Data Processing Agreement (template)

Version 1.1 · 2026-08-25 · Art. 28(3) GDPR draft. The registered Processor identity/address, production hosting facts and professional review evidence must be completed before execution.

Parties. The campground operator identified in the signed order (Controller) and the registered CampsiteOS entity identified in the executed DPA (Processor). This repository draft is not the executed agreement.

1. Subject matter & duration. Processing of guest and booking personal data for the operation of the Controller's reservation system, for the term of the subscription.

2. Nature & purpose. Storage, organisation, transmission of booking, payment-status, communication and statutory-registration data; automated transactional messaging; report generation.

3. Categories of data & data subjects. Guests and their party members: identity, contact, stay, party composition, travel-document data where statutory registration requires it, payment references (never card data — those flow directly to the Controller's own PSP account).

4. Controller instructions. The Processor processes only on documented instructions, including the configuration the Controller sets in the product (retention classes, registration authorities, tax postures). Product configuration constitutes a documented instruction.

5. Confidentiality. Persons authorised to process are bound to confidentiality.

6. Security (Art. 32). Encryption in transit; authority credentials encrypted at rest (AES-256-GCM with keys held outside the database); immutable financial ledger; role-based, per-property access control; audit events on booking changes.

7. Subprocessors. General authorisation with the published subprocessor list; 30 days' notice of changes with a right to object on reasonable grounds.

8. Data-subject rights. The Processor provides the tooling (machine- readable subject export; erasure that anonymises everything not under a statutory retention duty) and assists the Controller without undue delay.

9. Breach notification. Without undue delay after becoming aware, with the information Art. 33(3) requires.

10. Deletion/return. On termination the Controller may take the full-data export. The Processor then deletes or returns personal data according to each approved purpose/retention object, except where Union/Member-State law requires retention or a recorded legal hold applies. Destruction removes artifact bytes and retains only the minimum non-personal destruction receipt.

11. Audits. The executed agreement must state the audit process, evidence, cost allocation and objection/escalation terms. Repository documentation and the claims-vs-code checklist are supporting evidence, not a substitute for the Controller's Art. 28 audit rights.