Data processing agreement

Draft for legal review. Items in square brackets must be completed before publication.

1. Parties and scope

This agreement is between the customer (controller) and [company name] (processor) and forms part of the terms of service. It applies to personal data the customer puts into Readyby.

2. Subject matter, nature and purpose

Coordinating cleanings of short-term rental properties: scheduling, messaging cleaners, checklists and photos, incident reports, owner reports and exports.

3. Categories of data subjects and data

• Cleaners: name, phone number, messenger, language, working areas and days, messages, photos, working times.
• Property owners: name, email, phone, language, report preferences.
• Customer users: name, email, role, activity log.
• Guests: check-in and check-out dates, number of guests, booking source. No names or contact details.

4. Processor obligations

The processor processes data only on documented instructions, ensures confidentiality of its staff, implements appropriate technical and organisational measures (Annex 1), assists with data subject requests and breach notifications, and deletes or returns data at the end of the service.

5. Sub-processors

The customer authorises the sub-processors listed in Annex 2. The processor informs the customer of changes at least 30 days in advance; the customer may object.

6. International transfers

Data is stored in the EU. Transfers outside the EEA rely on adequacy decisions or standard contractual clauses.

7. Audits

The processor makes available the information needed to demonstrate compliance and allows audits [frequency and conditions to be agreed].

Annex 1: Security measures

Encryption in transit and at rest for access codes; tenant isolation of every customer's data; access logs, including every reveal of an access code; least-privilege access for staff; backups in the EU. [Complete list to be confirmed.]

Annex 2: Sub-processors

[Hosting provider, email provider, WhatsApp Business (Meta), payment provider, AI model provider, with purpose and location.]