3. The Device Owner may switch to another Plan at any time, and the switch takes effect immediately. Switching to a paid Plan entails the immediate debit to the Balance of the full fee of the new Plan; the new billing period runs from the date of the switch.

3.4. The Operator reserves the right to modify subscription fees with at least thirty (30) calendar days’ advance written notice, in accordance with Article 17 of the General Terms.

Article 4 – Collections and Payouts

4.1. The Operator does not charge or withhold any Commission on the Device Owner’s transactions, in accordance with Article 8.4 of the General Terms. The price paid by the Buyer accrues in full to the Device Owner, net only of the fees applied by Stripe to the payment.

4.2. The Buyer’s payment is collected directly into the Device Owner’s Stripe Connect account, without any deduction by the Operator. Payouts to the Device Owner’s bank account are made by Stripe.

4.3. Payout timing is subject to Stripe’s standard processing schedules. The Operator does not guarantee specific Payout dates and shall not be liable for any delay caused by Stripe, the banking system, or regulatory holds. Stripe may impose additional holding periods for new accounts or flagged transactions.

4.4. The Device Owner is solely responsible for the accuracy of their Stripe Connect account details. The Operator shall not be liable for Payouts sent to incorrect or outdated account information.

4.5. Precautionary measures. Where: (a) there is a pending dispute, chargeback or refund claim; (b) the Operator reasonably suspects fraudulent activity; (c) the Device Owner is in material breach of this Agreement; or (d) this is required by applicable law or by an order of a competent authority, the Operator may, including with immediate effect and without notice, suspend the publication of the Device Owner’s Products and the acceptance of new orders, restrict access to the Account pursuant to Article 15.2 of the General Terms and exercise the power set out in Article 8.10 of the General Terms, without prejudice to Article 15.4 of the General Terms. Payouts shall in any event be made by Stripe in accordance with the terms governing the Device Owner’s Stripe Connect account.

4.6. Currency. Transactions are processed in the local currency of the applicable Storefront. Payouts are made in the currency of the Device Owner’s Stripe Connect account. Currency conversion, if applicable, is handled by Stripe at its prevailing exchange rate and is subject to Stripe’s foreign exchange fees.

4.7. Costs arising from disputes (chargebacks). Amounts subject to chargeback, dispute or reversal relating to the Device Owner’s transactions, together with the fees and penalties applied by Stripe, are debited by Stripe to the Device Owner’s Stripe Connect account in accordance with the terms governing it and shall be borne exclusively by the Device Owner, unless the dispute arises from an act directly attributable to the Operator. The Device Owner shall cooperate in good faith in the handling of disputes, promptly providing the documentation requested by Stripe or the Operator.

4.8. The prudential exposure limit set out in Article 8.9 of the General Terms and Conditions of Use applies.

4.9. The Operator makes available to the Device Owner the tool for requesting from the Buyer the payment of further sums in connection with the stay, which are collected directly into the Stripe account connected to the property. The Device Owner is solely liable for the request, its amount and its merits; the Operator does not verify its content.

Article 6 – Delegations to Authorized Vendors

6.1. The Device Owner may delegate operational access to their registered devices to one or more Authorized Vendors by generating a pairing code (format: INS-XXXXXX) through the Platform.

6.2. Scope of delegation. An Authorized Vendor operating under Delegation may: manage devices, create Scenarios, test automations, and perform operational tasks on behalf of the Device Owner. The Authorized Vendor may not: delete devices, modify system device types, create their own IoT Products, or sub-delegate.

6.3. The Device Owner may revoke any Delegation at any time, with immediate effect. Upon revocation, the Authorized Vendor’s access to the delegated devices shall cease immediately. Delegations are also automatically revoked if the Authorized Vendor’s profile becomes inactive.

6.4. All actions performed by an Authorized Vendor under Delegation are recorded in the Platform’s audit log with full traceability. The Device Owner acknowledges that the Platform records the identity, timestamp, and nature of every action performed under Delegation.

6.5. Liability. The Device Owner is responsible for selecting qualified Authorized Vendors and for supervising their activities. The Operator shall not be liable for any loss, damage, or malfunction caused by an Authorized Vendor acting under Delegation. The Device Owner shall indemnify the Operator against any claims arising from the acts or omissions of Authorized Vendors operating under Delegation.

Article 7 – Tax, Regulatory and Compliance Obligations

7.1. Tax responsibility. The Device Owner is solely responsible for determining and fulfilling all tax obligations arising from their activities on the Platform, including but not limited to: income tax, VAT/GST, and any other applicable local, national, or international taxes. The Operator does not provide tax advice.

7.2. Where required by applicable law (including but not limited to Council Directive (EU) 2021/514 – DAC7), the Operator may be obligated to collect and report information about the Device Owner and their transactions to tax authorities. The Device Owner consents to such reporting and agrees to provide all information necessary for the Operator’s compliance.

7.3. The Device Owner shall comply with all applicable laws and regulations, including but not limited to: consumer protection laws, product safety regulations, data protection laws, anti-money laundering requirements, and any sector-specific regulations applicable to IoT devices and home automation in the Device Owner’s jurisdiction.

