How to get a DPA
When you use reservationbay to handle your renters' personal data, you are the controller and SitePack B.V. is the processor. A data processing agreement records that relationship. We issue one on request rather than publishing a self-service version, so that it names your organisation and reflects your actual processing.
Ask us for one and we will send a draft to review. If your organisation has its own template, send it over — we will read it and come back with any points that need adjusting rather than refusing on principle.
What the agreement covers
- The categories of personal data processed and the purposes of processing.
- Our obligations as processor, including confidentiality and security measures.
- Sub-processors, including payment and hosting providers, and how changes are notified.
- Where data is stored and the position on transfers outside the EEA.
- Breach notification timelines.
- What happens to data on termination: return, export or deletion.
A DPA sits alongside the terms of service and the privacy policy rather than replacing them. If you need all three for a procurement process, ask and we will send them together.
Frequently asked questions
Do I need a DPA?
If you are processing personal data of your renters through the platform — which you are, as soon as you take a booking — then a DPA is the document that records our processor obligations to you. Many customers only need one when their own compliance process asks for it.
Can I use my own template?
Yes, send it to us. We will review it and flag anything that does not match how the platform actually works, rather than insisting on our own paper.
Where is data stored?
Within the EU. The privacy policy has the detail, and the DPA names the sub-processors involved.
Request a DPA
Tell us your organisation's details and we will send a draft to review.