Your data, and who's responsible for what

HiJiffy is built to be GDPR-compliant by design, and protecting guest data is something we take seriously at every layer of the product. This article explains, in plain terms, how data protection responsibilities are shared between you (the hotel) and HiJiffy.

The core principle: you are the Controller, HiJiffy is the Processor

Under the GDPR, there are two key roles:

• You, the hotel, are the Data Controller. You decide why and how guest data is collected and used. The guest data flowing through HiJiffy belongs to you, not to us.
• HiJiffy is the Data Processor. We store and process that data only on your documented instructions, to deliver the service you've contracted. We never use your guests' data for our own purposes, never sell it, and never share it outside the scope of our agreement with you.

This distinction matters in practice. It means HiJiffy provides the secure, compliant tools and infrastructure for guest communication, while decisions such as which communications to send, on what legal basis, and what your guests are told in your privacy notice remain with you as the Controller. The rest of this section explains how we support you on both sides.

The Data Processing Agreement (DPA)

Every HiJiffy customer contract includes a Data Processing Agreement that formalises this relationship under Article 28 of the GDPR. The DPA sets out the categories of data we process, the purposes, our security obligations, our use of sub-processors, data-transfer safeguards, breach-notification duties and your audit rights. If you need a copy of your DPA, contact your account manager or support@hijiffy.com.

Where to find everything