7.4. The Device Owner shall maintain adequate insurance coverage for their activities on the Platform, including, where applicable, professional liability insurance and product liability insurance.

Article 7-bis – Compliance Services for Accommodation Facilities

7-bis.1. Tools provided. For facilities located in Italy, the Platform provides the Device Owner with tools for hospitality-related obligations: the collection of guests’ personal details and of the data required by law; the composition and electronic transmission of the guest notification forms (“schedine alloggiati”) to the Italian State Police; the generation of the files for the regional statistical surveys on tourism; the calculation of the tourist tax and, where enabled, its collection directly into the Device Owner’s Stripe account.

7-bis.2. Ownership of the obligations. The notification, survey, and payment obligations remain exclusively with the Device Owner, as operator of the facility (including the obligations under Article 109 of the Italian T.U.L.P.S. and the Ministerial Decree of 7 January 2013 for guest notifications, the statistical legislation, and the municipal regulations on the tourist tax). The Platform is a support tool: it does not replace the Device Owner and does not provide legal or tax advice.

7-bis.3. The vendor declares, the system prepares. The compliance services operate according to this principle: (a) the activation of the services for a facility is carried out from the vendor panel and amounts to an instruction of the Device Owner; (b) the transmission of the guest notification forms starts only if the Device Owner has registered the arrival and if the data of the guest group are complete and the guests’ identity has been verified or confirmed in person by the Device Owner; otherwise the Platform warns but does not transmit; (c) for the statistical surveys the Platform only generates the file: the upload to the regional portal is carried out personally by the Device Owner with their own credentials.

7-bis.4. Credentials and limits of liability. The credentials for the authorities’ portals (for example, Alloggiati Web) are provided by the Device Owner, who guarantees their validity and updating. The Operator is responsible for the technical operation of the tools under the terms of the Data Processing Agreement set out in the Appendix; it is not responsible for omissions or delays attributable to missing or incorrect data, unregistered arrivals, invalid credentials, or the unavailability of the authorities’ portals.

7-bis.5. Data protection. The processing of guests’ personal data in the context of the compliance services is governed by the Data Processing Agreement (Article 28 GDPR) set out in the Appendix to this Agreement, which forms an integral part of it.

Article 8 – Content, Micro-store and Branding

8.1. The Device Owner may customize their Micro-store within the limits defined by the Platform’s design guidelines. The Device Owner is solely responsible for the content of their Micro-store, including product descriptions, images, pricing, and any informational content.

8.2. The Device Owner grants the Operator a non-exclusive, worldwide, royalty-free, sublicensable license to use, display, reproduce, and distribute the Device Owner’s Product listings and Micro-store content for the purpose of operating and promoting the Platform.

8.3. Except as provided in Article 8-bis.4, the Device Owner shall not use the Platform to promote competing marketplaces, redirect traffic away from the Platform, or engage in any activity that undermines the Platform’s commercial interests.

Article 8-bis – stay.roraima.io Portal

8-bis.1. Purpose. The Operator operates the search portal accessible at stay.roraima.io (the "Portal"), which enables any user to search the Device Owners' offers by location, dates, number of guests and further criteria, and which refers the user, for booking and payment, to the Device Owner's Micro-store by means of a link carrying the search parameters. The Portal does not allow contracts to be concluded or payments to be made; the contract is concluded on the Micro-store, between the Buyer and the Device Owner, in accordance with the General Terms.

8-bis.2. Display of offers. The Device Owner's offers that are active on the Platform as booking or rental services by the night or as services bookable in time slots, including experiences and the use of spaces and services, are displayed on the Portal; the Equipment and Space Use Services referred to in Article 5.2 are not displayed. The offers are displayed as a form of promotion falling within the license referred to in Article 8.2. The Device Owner does not have the option to exclude individual active offers from the Portal; an offer that is deactivated, suspended or removed from the Platform ceases to be displayed on the Portal. For each offer, the Portal shows the content published by the Device Owner, including the title, images, description, price, type of property, location and an approximate position on the map, placed within an area of approximately one kilometer and marked as such; the address of the property is disclosed only to the Buyer who has made a booking. Being displayed on the Portal entails no charge for the Device Owner.

8-bis.3. Ranking of results. Pursuant to Article 5 of Regulation (EU) 2019/1150, the Device Owners' offers are presented on the Portal according to the following main parameters, listed in order of relative importance: (a) the straight-line distance between the approximate position of the property referred to in Article 8-bis.2 and the location indicated in the search, in ascending order, rounded to the kilometer, as the prevailing parameter because it corresponds to the first criterion expressed by the user; (b) where the distance is equal, the price, in ascending order: the total price for the dates and number of guests indicated or, where no dates are indicated, the starting price stated in the offer; (c) where the preceding parameters are equal, the length of time for which the offer has been published, with precedence given to the offer published for the longest time, for the sole purpose of ensuring a stable order. Where no location is indicated in the search, the parameters referred to in letters (b) and (c) apply. The filters selected by the user exclude non-matching offers without altering the order of the remaining offers. The Plan subscribed to by the Device Owner, the Roraima Credits and any other direct or indirect remuneration paid to the Operator do not affect the ranking of results. The ranking is not personalized on the basis of the user's profile. The description of the parameters is also published on the "How we rank the results" page of the Portal; changes to it are notified to the Device Owner in accordance with Article 17 of the General Terms.

