Enterprise Compliance

What is it?

At HolidaiButler, compliance is not merely an appendix to the contract but an integral feature of the architecture. Deletion deadlines are enforced by code, the chatbot identifies itself as an AI, and the fact that all hosting takes place within Europe can be verified externally. What we promise is measurable.

Specifications

• GDPR erasure requests within 72 hours, enforced by code with automatic monitoring for time-limit breaches.
• Data export on request, in a structured and machine-readable format, as soon as possible and within 30 days at the latest.
• The record of processing activities (Article 30 of the GDPR) is kept up to date; all data processors are European companies.
• A complete audit trail of system operations, recorded on our own European infrastructure.
• The reviews shown are never more than two years old, with a fixed retention period that ensures this.
• The EU AI Act, which will come into full effect on 2 August 2026: the chatbot identifies itself as an AI, and critical decisions are subject to human oversight (Human in Command).
• Accessibility in accordance with WCAG 2.1 AA guidelines: contrast ratios, keyboard navigation and screen reader support, as measured on the published site.
• Payments are processed in accordance with PCI DSS via Adyen (Amsterdam); the e-commerce modules will be rolled out by destination in 2026-2027.
• Annual penetration testing cycle, first round in Q3 2026; dependency monitoring with weekly security audits.
• 100% EU-hosted: server, databases and AI models located within the European Union, verifiable by an external party.