Data Processing Agreement
Draft for legal review. Text in [brackets] must be completed before publication.
This agreement (“DPA”) forms part of the Terms of Service between the customer (“Controller”) and [LEGAL ENTITY NAME] (“Processor”). It applies when the Processor processes personal data on the Controller's behalf under Article 28 of the GDPR.
1. Subject matter and duration
The Processor checks the Controller's PMS accounts and verified websites for security risks, as set out in the Terms. Processing lasts for as long as the Terms are in force, plus the deletion periods below.
2. Nature of the processing
| Data subjects | The Controller's PMS users (staff, cleaners, owners, contractors). Owners whose contact details are on file. Guests, through the guest messages read to spot scams, and incidentally where their data appears in configuration such as message templates. |
|---|---|
| Personal data read | PMS user records (IDs, roles and permissions, last sign-in, email addresses read in memory only to match people the Controller marked as having left); door codes and wifi passwords of listings and bookings (read in memory only, never stored), webhook configuration, channel status, owner payout settings and contact details, listing descriptions and access details, refund amounts, message templates, guest messages since the last check (read in memory only, never stored), and publicly visible website content. |
| Personal data stored | Only keyed one-way fingerprints of the above, and a timeline of which kind of item changed and when (identified by those fingerprints, kept 90 days), the names or domains of apps receiving data by webhook (never full addresses), and, for people the Controller marks as having left, a masked email and its fingerprint. Names, emails, bank details, guest data and raw API responses are not stored. |
| Operations | Read-only retrieval through the PMS API, in-memory comparison, fingerprinting, and storage of finding summaries. Only if the Controller turns on real-time checks: creating and removing one webhook in the PMS account, and receiving its notifications, which are used only to start a check and are not stored. |
| Special categories | None. |
3. Processor obligations
The Processor:
- processes personal data only on the Controller's documented instructions, which are the Terms, this DPA and the Controller's settings in the portal;
- ensures that anyone authorised to process the data is bound by confidentiality;
- takes the security measures in section 5;
- helps the Controller respond to data subject requests and meet its obligations under Articles 32–36 GDPR;
- notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach;
- makes available the information needed to show compliance, and allows audits by the Controller or its auditor on 30 days' notice, no more than once a year, unless a breach has occurred.
4. Subprocessors
The Controller authorises the following subprocessors: Cloudflare, Inc., USA (hosting, database and background processing) and Resend, Inc., USA (sending alert emails, from its EU region in Ireland). Both rely on the EU–US Data Privacy Framework, with Standard Contractual Clauses as fallback. When a user turns on alerts on their devices, the alert passes through that browser's push service (Apple, Google, Mozilla or Microsoft) end-to-end encrypted, so the push service can't read it. Billing (Paddle, which sells the subscription as Merchant of Record) and website analytics (Google Analytics) concern the Processor's own customer relationship and website, not data processed on the Controller's behalf, and are covered by the Privacy Policy. The Processor will give at least 30 days' notice before adding or replacing a subprocessor, and the Controller may object on reasonable grounds. Subprocessors are bound by data protection terms no less protective than this DPA. Transfers outside the EEA rely on an adequacy decision or Standard Contractual Clauses.
5. Security measures
- TLS for all traffic; data encrypted at rest.
- Stored PMS API keys encrypted with AES-256-GCM under a data key unique to each customer, which is itself wrapped by a master key.
- Change detection using keyed HMAC fingerprints, so stored values cannot be reversed into the original data.
- Mandatory two-step verification for all portal users; role-based access; sessions that can be revoked.
- An audit log of changes within each workspace; rate limiting; a strict Content Security Policy.
- Data minimisation: read-only API use (apart from the optional real-time webhook, created only on the Controller's instruction) and no storage of raw responses or notification contents.
6. Deletion and return
Disconnecting a PMS immediately deletes its stored key, fingerprints and change timeline. Resolved findings are deleted 12 months after resolution. When the Controller deletes its workspace, or the Terms end, all workspace data is deleted immediately, except encrypted backups held by the hosting provider, which expire on their normal cycle. At any time before deletion, the Controller can export its data from the portal.
7. Liability and precedence
The limits of liability in the Terms apply to this DPA. If this DPA and the Terms conflict on data protection, this DPA prevails.
Signatures
The Controller accepts this DPA by accepting the Terms in the portal. If you need a countersigned copy, email [CONTACT EMAIL].