8-bis.4. Link to the property on Booking.com. The Device Owner may, at their discretion, enter in the panel the link to the page of the same property on the Booking.com website. By entering the link, the Device Owner authorizes the Operator to display it on the Portal next to their offer. The Device Owner warrants that the link refers to the property that is the subject of the offer and to a listing managed or authorized by them. Entering the link pursuant to this Article does not constitute a breach of Article 8.3. The Operator may decline to display, or may remove, a link that does not meet these requirements.

8-bis.5. Third-party content on the Portal. The Device Owner acknowledges that the Portal may display, separately from the Device Owners' offers and with an indication of their nature: (a) search links to third-party booking websites; (b) accommodation establishments not registered on the Platform, taken from public lists. Such content may also concern the Device Owner's property offered on other channels on different terms. Such content does not affect the ranking referred to in Article 8-bis.3. The Operator does not require the Device Owner to apply, on the Micro-store, prices or terms not exceeding those applied on other sales channels.

8-bis.6. Data generated by the Portal. The Operator collects aggregated data on the use of the Portal, including the number of searches per location, category and day and the number of searches returning no Device Owner offers; such data contain no personal data and may be used to improve and promote the Platform. The personal data of Portal users are processed by the Operator as controller in accordance with the privacy notice published on the Portal; the Device Owner receives only the data that the user communicates to them when booking on the Micro-store or contacting them.

Article 9 – Checkout Extra Information

9.1. The Device Owner may configure custom fields to request additional information from the Buyer at checkout (e.g., delivery address for IoT installation, specific device preferences). Such information is transmitted to the Device Owner upon order confirmation.

9.2. Data protection. The Platform does not archive checkout extra information beyond the duration of the transaction. The Device Owner, as an independent data controller, is solely responsible for the lawful collection, processing, and storage of such data in compliance with the GDPR and applicable national legislation.

9.3. The Device Owner shall not use checkout fields to collect sensitive personal data (as defined in Article 9 of the GDPR), including but not limited to health data, biometric data, political opinions, or religious beliefs, unless absolutely necessary for the provision of the service and in compliance with the GDPR.

Article 10 – IoT Controls Included in Bookings and in Equipment and Space Use Services, and Gateways

10.1. IoT-control permissions may be issued only to the Buyer or authorized guest for a valid booking or rental and only for the configured access window, or to the Buyer of an Equipment and Space Use Service, only for the functions configured by the Device Owner and for the duration of the period of use or programme started on site under Article 5.2. They are a technical component of that service and not a separately sold digital product.

10.2. The Device Owner may configure web, API, webhook or local-gateway channels solely as technical means of delivering the IoT functions included in the booking or rental. The Device Owner remains responsible for their security, configuration, availability and maintenance. In Equipment and Space Use Services, the IoT functions are delivered only through the Operator’s gateway and the Buyer’s page on the Platform.

10.3. Custom channels create additional security risks. The Device Owner must apply appropriate access controls and may not expose credentials or functions beyond the scope and duration of the relevant booking, rental or Equipment and Space Use Service.

Article 11 – Suspension, Termination and Consequences

11.1. The provisions of Article 15 of the General Terms apply to this Agreement. In addition, the Operator may suspend or terminate the Device Owner’s access specifically if: (a) the Device Owner’s chargeback rate exceeds thresholds established by Stripe or the Operator; (b) the Device Owner repeatedly fails to maintain device availability (more than three substantiated complaints in any thirty-day period); or (c) the Device Owner lists Products that violate safety regulations or pose a risk to persons or property.

11.2. Effects on confirmed bookings. Upon termination, the Device Owner must honour confirmed bookings and Equipment and Space Use Services already paid, or provide the remedies and refunds required by applicable law and the relevant offer. Any IoT credentials already issued remain valid only for the corresponding booking window or, for Equipment and Space Use Services, until the end of the period within which, under the offer, the Tokens or the time of use must be used. Refunds due may be ordered by the Operator on behalf of the Device Owner under Article 8.10 of the General Terms, including after termination.

11.3. Final settlement. Upon termination: (a) Payouts continue to be made by Stripe in accordance with the terms governing the Device Owner’s Stripe Connect account; (b) the Operator shall provide the Device Owner with a final settlement statement; (c) the Device Owner shall keep its Stripe Connect account connected to the Platform until all paid orders have been performed, refunded or otherwise settled, so as to allow refunds, disputes and chargebacks to be handled.

11.4. The Device Owner may terminate this Agreement at any time by canceling their vendor subscription through the Platform. Termination shall take effect at the end of the current billing period. No refund shall be due for the remaining portion of the current billing period.

