Status
This summary describes the intended structure. Only the DPA agreed with the individual customer is binding.
Roles and subject
The hotel customer is generally controller for guest and employee data; LeoLan processes it on documented instructions as processor. The customer-specific DPA defines subject, duration, purpose, data types and data subjects.
Instructions and assistance
LeoLan processes within the agreed scope, binds authorised personnel to confidentiality, and assists as agreed with data subject rights, incidents, impact assessments, deletion and return.
Security and evidence
Agreed technical and organisational measures, audit rights, evidence and notification channels form part of the customer-specific DPA.
Subprocessors
The concrete, versioned subprocessor list is supplied before production use. Changes follow the procedure in the DPA.