Data Processing Agreement (DPA)

Last updated: 25 October 2026 (version 1.1).

Data Processing Agreement (DPA) defines how personal data is processed between the data controller and the processor in compliance with GDPR.

1. Parties

This Data Processing Agreement (“DPA”) forms part of the Service Agreement between:

Controller: The hospitality customer using PassportScan Cloud

Processor:
GlobeID Limited
The Black Church, St. Mary’s Place
Dublin 7, D07P4AX
Ireland
CRO 559612 · VAT IE3342103WH
Privacy contact: privacy@passportscan.net (Data Protection Officer)

The Processor provides PassportScan Cloud services to the Controller.

2. Purpose

This DPA governs the processing of Personal Data by the Processor on behalf of the Controller in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Applicable local data protection laws

The Processor shall process Personal Data only on documented instructions of the Controller.

Guest Personal Data is not collected by the Processor directly from the data subject: it is captured by, or on the instructions of, the Controller during check-in. The Controller is responsible for informing guests about the processing (Article 14 GDPR); the Services support this with in-flow privacy notices and consent capture.

3. Nature and Purpose of Processing

PassportScan Cloud enables:

• Digital guest registration
• Identity document scanning and OCR extraction
• Consent capture
• Regulatory export
• PMS integration
• Credit purchase and account activation

Payment processing is handled exclusively by Stripe.

The Processor does not determine the purposes of processing.

The duration of the processing is the term of the Service Agreement, together with the period until the Personal Data is returned or deleted in accordance with Section 13.

4. Categories of Data Subjects

• Hotel guests
• Minor guests (where legally required)
• Reservation holders
• Hotel staff users
• Billing contacts

5. Categories of Personal Data

Identity Data

• First name, last name
• Date and place of birth
• Nationality
• Address
• Identity document number
• Document type
• Expiry date
• Document images (if enabled)
• Signature images
• Consent metadata

Technical Data

• IP address
• Authentication metadata
• Device metadata
• Logs

Payment Metadata

• Transaction ID
• Payment status
• Amount
• Currency
• Billing email (if applicable)

The Processor does not store or process:

• Full payment card numbers
• CVV codes
• Card expiration dates

Payment card data is processed exclusively by Stripe.

6. Processor Obligations

The Processor shall:

• Process Personal Data only on documented instructions
• Ensure confidentiality
• Implement appropriate technical and organisational measures
• Assist with data subject rights: requests received by the Processor from data subjects are routed to the Controller and handled on its instructions, within the one-month deadline of Article 12(3) GDPR
• Notify personal data breaches without undue delay
• Assist the Controller, taking into account the nature of the processing and the information available to the Processor, in meeting its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation of the supervisory authority
• Inform the Controller immediately if, in the Processor's opinion, an instruction infringes the GDPR or other applicable data protection law
• Delete or return Personal Data at the end of the services, at the Controller's choice and on its request (Section 13)

7. Technical and Organisational Measures

The Processor implements the safeguards described in the Privacy Policy (Section 6) and detailed in the Security Overview, including:

• Core platform infrastructure hosted on Amazon Web Services in the European Union, in a dedicated production account; regional document image storage may be provisioned outside the EEA as described in Section 10.2
• Encryption in transit (TLS 1.2+ at external edges) and at rest (AES-256), with application-level encryption for sensitive identity data
• Role-based access control and multi-factor authentication on critical systems; no staff member holds standing access to production; access to production data granted only on approval by a second authorised person and limited in time, with a record of all operator activity
• Changes reach production only through peer-reviewed, approved releases
• Development and test environments use synthetic or anonymised data and do not contain Customer Personal Data
• Logging and monitoring, with alerting and incident response procedures; personal data and secrets are masked in the services before logs are sent to Datadog, and when displayed
• Periodic independent penetration testing
• An information security management system aligned with ISO/IEC 27001:2022

8. Sub-Processors

The Controller authorises the Processor to engage sub-processors as listed in the public Sub-processor List at https://www.passportscan.net/sub-processor/, which forms an integral part of this DPA.