Article 12 – Representations and Warranties

12.1. The Device Owner represents and warrants that:

(a) the Device Owner has the legal capacity and authority to enter into and perform this Agreement;

(b) all information provided to the Operator is accurate, current, and complete;

(c) the Device Owner lawfully owns or controls all IoT devices registered on the Platform;

(d) all Products listed comply with applicable laws, safety regulations, and these Terms;

(e) the Device Owner’s use of the Platform does not infringe upon the rights of any third party;

(f) the Device Owner will comply with all applicable tax, consumer protection, and data protection laws;

(g) the Device Owner holds all necessary licenses, permits, and certifications for their activities;

(h) the Operator’s access to the data generated by the connected devices takes place on the Device Owner’s instructions, for the sole purposes of the service, and the Device Owner is entitled to make such data available to the Operator in accordance with the manufacturer’s terms and applicable law.

12.2. The Device Owner acknowledges that any breach of the representations and warranties set forth in this Article constitutes a material breach of this Agreement and may result in immediate suspension or termination, without prejudice to the Operator’s right to claim damages.

Article 13 – Specific Indemnification

13.1. Without prejudice to Article 14 of the General Terms, the Device Owner specifically agrees to indemnify, defend, and hold harmless the Operator from and against any claims arising from: (a) device malfunction, including damage to persons or property; (b) unauthorized surveillance, data collection, or privacy violations through IoT devices; (c) product safety violations; (d) breach of consumer rights; (e) incorrect or misleading Product listings; (f) tax non-compliance; and (g) the acts or omissions of Authorized Vendors operating under Delegation.

Article 14 – Governing Law and Final Provisions

14.1. This Agreement shall be governed by and construed in accordance with the laws of Italy, in accordance with Article 18 of the General Terms.

14.2. The provisions of the General Terms regarding amendments (Article 17), dispute resolution (Article 16), force majeure (Article 19.3), and severability (Article 19.1) apply mutatis mutandis to this Agreement.

14.3. This Agreement, together with the General Terms, the Privacy Policy, and any applicable policies, constitutes the entire agreement between the Device Owner and the Operator with respect to the subject matter hereof.

Acceptance

By selecting a subscription Plan and completing the vendor onboarding process, the Device Owner confirms that they have read, understood, and accepted this Device Owner Service Agreement in its entirety, in conjunction with the General Terms and Conditions of Use and the Data Processing Agreement (Article 28 GDPR) set out in the Appendix, which forms an integral part of this Agreement.

Last updated: 11 October 2026

Previous version: 1.8 – 6 October 2026

© 2026 Roraima – All rights reserved.

Access data processing — igloohome smart locks (Singapore)

Where the Owner enables guest access through smart locks operated via igloohome, it does so using its own igloohome account and remains the data controller for that processing. igloohome is provided by Igloocompany Pte. Ltd. (Singapore), a non-EU provider. Under igloohome's API terms, the Owner must have a valid legal basis and obtain any necessary consent before any guest personal data is provided to igloocompany, and is responsible for the security of its igloohome account and API credentials. The Roraima Platform minimises the data sent to igloohome, transmitting only a neutral booking reference (e.g. "Roraima #<booking id>") and never the guest's name or contact details. Access events received via an active Wi-Fi bridge are processed solely for security and dispute-resolution purposes. Igloocompany declares compliance with the GDPR and UK GDPR in addition to Singapore's PDPA; transfers outside the EEA rely on the adequate safeguards declared by the provider. Further details are set out in the Roraima Privacy Policy.

Appendix – Data Processing Agreement (Article 28 GDPR)

Appendix to the contracts of the Roraima platform — an integral part of the contract to which it is attached. The text of this Agreement, including its Annexes, is included in the content of the contract page: acceptance of the contract includes the Agreement in the version included in the accepted text.

Recitals

When a Vendor uses the Roraima platform to manage bookings and stays, the platform collects and processes personal data of the Vendor's guests: personal details, identity documents, mandatory communications to the authorities, access codes. For these data the controller is the Vendor — because the law places the relevant obligations on the Vendor (notification of guests to the Italian State Police (Polizia di Stato), tourism statistical surveys, tourist tax) and it is the Vendor who decides how to manage its own guests. Roraima is the instrument: it processes those data on behalf of the Vendor and in accordance with the Vendor's instructions.

This Agreement governs that relationship pursuant to Article 28 of Regulation (EU) 2016/679 (the "GDPR"). In the event of conflict with the general clauses of the contracts to which it is annexed, this Agreement prevails for data protection matters (in particular, it supplements and further specifies Article 12.2(b) of the General Terms and Conditions).

1. Parties and roles

1.1. The parties are:

• the Vendor (the party that has entered into the Service Contract for Owners), acting as controller of the personal data of its own guests and of the persons staying at its properties;
• Dario Salaris — «Roraima — Startup di Dario Salaris», Via Firenze 16, 07039 Valledoria (SS), Italy, privacy contact privacy@roraima.io (the "Operator"), acting as processor.

1.2. What this Agreement does NOT cover. The following remain outside its scope, because they have a different controller:

• data for which the Operator determines purposes and means on its own account (platform accounts, marketplace orders, technical logs, conversational assistants used by the Vendor itself): for those data the Operator is the controller and the Privacy Notice applies;
• data that the Vendor collects as an independent controller (extra information at checkout, Article 9 of the Contract; data collected in person at the property);
• data that external service providers process as independent controllers (for example Stripe for anti-fraud checks and vendor identification, or the lock manufacturers with respect to the account the Vendor holds with them — Article 9 of this Agreement).

