1. Who this agreement is between
This agreement is part of our Terms of Service. It applies whenever Bello processes personal data on behalf of a business that uses it (“you”). For that data, you are the controller and Wysda Corporation (Pvt) Ltd (“we”) is the processor, as those words are used in Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.
If this agreement and the Terms of Service ever disagree about personal data, this agreement applies.
2. The data and why it’s processed
- Whose data: your guests and customers, your staff, and contacts at your suppliers and corporate clients.
- What data: names and contact details; identity document details recorded at check-in; stays, bookings, orders and payments; preferences and notes; staff attendance, leave and payroll details; and the documents you upload.
- Why: only to provide Bello and the features you use, including support, backups and security.
- How long: for as long as you use Bello, and then until the data is deleted as described below.
3. We follow your instructions
We process your personal data only as you instruct us, through the way you set up and use Bello, these terms and any written instructions you give us. We don’t use it for our own purposes, sell it, or use it to train AI models for anyone else. If we believe an instruction breaks the law, we’ll tell you.
4. Confidentiality and security
Everyone at Wysda Corporation who can access your data is bound to keep it confidential and sees only what their work needs. We protect your data with measures that suit the risk, including:
- keeping every business’s data separate from every other business’s;
- encrypting data while it travels over the internet;
- nightly backups that can be restored if something goes wrong;
- access by role, with important actions recorded;
- keeping our systems updated and monitored.
More detail is on our security page.
5. Our service providers
We use carefully chosen service providers for hosting, email, booking-site connections, messaging, AI processing and payments. Each is bound by a written contract to protect your data at least as well as this agreement does, and we remain responsible for their work. You can ask us for the current list at hello@bellohq.com. We’ll tell you before adding or replacing a provider that processes your data, so you can raise any concern.
6. Where the data goes
Your data is stored on servers in Singapore, Germany and Finland. Where personal data leaves Sri Lanka, we make sure it’s protected as the Personal Data Protection Act requires, through contracts with our providers and the security measures above.
7. Helping with requests from guests and staff
If a guest or member of staff asks to see, correct or delete their data, Bello lets you do most of this yourself. Where you need more help, we’ll assist you. If a request comes to us directly, we’ll pass it on to you rather than answer it ourselves, unless the law requires otherwise.
8. If something goes wrong
If we become aware of a breach affecting your personal data, we’ll tell you without undue delay, explain what happened and what we’re doing about it, and give you the information you need to meet your own duties, including any notice to the Data Protection Authority or to the people affected.
9. Records, assessments and audits
We keep records of how we process your data, and we’ll give you the information you reasonably need to show that you comply with the law, including help with a data protection impact assessment. If that information isn’t enough, you may audit our compliance with reasonable notice, at a time that doesn’t disrupt our service to others, and under confidentiality.
10. When you leave Bello
When your subscription ends, you have 30 days to download your data. We then delete it from our live systems within a further 60 days, and from backups as they’re overwritten, unless the law requires us to keep part of it. We can confirm the deletion in writing if you ask.
11. Your part
You’re responsible for having a lawful reason to collect and keep the personal data you put into Bello, for telling your guests and staff how you use it, and for the instructions you give us. The limits of liability in our Terms of Service also apply to this agreement.