Data Processing Agreement
CockpitMod d.o.o. (Processor) and the subscribing Customer (Controller) | Version 1.0 | 1 August 2024
1. Parties and purpose
This Data Processing Agreement ("DPA") is entered into between CockpitMod d.o.o. (PIB: 73519284, CRPS: 4-0102578/X, ul. Moskovska 14, 81000 Podgorica, Crna Gora) acting as data processor, and the Customer who has accepted the CockpitMod Terms of Service, acting as data controller. This DPA governs the processing of personal data by CockpitMod on behalf of the Customer in connection with the provision of CockpitMod Module subscriptions and satisfies the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679.
2. Subject matter and nature of processing
CockpitMod processes personal data exclusively to provide the Module services subscribed to by the Customer. Processing activities include: receiving reservation and guest data from the Dirs21 API on behalf of the Customer; applying Module-specific logic (routing, matching, aggregating, scheduling, reporting) to that data; storing processed outputs in the CockpitMod Platform; transmitting results back to the Dirs21 API or to third-party systems specified by the Customer; and generating usage reports for the Customer's account.
3. Categories of data subjects
The personal data processed under this DPA relates to the following categories of data subjects: hotel guests whose reservations are managed in the Customer's Dirs21 account; corporate billing contacts whose details are associated with corporate rate agreements; hotel staff whose shift records are managed through the Staff Scheduler Module; and the Customer's own account users who access the CockpitMod Platform.
4. Categories of personal data
The categories of personal data processed depend on the Modules subscribed to and may include: guest name and email address, reservation dates and room type, loyalty programme identifiers, payment method type (not full card numbers), review content and platform identifiers, corporate company name and billing contact details, staff names and shift information, and CockpitMod account user email addresses.
5. Duration of processing
Processing continues for the duration of each active Module subscription. Upon cancellation of a Module, all Module-specific personal data is deleted within 30 days of the effective cancellation date. Account user data is retained for the duration of the account plus 7 years to comply with applicable commercial law.
6. Processor obligations
CockpitMod shall: (a) process personal data only on documented instructions from the Controller (as set out in these Terms and the DPA) and notify the Controller if it believes an instruction violates applicable law; (b) ensure that persons authorised to process personal data have committed themselves to confidentiality; (c) implement appropriate technical and organisational security measures as described in section 7; (d) assist the Controller in fulfilling its obligations to respond to data subject requests under Chapter III of the GDPR; (e) assist the Controller in ensuring compliance with Articles 32–36 of the GDPR; (f) delete or return all personal data upon termination as specified in section 5; and (g) make available to the Controller all information necessary to demonstrate compliance with this DPA.
7. Technical and organisational measures
CockpitMod implements the following technical and organisational measures to protect personal data: encryption of personal data in transit using TLS 1.2 or higher; encryption of sensitive credential data at rest using AES-256; logical separation of Customer data in the Platform database; access controls ensuring personal data is accessible only to authorised personnel with a legitimate need; regular automated backups of encrypted data; vulnerability monitoring and regular security reviews; and an incident response procedure for personal data breaches.
8. Sub-processors
CockpitMod engages sub-processors to provide infrastructure and operational services necessary to deliver the Platform. Current sub-processors include cloud infrastructure providers and email delivery services. A current list of sub-processors is available on request at support@cockpitmod.org. CockpitMod will provide at least 30 days advance notice of any new sub-processor or material change to existing sub-processor arrangements. If the Controller objects to a new sub-processor, it may terminate the affected Module subscription in accordance with the Refund Policy without penalty.
9. Data transfers
CockpitMod processes data primarily within the European Economic Area. Where processing involves transfer of personal data to third countries, CockpitMod ensures appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission (Commission Decision 2021/914). Details of specific transfer mechanisms are available on request.
10. Data subject rights
CockpitMod will assist the Controller in responding to data subject requests. When CockpitMod receives a data subject request directly relating to personal data processed on behalf of the Controller, it will forward the request to the Controller's registered email address within 5 business days. Where the Controller instructs CockpitMod to action a data subject request (such as deletion of a specific guest record), CockpitMod will do so within 30 days.
11. Personal data breach
CockpitMod will notify the Controller by email to the registered account address without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting personal data processed on behalf of the Controller. The notification will include: the nature of the breach; the categories and approximate number of data subjects affected; the categories and approximate number of personal data records affected; the likely consequences; and the measures taken or proposed to address the breach.
12. Audit rights
The Controller has the right to audit CockpitMod's compliance with this DPA. Audits shall be conducted at the Controller's expense, with reasonable advance notice, no more frequently than once per year, and in a manner that does not disrupt CockpitMod's operations. CockpitMod may satisfy audit requests through certified independent assessments or documentation in lieu of on-site inspection.
13. Contact for DPA matters
CockpitMod d.o.o., ul. Moskovska 14, 81000 Podgorica, Crna Gora. Email: support@cockpitmod.org. AZLP registration: 05-030/26-2053. Supervisory authority: Agencija za zaštitu ličnih podataka, Bulevar Džordža Vašingtona bb, 81000 Podgorica.