1.3. Authorized Suppliers under delegation. Where the Vendor delegates an Authorized Supplier (Article 6 of the Contract), the Supplier processes the data it accesses as a processor of the Vendor, on the terms already laid down by Article 12 of the Contract for Authorized Suppliers. The Operator is not answerable for the conduct of the delegated Supplier, but records the Supplier's data-modifying actions in the platform's activity log.

1.4. Managers under mandate (three-party chain). Where a manager-Vendor administers properties of another Owner under a management mandate granted within the platform:

• the owner remains the controller of the data of the guests of its own properties;
• the manager processes those data on behalf of the owner, from the grant of the mandate until its revocation (both recorded by the platform; revocation is technically effective from the moment it is recorded). Until the grant and revocation functions are available in the panel, the owner requests them from the Operator (privacy@roraima.io), which carries them out without delay and in any event within 24 hours;
• in processing the owner's data, the manager undertakes to: use them solely for the performance of the mandate; not retain them longer than necessary; adopt appropriate security measures; not disclose them; cooperate on data subjects' requests; and notify the owner and the Operator without undue delay in the event of a breach. Acceptance of this Agreement by both of them constitutes the conclusion, in electronic form, of the instrument required by Article 28(3) GDPR between owner and manager for the processing falling within the scope of the mandate;
• the Operator remains the owner's processor; actions performed by the manager within the platform, within the limits of the mandate, count as instructions of the owner within the meaning of Article 3;
• the platform guarantees: separation of data by company; safeguards that cannot be circumvented (the manager cannot touch the owner's profile, credentials or payment proceeds); and the recording of every data-modifying action of the manager, together with the manager's identity.

1.5. Owners outside the platform. Where the Vendor processes guest data as a processor on behalf of a third-party owner who is not a vendor on the platform, the Operator acts as a sub-processor within the meaning of Article 28(4) GDPR, and the Vendor warrants that its agreement with the owner permits the terms of this Agreement.

2. Subject matter, duration, nature and purposes of the processing

2.1. The Operator processes on behalf of the Vendor the categories of data and of data subjects described in Annex 1, which forms an integral part of this Agreement. In summary, the processing operations are: collection of guests' personal details and pre-arrival information; verification of guests' identity (video message, or processing of document photographs on the property's mini-PC, with biometric comparison between face and document); compilation and transmission of the guest notification records (schedine alloggiati) to the Italian State Police; generation of the files for the regional statistical surveys; calculation and collection of the tourist tax into the Vendor's account; generation and revocation of physical access codes; sending of communications to guests on behalf of the Vendor; delivery to the Vendor of the documents uploaded by the buyer during order verification.

2.2. Special categories of data and minors. Identity verification involves a biometric comparison (Article 9 GDPR) performed exclusively on the mini-PC installed at the property, using local models: no external artificial intelligence service receives the images. Minors are never subjected to biometric processing: for minors, only the textual data necessary to meet legal obligations are collected.

2.3. Duration. The processing lasts for the duration of the contractual relationship, without prejudice to the retention periods set out in Annex 1 and to the legal obligations that survive termination (Article 11).

2.4. Two modes of operation, two responsibilities. The Vendor acknowledges the following distinction, which delimits what the Operator is answerable for:

• Alloggiati Web: the Operator transmits. Using the property credentials supplied by the Vendor, the platform compiles the guest notification and sends it directly to the portal of the Italian State Police. Transmission is initiated only if the Vendor has recorded the arrival, the data for the travel party are complete, and the guests' identity has been verified (or confirmed in person by the Vendor, where video verification has been waived); otherwise the platform alerts the Vendor but does not transmit.
• Statistical surveys (ISTAT): the Operator only prepares. The platform generates the file in the format required by the Region; it is the Vendor who downloads it and personally uploads it to the regional portal using the Vendor's own credentials. No automatic transmission takes place.

2.5. Recipient authorities. The Italian State Police and the statistical bodies receive the data as recipient authorities designated by law: they do not process on behalf of either party and are not sub-processors.

3. Instructions of the Vendor (Article 28(3)(a))

3.1. Configuration constitutes instruction. The Vendor's documented instructions are given through the configuration of the vendor panel, which the platform records and retains. In particular:

• by activating guest-notification compliance for a property and entering the credentials issued by the Italian State Police, the Vendor instructs the Operator to collect guests' personal details and to transmit the guest notifications for that property;
• if the Vendor activates nothing, the Operator transmits nothing and data collection falls back to the minimum profile;
• the switch that includes bookings imported from external calendars (Airbnb, Booking.com and the like) in the mandatory notifications is off until the Vendor turns it on for the individual property;
• the erasure period for the data of the person who made the booking is not currently left to the Vendor: it is a fixed platform term, 730 days from departure, the same for everyone, and the Operator provides no feature to change it. Under no circumstances does the processing fall below a mandatory minimum of 180 days, needed to cover payment chargeback windows. Should the Operator make the term configurable by the Vendor in future, the Vendor's choice will constitute an instruction in all respects within that minimum, and this Agreement will be updated accordingly;
• the collection profile follows the activations: as long as a company has no compliance service enabled, the platform automatically applies the minimum collection profile (essential data only); enabling even one service extends the collection to the data required by the Italian obligations for all of the company's facilities.