Current categories include:

• Amazon Web Services (AWS) – Cloud Infrastructure
• Clerk – Authentication
• Datadog (EU site, datadoghq.eu) – Log management
• Google Workspace – Business communications; Customer Personal Data only incidentally, in customer support correspondence
• Google reCAPTCHA Enterprise – Bot protection for the guest self-check-in application (guest IP address and device signals)
• Stripe – Payment processing

The Processor ensures that sub-processors are bound by GDPR-equivalent obligations and remains fully liable for their acts and omissions (Article 28(4) GDPR). The Controller will be informed of intended changes through publication of an updated Sub-processor List and may object within 30 days on reasonable data-protection grounds.

9. Security of Processing (Article 32 GDPR)

The Processor ensures appropriate security measures considering:

• State of the art
• Implementation costs
• Nature, scope, context and purposes of processing
• Risk to rights and freedoms of natural persons

Security measures include encryption, access control, resilience, and incident response capability.

10. Data Residency and International Transfers

10.1 Core Infrastructure

Core platform infrastructure, including application services and primary databases, is hosted exclusively in:

Amazon Web Services (AWS) – eu-west-1 (Ireland, European Union).

No cross-region replication of core databases is configured.

10.2 Regional Document Image Storage

Where document image storage functionality is enabled by the Controller, object storage (Amazon S3) may be provisioned in the AWS region corresponding to the hotel’s operational jurisdiction.

Such regions may include locations outside the European Economic Area (EEA). At the date of this DPA, the regions available outside the EEA are:

• United States (us-east-1)
• Brazil (sa-east-1)
• Singapore (ap-southeast-1)
• Australia (ap-southeast-2)

Any additional region is notified through an updated Sub-processor List.

Enabling document image storage, and selecting the storage region, is a configuration choice made by the Controller and constitutes the Controller's documented instruction for the resulting transfer (Article 28(3)(a) GDPR).

Regionalisation supports:

• Data localisation requirements
• Latency optimisation
• Jurisdictional alignment

10.3 International Transfer Safeguards

Where personal data is processed outside the EEA, transfers are governed by:

• The provider's data processing terms incorporating the European Commission's Standard Contractual Clauses (e.g. the AWS Data Processing Addendum)
• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.2+ at external edges)

The Processor ensures appropriate safeguards under Chapter V GDPR.

11. Audit and Inspection

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, including:

• Security documentation
• Penetration testing summary
• Certifications (where applicable)

The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, subject to reasonable notice.

12. Personal Data Breach

The Processor shall notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's Personal Data, so that the Controller can meet its own 72-hour obligation under Article 33 GDPR.

Notification shall include:

• Nature of the breach
• Categories and approximate number of data subjects and records affected
• Name and contact details of the Data Protection Officer
• Likely consequences of the breach
• Mitigation measures taken

13. Termination

Upon termination of services, the Processor shall, at the Controller's choice, return Personal Data to the Controller and/or delete it. The Controller communicates its choice by written request to privacy@passportscan.net; at termination the Processor will ask the Controller for its choice if none has been received. Pending the Controller's choice, Personal Data is processed for no purpose other than its return or deletion.

On the Controller's request:

• The Processor's operations team returns the Personal Data to the Controller in a format agreed with it and/or deletes it from live systems within 30 days of the request, unless otherwise required by law, and confirms completion to the Controller in writing
• Access of the Controller's users is revoked upon termination
• Backup copies expire through the scheduled backup retention cycle (up to 15 days); residual versioned copies in object storage and related access logs expire within 90 days

14. Governing Law and Jurisdiction

This Data Processing Agreement and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of Ireland, consistently with the Terms and Conditions and the Privacy Policy. The courts of Ireland shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA, without prejudice to the competence of the supervisory authorities under Chapter VI GDPR and to mandatory data protection law.