Data Processing Agreement

The customer is controller and Capsule Technologies Ltd is processor for Customer Personal Data, except where Booqiva independently determines purposes described in the Privacy Notice. Booqiva processes Customer Personal Data only on documented instructions in the contract, configuration and lawful support requests.

Subject matter: hosting and operating rental-management services. Duration: subscription plus deletion/backup periods. Data subjects may include customer personnel, rental customers, prospects, partners and suppliers. Data may include identity, contact, booking, payment metadata, inventory, location, workforce evidence, communications and audit information selected by the customer.

Booqiva restricts access to authorised persons under confidentiality duties and maintains proportionate technical and organisational measures, including tenant isolation, access control, encryption in transit, backups, vulnerability management, audit logs, secrets management and incident monitoring.

The customer gives general authorisation for the providers on the published Sub-processor List. Booqiva remains responsible for processor obligations and will provide advance notice of material additions where reasonably possible. Customers may object on substantiated data-protection grounds.

Taking account of the processing, Booqiva assists with data-subject requests, security, breach assessment, DPIAs and regulator consultations through available functionality and reasonable support. Additional bespoke work may be chargeable if permitted by law and agreed in advance.

Booqiva will notify the customer without undue delay after becoming aware of a confirmed breach affecting Customer Personal Data and will provide available information needed for the customer's duties. Notification is not an admission of fault.

At termination, customers may export data using available tools. Booqiva deletes or anonymises Customer Personal Data after the documented retention window unless law requires preservation. On reasonable request, Booqiva provides compliance information and supports proportionate audits, subject to confidentiality, security and non-disruption safeguards.

Where Customer Personal Data is transferred outside the EEA without an adequacy decision, the parties incorporate the applicable EU Standard Contractual Clauses, normally Module Two, together with documented supplementary measures. The customer authorises necessary onward transfers by approved sub-processors under equivalent safeguards.

This DPA prevails over conflicting Terms solely for personal-data processing. Mandatory GDPR requirements and applicable transfer clauses prevail over both.