3.2. The Operator processes the data only on those documented instructions, including with regard to transfers of data to third countries or international organizations (Article 9), unless required to do otherwise by Union or Italian law to which the Operator is subject: in that case, the Operator informs the Vendor of that requirement before processing, unless the law prohibits it.

3.3. Manifestly infringing instructions. If, in the Operator's opinion, an instruction infringes the GDPR or other data protection provisions, the Operator shall immediately inform the Vendor and may suspend the execution of that instruction.

3.4. Who may give instructions, and how. Instructions are valid if given by the Vendor through its own panel, by one of its authorized users, by an Authorized Supplier within the scope of the delegation (Article 1.3), or by a manager within the scope of the mandate (Article 1.4). Instructions that cannot be given through the panel may be given in writing to privacy@roraima.io by the account holder: the Operator confirms their receipt and feasibility and retains the exchange as a documented instruction.

4. Obligations and rights of the Vendor

4.1. Obligations. The Vendor, as controller:

• warrants that it has a valid legal basis for the processing entrusted to the Operator, including a condition of lawfulness under Article 9(2) GDPR for the biometric identity verification of adult guests who consent to it;
• provides guests with the information required by Articles 13-14 GDPR. Since 3 August 2026 the guest's digital journey carries, on the Vendor's behalf, the complete Article 13 information and the explicit consent for biometric matching and for the video, shown before the corresponding collection and recorded as evidence (text shown, its digest, version, language and time). The Operator undertakes to keep those texts available and to preserve that evidence, and to keep at least one alternative to biometric matching available and free of detriment for the guest — human-reviewed video or in-person verification — since the consent would not be freely given without it. One adjacent path is declared as not yet covered: the "access right" journey still allows an identity video without a recorded consent (identity-verification impact assessment, document 05);
• is responsible for the lawfulness of the instructions it gives and for the accuracy of the data it uploads;
• activates the compliance functions only for properties it legitimately manages, and keeps with due care the credentials it entrusts to the platform.

4.2. Rights. The Vendor is entitled to: give and amend instructions (Article 3); object to new sub-processors (Article 7.2); receive assistance with data subjects' rights, personal data breaches and impact assessments (Article 10); choose between return and erasure of the data upon termination (Article 11); and verify compliance with this Agreement (Article 12).

5. Authorized persons and confidentiality (Article 28(3)(b))

5.1. The Operator ensures that the persons authorized to process the data have committed themselves to confidentiality, and limits their access to what is necessary.

6. Security (Article 28(3)(c) — Article 32 GDPR)

6.1. The Operator adopts and maintains all the measures required by Article 32 GDPR, appropriate to the risk and to the nature of the data processed (including data under Article 9), among them: encryption of the most sensitive data, both at rest and in transit; separation of data by company, so that one vendor's panel cannot reach another vendor's data; minimization of the data shared with external providers; access control and logging of sensitive operations.

6.2. Access by support staff to the Vendor's configuration data takes place only under a specific permission granted by the Vendor, which the Vendor may revoke at any time from their panel and which in any event expires automatically after 7 days, with every action logged.

6.3. A more detailed description of the measures is made available to the Vendor on request, in the manner set out in Article 12.

7. Sub-processors (Articles 28(2) and 28(3)(d))

7.1. General authorization. The Vendor gives its general authorization for the Operator to engage the sub-processors listed in Annex 2. From the effective date of this Agreement, the up-to-date list is maintained on the "Sub-processors" page of the website.

7.2. Updates. To add or replace a sub-processor, the Operator updates that page and notifies Vendors at least 15 days before the new provider receives any data. The Vendor may object on justified data protection grounds; if the objection cannot be resolved, the Vendor may withdraw from the affected service before activation. Changes to the list follow this procedure and do not require a fresh acceptance of this Agreement.

7.3. Same guarantees. With each sub-processor the Operator concludes a contract imposing data protection obligations equivalent to those of this Agreement. The Operator remains fully liable to the Vendor for the performance of the sub-processors.

7.4. Who is NOT a sub-processor. The following are not sub-processors, and the Vendor acknowledges this: the recipient authorities (Article 2.5); the technical providers that receive no personal data of guests (including the cloud services of the manufacturers of the connected locks, to which the platform sends only access codes, validity windows and a neutral booking reference — never the guest's name, contact details or documents); and the independent controllers (such as Stripe for the checks required by law, and the manufacturers with which the Vendor holds its own account — Article 9).

8. Recipients chosen by the Vendor

8.1. The platform allows the Vendor to connect external services of the Vendor's own choosing: calendars of booking portals (Airbnb, Booking.com, Vrbo or other addresses configured by the Vendor), webhooks to the Vendor's own systems, personal API interfaces, the Vendor's own Home Assistant instance, the Vendor's own MQTT broker. In these cases the recipient is determined by the Vendor: the configuration constitutes an instruction to send data to, or receive data from, that service, and the choice and security of the recipient are the Vendor's responsibility.

