Data Processing Agreement
Article 28 GDPR terms for customer-controlled personal data processed through DoorAPI.
Customer-specific agreements, order forms and mandatory law may override these general provisions.
Parties and scope
This DPA forms part of the customer agreement where Doorsecure processes personal data on behalf of the customer. The customer is controller and Doorsecure B.V. is processor unless expressly agreed otherwise.
Processing details
Subject matter: provision of DoorAPI access-control, identity, ticketing, integration, device and support services. Duration: the agreement plus documented deletion or return period. Data subjects may include customers, employees, members, visitors, contractors and administrators. Data categories depend on enabled modules and may include identity, credentials, access events, device data, images and optional biometric data.
Instructions and confidentiality
Doorsecure processes data only on documented instructions, including transfers, unless required by law. Authorised personnel are bound by confidentiality.
Security measures
Doorsecure maintains measures including TLS 1.3 in transit, AES-256 encrypted storage and backups, access controls, MFA capability, scoped API credentials, monitoring, vulnerability management, backup and recovery procedures, and governance under ISO 27001.
Subprocessors
The customer gives general authorisation for listed subprocessors. Doorsecure will maintain a current register and provide notice of material additions where contractually required. Doorsecure remains responsible for subprocessor obligations as required by GDPR.
Assistance
Doorsecure assists with data-subject requests, security obligations, DPIAs and supervisory-authority consultations, taking into account the nature of processing and information available.
Personal data breaches
Doorsecure notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data and provides available information needed for the customer’s obligations.
Audits and information
Doorsecure provides information reasonably necessary to demonstrate compliance. Audits are coordinated to protect other customers, security and confidentiality, with certificates and independent assurance used where appropriate.
Return and deletion
At the end of services, Doorsecure deletes or returns customer personal data according to the agreement and customer instruction, except where law requires retention. Backup deletion follows the applicable lifecycle.
International transfers
Doorsecure ensures an appropriate GDPR Chapter V mechanism for restricted transfers, including contractual safeguards where required.