Data Processing Agreement (template)
Draft. These terms have not been legally reviewed and aren't in force yet.
1. Roles
The property signing up ("Controller") decides why and how guest personal data is processed. Ayra Ventures Private Limited ("Processor") processes it only to provide PassportScan and on the Controller's documented instructions, which include use of the service's features.
2. Data and purpose
Data subjects: guests and the Controller's staff. Data: passport image and details, contact and stay details. Purpose: guest check-in records and sending guest details to systems the Controller connects. Duration: until deleted under the Controller's retention settings or the agreement ends.
3. Confidentiality
The Processor limits access to people who need it and who are bound to keep the data confidential.
4. Security
Measures include: encryption in transit, encrypted storage of passport files, encrypted passport numbers and scan data, separation between properties, role-based access, optional two-factor sign-in, audit logs, automatic deletion under retention settings, and encrypted backups kept for 14 days.
5. Sub-processors
The Controller authorises the sub-processors listed in the Privacy Policy. The Processor will give notice of changes and bind sub-processors to equivalent duties. [Set notice period.]
6. International transfers
[To be completed with legal advice: where data is stored and the transfer safeguards relied on.]
7. Assistance and data subject rights
The service lets the Controller export or permanently delete a guest's data. The Processor will reasonably help with other requests and with security or impact assessments.
8. Personal data breaches
The Processor will tell the Controller without undue delay after becoming aware of a breach affecting its data. [Set a maximum number of hours.]
9. Deletion and return
When a property is deleted, its data is permanently removed from the live service, and from backups once they expire within 14 days.
10. Audit
The Processor will provide the information reasonably needed to show compliance with this agreement. [Set audit terms.]
Signatures
Controller: ______________________ Date: __________
Processor: Ayra Ventures Private Limited Date: __________