Agent Hotel data-processing agreement template
Version: v1 Source policy review date: 2026-09-19 Status: versioned, unexecuted customer DPA template. Customer-specific fields and applicable annexes intentionally require completion before binding acceptance. Publication does not establish a current customer relationship or production activation.
Template status and parties
This is a customer-specific template, not an executed agreement. There are currently no customers. It does not establish an account-specific agreement with any provider or activate production processing. Proposed processor: RETRO GAMES FOX CAVIC, organization number 921560095, Dalanvegen 45, 3850 KVITESEID, Norway. Contact: zcavic87@gmail.com; +47 98416851. Customer legal identity and contact: [CUSTOMER]. Customer role and any upstream controller authorization: [CUSTOMER-ROLE]. Underlying service agreement and binding acceptance record: [AGREEMENT-REFERENCE].
Processing annex
Subject and authorized service operations: [SUBJECT-AND-SERVICES]. Nature and purposes of instructed processing: [INSTRUCTIONS-AND-PURPOSES]. Duration and termination conditions: [DURATION]. Data-subject categories and personal-data categories: [CATEGORIES]. Applicable restrictions and any separately authorized sensitive-data handling: [RESTRICTIONS]. Private customer content is distinguished from the operator's own account, security, support and billing-administration purposes. If the customer is a processor, the upstream authority and subprocessor relationship must be established. The customer's commercial agreement does not itself establish every underlying data subject's lawful basis.
Proposed core obligations
Under an executed agreement, instructed personal data is processed only on documented instructions, including relevant transfer instructions, except where applicable law requires otherwise. Authorized personnel must be bound to confidentiality. The agreed security annex must describe actual scope controls, encryption boundaries, secret-safe logging, bounded admission and outbound protections. Customer-managed encryption keys remain outside the service's recovery authority. Do not promise protections or production verification not established by the annex: [SECURITY-ANNEX].
Subprocessors and transfers
List the actual authorized subprocessors and their relevant purposes, locations and applicable transfer arrangements: [SUBPROCESSOR-AND-TRANSFER-ANNEX]. Complete the permitted authorization, notification, change and objection process: [AUTHORIZATION-AND-CHANGE-PROCESS]. Do not substitute a general provider list or a sample DPA for the applicable arrangement. Independent-controller processing must be distinguished from instructed processing.
Assistance and incidents
The executed agreement must provide the applicable assistance for individual rights, security, breach notification and impact assessments. Requests must protect other tenants and use proportionate identity/authority checks. Incident assistance must not wait for a completed investigation where an earlier notification is required. Operational contacts and protected evidence/assistance procedure: [ASSISTANCE-PROCEDURE]. These provisions do not mint customer credentials or restore lost private decryption keys.
Return, deletion and end of service
Record the customer's applicable return/deletion choice and the supported authorized export process: [RETURN-AND-DELETION-INSTRUCTIONS]. Attach verified category-specific retention exceptions and the actual backup/suppression boundaries: [RETENTION-ANNEX]. No promise of immediate erasure from every backup is made. Retained legal records must have an identified purpose and applicable retention rule; they do not justify keeping unrelated customer content. The template does not establish that restoration or production deletion has been activated.
Information and audits
Provide the information and audit cooperation required by the applicable processing agreement and law, while protecting other tenants, credentials and infrastructure secrets. Complete the practical evidence-access and audit procedure without negating those duties: [AUDIT-PROCEDURE]. Signature or other binding electronic acceptance, representatives and dates: [ACCEPTANCE]. A public download, privacy-notice acknowledgment or existing local-alpha acknowledgment is not acceptance of this completed agreement.