8.2. The Operator applies the platform's technical protections to these connections (address checks, limits, logging) but is not answerable for the processing carried out by the service chosen by the Vendor.

9. Transfers outside the European Economic Area

9.1. The data processed on behalf of the Vendor reside in the European Union. Certain sub-processors involve transfers outside the EU, subject to the safeguards indicated in Annex 2 (EU-US Data Privacy Framework certification and/or Standard Contractual Clauses).

9.2. No personal data of guests are transferred to the non-EU lock manufacturers (Article 7.4). The credentials the Vendor uses with those manufacturers belong to the Vendor's own contractual relationship with them: in respect of those credentials, the manufacturer is an independent controller and its own terms and privacy notice apply.

10. Assistance to the Vendor (Article 28(3)(e)-(f))

10.1. Data subjects' rights. If a guest exercises a right (access, rectification, erasure, restriction, portability, objection), the addressee of the request is the Vendor, as controller. The Operator assists the Vendor: it carries out the rectifications and erasures requested by the Vendor within 30 days of the request and confirms the outcome in writing, indicating any data retained under a legal obligation and the applicable period (a guest notification already transmitted to the Italian State Police, or a data item still within a mandatory retention period, cannot be erased before that period expires). If a request reaches the Operator directly, the Operator forwards it to the Vendor without responding on the merits, save for any agreed assistance.

10.1-bis. Data retained for defence, not under a legal obligation. For bookings imported from an external channel (Airbnb, Booking.com and the like), an erasure requested by the data subject does not delete the encrypted copy of the channel's original message: it is the only evidence of what the channel communicated and is retained for the establishment, exercise or defence of legal claims (Article 17(3)(e)), in the interest of both the Vendor and the Operator. The operational copies of that data — the guest's name, email and language as supplied by the channel — are erased along with everything else. The retained copy is deleted when the booking's ordinary retention period expires. The Operator discloses this exception to the guest in the wording of the erasure button and to the Vendor in the panel; the Vendor takes it into account when responding to the data subject.

10.2. Personal data breaches. The Operator notifies the Vendor without undue delay of any personal data breach affecting data processed on the Vendor's behalf of which it becomes aware, providing the relevant information required by Article 33(3) GDPR (nature of the breach, categories and approximate number of data subjects, likely consequences, measures taken or proposed) and updating it as it becomes available. The notification is sent to the Vendor's email address registered in the panel. The Operator documents every breach and makes the documentation available to the Vendor for the purposes of Articles 33 and 34; notifying the supervisory authority and the data subjects remains a decision of the Vendor, which the Operator assists.

10.3. Impact assessments and the supervisory authority. The Operator assists the Vendor, insofar as within its remit, with data protection impact assessments (Article 35) and with any consultations with the supervisory authority (Article 36), making its relevant technical documentation available.

11. Return and erasure (Article 28(3)(g))

11.1. During the relationship. The Operator erases the data upon expiry of the periods set out in Annex 1, without prejudice to periods determined by law or by the Vendor's instructions.

11.2. Upon termination: the Vendor chooses. Upon termination of the relationship, the Operator asks the Vendor, through the panel or at the contact details on record, whether it prefers the return or the erasure of the data processed on its behalf. On request, the Operator returns all the data — including the compliance records — in a structured, readable format, within 30 days. If no choice is made within 60 days of termination, the Operator proceeds with erasure. Erasure extends to the copies held by sub-processors; data contained in backup copies are extinguished through the normal backup rotation cycle and in the meantime are neither restored nor used, except where required by law.

11.3. Exceptions. The following are excepted: (a) data whose retention is imposed on the Operator by an obligation under Union or Italian law, retained only for the period and purpose required by law; (b) the records of the compliance tasks performed through the platform (outcomes, dates, receipt identifiers — without the underlying content), which the Operator retains as an independent controller, for the protection of its own rights, for the period indicated in the Privacy Notice.

11.4. Upon the Vendor's written request, the Operator certifies that erasure has been completed.

12. Audits and information (Article 28(3)(h))

12.1. The Operator makes available to the Vendor the information necessary to demonstrate compliance with Article 28 — including the record of processing activities (processor section), the description of the security measures and the up-to-date list of sub-processors — and allows for and contributes to audits within the meaning of Article 28(3)(h).

12.2. The ordinary arrangement is one documentary audit per year, on reasonable notice. The Vendor retains the right to an inspection, directly or through an appointed auditor who is not a competitor of the Operator, where: (a) the documentation proves insufficient in the Vendor's reasoned judgment; (b) a personal data breach affecting the Vendor has occurred; (c) a supervisory authority so requires. The inspection takes place on 30 days' notice (shortened in the event of a breach), during business hours, under a confidentiality undertaking, and with a scope that excludes the data of other vendors (the platform is shared). The costs of audits beyond the annual documentary audit are borne by the Vendor, unless the audit establishes a failure by the Operator to comply.

