Data Processing Agreement

1. Parties

This DPA is entered into between the Agency Tenant (Controller) and Albor Compliance Suite SL (Processor) and forms part of the Terms of Service.

2. Subject and duration

Albor processes personal data on behalf of the Controller solely for the purpose of providing the Service. Processing continues for the term of the subscription plus the 90-day data-export window thereafter.

3. Categories of data subjects and data

Data subjects: end users (Controller staff), property owners, guests, vendor contacts.

Categories of data: identification (name, document number), contact details, booking history, payment metadata, scanned ID documents (encrypted at rest).

4. Controller obligations

The Controller is responsible for ensuring there is a valid legal basis for processing and for providing required transparency notices to data subjects (e.g., guest privacy notice at check-in).

5. Processor obligations

Process data only on documented instructions from the Controller.

Ensure persons authorized to process the data are bound by confidentiality.

Implement appropriate technical and organisational measures (encryption at rest, TLS in transit, RBAC, audit logging, regular penetration tests).

Assist the Controller in fulfilling data-subject requests within 14 days.

Notify the Controller of any personal data breach within 24 hours of awareness.

6. Sub-processors

The Controller authorizes the sub-processors listed in the Privacy Policy. Albor will notify the Controller of any new sub-processor at least 30 days in advance, allowing the Controller to object on reasonable grounds.

7. International transfers

Personal data is processed primarily within the EEA. Where data is transferred to non-EEA processors (Stripe, Resend, Sentry, Anthropic), Albor relies on the EU Standard Contractual Clauses (Module 3) as the lawful transfer mechanism.

8. Audit

The Controller may, with 30 days notice and at most once per 12 months, audit Albor's compliance with this DPA. Reasonable costs of the audit are borne by the Controller; remediation costs of any non-compliance are borne by Albor.