Last updated on 31 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions between Zero Based Ltd, trading as GuestGate (“GuestGate”, “we”, “us”), and the customer who agreed to them (“Customer”, “you”). It applies whenever GuestGate processes personal data about your guests on your behalf, and it takes effect automatically when you accept the Terms. If this DPA conflicts with the Terms, this DPA wins for anything to do with personal data.
You are the controller of the personal data your guests give when they log in to your WiFi, and GuestGate is your processor. GuestGate is a separate controller for the account and billing details of you and your team, which our Privacy Policy covers.
Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the UK GDPR and, where it applies, the EU GDPR (“Data Protection Law”).
The details of the processing are set out in Annex 1. We process guest personal data only to provide GuestGate to you, and only on your documented instructions. Your instructions are this DPA, the Terms, and how you set up and use GuestGate, such as the questions your portals ask, your retention period and any webhooks you configure. If we believe an instruction breaks Data Protection Law, we will tell you. If the law requires us to process guest data in some other way, we will tell you first unless the law forbids it.
You are responsible for having a lawful basis for collecting guest data and for telling guests about it. GuestGate shows guests a short summary of how their details are used, and you can add your own privacy notice to each portal. You must collect marketing consent in a way that meets the law that applies to you, for example by using the marketing consent option rather than a pre-ticked box. You must not use custom questions to collect special category data, such as health, religion or ethnicity, or data about children under 13.
Everyone at GuestGate who can access guest data is bound by a duty of confidentiality and only accesses it when they need to, for example to provide support you have asked for or to fix a fault.
We maintain the technical and organisational measures in Annex 2. We may improve them over time, but we will not reduce the overall level of protection.
You give us general authorisation to use the sub-processors listed in Annex 3. We will update that list at least 30 days before a new sub-processor starts processing guest data. If you object on reasonable data protection grounds, tell us at privacy@guestgate.cloud within those 30 days. We will try to resolve it, and if we cannot, you may cancel the affected service and we will refund any prepaid fees for the remaining period. We impose data protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible to you for their work.
GuestGate gives you tools to handle guests’ requests yourself: you can search for a guest, export guest data, and delete a guest and their visit history. If a guest contacts us directly, we will pass the request to you without undue delay and will not respond to it ourselves, unless you ask us to. Where the tools are not enough, we will give you reasonable help to respond.
We will tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your guest data. We will give you the information we have that you need to meet your own obligations, and update you as we learn more. We will take reasonable steps to contain the breach and reduce its effects.
We will give you reasonable help with data protection impact assessments and consultations with a supervisory authority, to the extent they relate to GuestGate and the information is not already available to you.
Guest data is stored in the European Union, in Amazon Web Services’ Ireland (eu-west-1) region. Some sub-processors may access guest data from other countries, as Annex 3 shows. We only transfer guest data outside the UK and EEA where Data Protection Law allows it, for example to a country with an adequacy decision or under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
Guest data is deleted automatically when a guest has not connected within the retention period you choose, and you can delete individual guests at any time. When your account or a portal is deleted, we delete the related guest data from our live systems straight away. Copies in our database backups are removed as the backups expire, within 7 days. You can export your guest data at any time before then.
On request, we will give you the information you reasonably need to show that we meet this DPA. If that is not enough, you may audit our compliance once a year, at your own cost, with at least 30 days’ notice, during business hours and under a confidentiality agreement. You may also audit after a personal data breach or where a supervisory authority requires it.
Each party’s liability under this DPA is subject to the limits in the Terms, except where the law does not allow it to be limited. This DPA lasts for as long as we process guest data on your behalf.
Subject matter and duration: providing GuestGate’s captive portal service for as long as you use it, and until the guest data is deleted under section 11.
Nature and purpose: showing your guests a login page, authorising their devices on your UniFi network, recording their visits, and letting you view, export, send and delete that data.
Data subjects: people who connect to WiFi networks that use your GuestGate portals.
Categories of personal data:
Special category data: none.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database and backups | Ireland |
| Cloudflare, Inc. | Secure network connection to the GuestGate dashboard, through which guest data is displayed | Global network |
| Functional Software, Inc. (Sentry) | Error monitoring, which may occasionally capture guest data in an error report | Germany |
GuestGate also sends guest data to places you choose, which act for you rather than for us: your UniFi console (directly, or through Ubiquiti’s cloud connector if you connect that way) and any webhook addresses you configure.