12.3. Data-modifying operations performed by Authorized Suppliers under delegation or by managers under mandate are recorded by the platform together with the identity of the person performing them; the Vendor may at any time request an extract from the Operator, which provides it within 7 days.

13. No secondary use

The Operator does not use the data of the Vendor's guests for its own purposes: no profiling, no advertising, no disclosure or sale to third parties, no training of artificial intelligence models. This undertaking is an essential part of this Agreement.

14. Liability

14.1. Each party is liable for damage in accordance with Article 82 GDPR: the Operator for the damage caused by processing where it has not complied with the obligations the GDPR places on processors, or where it has acted contrary to the Vendor's lawful instructions; the Vendor for the remainder.

14.2. The indemnities and limitations of liability set out in the contracts to which this Agreement is annexed remain unaffected, to the extent that they are compatible with mandatory data protection law.

15. Term, amendments and final provisions

15.1. This Agreement remains in force for as long as the Operator processes personal data on behalf of the Vendor, and comes to an end upon the final erasure or return of the data (Article 11).

15.2. Amendments follow the same form as the contracts to which this Agreement is annexed: publication of a new version, notice, and acceptance recorded by the platform. Acceptance covers this Agreement and its Annexes in the version included in the accepted text; updates to the list of sub-processors follow Article 7.2. Recorded acceptances preserve the accepted text and are never rewritten.

15.3. Italian law applies; the courts of Sassari have jurisdiction, without prejudice to any mandatory venue provided by law. In the event of divergence between the language versions, the English text prevails, without prejudice to any non-derogable protections attaching to the Vendor's own language.

Annex 1 — Description of the processing

Annex 2 — Authorized sub-processors (as at the date of this Agreement)

The up-to-date list, with per-provider detail, is maintained on the "Sub-processors" page of the website from the effective date of this Agreement.

UNITED KINGDOM ADDENDUM

The following provisions apply exclusively to Users who reside in the United Kingdom.

Article 1 – Applicability and Scope

1.1. This Addendum applies to Device Owners whose habitual residence or place of establishment is in the United Kingdom, and supplements the Device Owner Service Agreement and the UK Addendum to the General Terms.

Article 2 – Governing Law

2.1. The provisions of Article 2 of the UK Addendum to the General Terms (governing law: laws of England and Wales, with Scotland/Northern Ireland carve-outs) apply to this Agreement.

Article 3 – Tax and Regulatory Compliance (UK-specific)

3.1. UK-based Device Owners must comply with HMRC requirements, including UK VAT registration where applicable, and Making Tax Digital (MTD) obligations.

3.2. References to DAC7 (Directive (EU) 2021/514) in the Device Owner Service Agreement shall, for UK Device Owners, be read as references to the UK’s equivalent platform reporting obligations (The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023).

Article 4 – Consumer Rights and Refunds

4.1. Where booking or rental services including IoT-control functions are supplied to UK consumers, the pre-contractual information requirements under the Consumer Contracts Regulations 2013 apply, including the clear disclosure of the loss of cancellation right for immediately-supplied digital content.

Article 5 – Insurance

5.1. UK-based Device Owners providing booking or rental services that include home-automation or security-device controls should ensure adequate product liability insurance compliant with the Consumer Protection Act 1987.

Acceptance

This UK Addendum to the Device Owner Service Agreement is accepted as part of the vendor onboarding process.

© 2026 Roraima – All rights reserved.

SWITZERLAND ADDENDUM

The following provisions apply exclusively to Users who reside in Switzerland.

Article 1 – Applicability and Scope

1.1. This Addendum applies to Device Owners whose habitual residence or place of establishment is in Switzerland, and supplements the Device Owner Service Agreement and the Switzerland Addendum to the General Terms.

Article 2 – Tax and Regulatory Compliance (Switzerland-specific)

2.1. Swiss-based Device Owners must comply with Swiss Federal Tax Administration (ESTV/AFC) requirements, including Swiss VAT registration under the MWSTG where applicable (threshold: CHF 100,000 annual turnover from domestic supplies).

2.2. Swiss Device Owners providing booking or rental services with IoT-control functions to customers in EU member states must assess their VAT obligations in the destination country (EU OSS/IOSS schemes do not apply to Swiss businesses directly; separate EU VAT registration may be required).

2.3. For physical devices shipped from Switzerland to EU customers, customs and import VAT implications are the responsibility of the Swiss Device Owner unless otherwise arranged.

Article 3 – Warranty

3.1. The warranty provisions applicable to Swiss Device Owners are governed by Articles 197–210 of the Swiss Code of Obligations (OR), rather than Directive (EU) 2019/771.

Article 4 – Product Safety

4.1. References to the EU General Product Safety Regulation (GPSR, Regulation (EU) 2023/988) in the Device Owner Service Agreement do not apply in Switzerland. Swiss product safety is governed by the Federal Act on Product Safety (PrSG / LSPro) and the associated Ordinance (PrSV / OSPro), which are broadly aligned with EU standards but constitute separate legislation.

Acceptance

This Switzerland Addendum to the Device Owner Service Agreement is accepted as part of the vendor onboarding process.

© 2026 Roraima – All rights reserved.