Data Processing Agreement (DPA)
To ensure compliance with the GDPR (General Data Protection Regulation) and to appropriately protect the personal data of your clients, Lime Booking provides access to a Data Processing Agreement (DPA). This document defines the terms under which Lime Booking processes personal data on behalf of its users and ensures that all data processing activities are carried out in accordance with applicable law.
By creating a Lime Booking user account, the user agrees to the General Terms and Conditions and to the Data Processing Agreement. For more information, you can contact dpo@lime-booking.com.
What does the Data Processing Agreement include?
The DPA includes the following key elements, in line with the GDPR:
1) Rights and obligations of the controller and processor:
The document sets out the rights and duties of the controller (you, as a Lime Booking user) and the processor (Lime Booking) when processing personal data, in accordance with GDPR.
2) Details of data processing:
It includes information on the purpose and nature of the processing of personal data, the types of personal data, the categories of data subjects, and the duration of processing (as defined in Annex A).
3) Conditions for using sub-processors:
The document regulates the conditions under which Lime Booking may use third parties (sub-processors) to process data and contains a list of approved sub-processors (Annex B).
4) Technical and organisational measures for data security:
It defines the measures for protecting personal data, including encryption, ensuring ongoing confidentiality, integrity and availability of data, as well as regular testing and evaluation of security measures (Annex C).
5) Instructions for transfers of personal data to third countries:
It sets out the rules and conditions for transferring personal data outside the European Economic Area (EEA), along with the necessary safeguards in accordance with the law (Annex C).
6) Assistance with GDPR compliance:
Lime Booking provides assistance in ensuring compliance with GDPR obligations, such as notification of personal data breaches, handling data subject access requests, and supporting data protection impact assessments.
7) Procedures for deletion and return of data:
It defines the procedures for deletion or return of personal data after the end of processing, unless further retention is required by law.
Do you have a question?
Contact us if you have any questions regarding data processing.
