Data Processing Agreement (DPA) — Caravel Sites

Version 1.0. Effective date: under review

This agreement is under review. Points marked under review are still being confirmed and may change before the agreement takes effect. The Portuguese version prevails under review.

This agreement follows Article 28(3) of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and uses as reference the Standard Contractual Clauses between controllers and processors adopted by the European Commission in Commission Implementing Decision (EU) 2021/915 of 4 June 2021 (OJ L 199, 7.6.2021, p. 18). It follows the structure of the Caravel apps DPA (https://caravelsuite.com/legal/dpa/, version 1.1 of 01/11/2026), adapted to the Caravel Sites service.

Official sources:

• GDPR — EUR-Lex, CELEX 32016R0679: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
• Implementing Decision (EU) 2021/915 — CELEX 32021D0915: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0915
• Implementing Decision (EU) 2021/914 (SCCs for transfers to third countries) — CELEX 32021D0914: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D0914
• Portuguese Law No. 58/2019 of 8 August (GDPR implementation): https://diariodarepublica.pt/dr/detalhe/lei/58-2019-123815982
• EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR (version 2.0, 7 July 2021): https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en

Parties

1. The Customer — the natural or legal person subscribing to the Caravel Sites service, identified in its account and invoice ("Controller" or "Customer").
2. Jardim Idílico Unipessoal Lda, trading as Caravel Suite, VAT/Tax No. PT518764532, registered office at Rua da Póvoa, n.º 775, Fração L, Zona Industrial de Amorim, 4495-121 Póvoa de Varzim, Portugal, registered at the Commercial Registry under No. 518764532, contact caravel@caravelsuite.com ("Processor" or "Caravel").

Clause 1 — Subject matter and scope

1. This agreement governs the processing of personal data that Caravel carries out on behalf of the Customer when providing the Caravel Sites service: building, hosting and maintaining the Customer's website and, in particular, receiving, storing and delivering to the Customer the messages that visitors send through the site's contact and booking request forms, available in the Caravel Sites dashboard.
2. Under Article 4(7) and (8) and Article 28 GDPR, the Customer is the controller of that data and Caravel is its processor.
3. This agreement does not cover — they are governed by the caravelsuite.com Privacy Policy (https://caravelsuite.com/legal/privacy/) — the data Caravel processes as controller in its relationship with the Customer itself: account, billing, subscription payments (processed by Stripe), support and correspondence.
4. This agreement forms part of the Caravel Sites terms of sale (Terms of use, https://caravelsuite.com/legal/terms/). In case of conflict on data protection matters, this agreement prevails (cf. Clause 4 of the Annex to Implementing Decision (EU) 2021/915).
5. This agreement is concluded electronically, which Article 28(9) GDPR accepts as written form.

Clause 2 — Duration

1. This agreement takes effect when the Customer accepts it (at purchase or when registering the Caravel Sites account) and remains in force for as long as Caravel processes personal data on the Customer's behalf.
2. It survives the end of the subscription until the deletion or return under Clause 10 is complete.

Clause 3 — Nature, purpose, categories of data and data subjects

Full description in Annex I. In summary:

• Nature: collection through the site's forms, recording, storage, consultation by the Customer in the dashboard, email notification to the Customer, backup, erasure.
• Purpose: enabling the Customer to receive and answer contact requests and manage booking requests from visitors to its site.
• Data subjects: visitors to the Customer's site who submit a form (prospective customers, guests, diners).
• Data: name, email, telephone, date, time, number of people, message text; technical submission data (date and time; under review).
• Special categories (Art. 9 GDPR): the service does not request them. The message field is free text and a visitor may, on their own initiative, write health information in it (e.g. allergies or reduced mobility). The Customer must not configure fields requesting such data without its own legal basis under Article 9(2).

Clause 4 — Documented instructions

1. Caravel processes the data only on documented instructions from the Customer, including with regard to transfers to third countries, unless required to do so by Union or Portuguese law; in that case Caravel informs the Customer beforehand, unless the law prohibits it (Art. 28(3)(a) GDPR; Clause 7.1 of the Annex to Decision 2021/915).
2. Documented instructions are: this agreement; the Customer's configuration in the dashboard (form fields, notification email, retention period); and requests the Customer sends by email from the address linked to the account.
3. Caravel immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions (Art. 28(3), final subparagraph, GDPR).
4. Caravel does not use the data for its own purposes — including advertising, profiling, sale or training artificial intelligence models — nor combine it with other customers' data. If it did, it would be considered a controller in respect of that processing (Art. 28(10) GDPR).

Clause 5 — Confidentiality

1. Caravel ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).
2. Access is limited to what is strictly necessary to provide, maintain and support the service. under review

Clause 6 — Security of processing (Art. 32 GDPR)

1. Caravel implements the technical and organisational measures described in Annex II, appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing (Art. 28(3)(c) and Art. 32 GDPR).
2. Caravel may update those measures provided the level of security is not reduced.
3. Caravel does not claim certifications (such as ISO/IEC 27001) it does not hold.
4. The Customer is responsible for protecting its dashboard and notification email credentials and for not requesting more data in the forms than it needs (Art. 5(1)(c) GDPR).

Clause 7 — Sub-processors

1. The Customer grants Caravel general authorisation to engage the sub-processors listed in Annex III (Art. 28(2) GDPR; Clause 7.7, Option 2, of the Annex to Decision 2021/915).
2. Caravel notifies the Customer by email at least 30 days in advance under review of any intended addition or replacement of sub-processors, and keeps the list up to date on its website.
3. The Customer may object in writing, on reasonable data protection grounds, within that period. If the objection is not resolved, the Customer may terminate the subscription before the change takes effect, without penalty, with a refund of the paid and unused part of the current period under review.
4. Caravel imposes on each sub-processor, by contract, data protection obligations equivalent to those in this agreement, in particular sufficient guarantees of security, and remains fully liable to the Customer for their performance (Art. 28(4) GDPR).
5. In a security emergency or sudden discontinuation of a provider, Caravel may make the replacement at shorter notice, informing the Customer as soon as possible and preserving the right to object.

Clause 8 — Assistance to the Customer

1. Data subject rights (Arts. 12–22 GDPR): taking into account the nature of the processing, Caravel assists the Customer by appropriate technical and organisational measures in responding to requests for access, rectification, erasure, restriction, portability and objection (Art. 28(3)(e) GDPR; Clause 8 of the Annex to Decision 2021/915). In the dashboard the Customer can view, export and delete messages under review. If Caravel receives a request directly from a data subject, it forwards it to the Customer without delay and does not answer it unless instructed by the Customer.
2. Other obligations: Caravel provides the Customer with the information reasonably necessary to comply with Articles 32 to 36 GDPR (security, breaches, impact assessment and prior consultation), taking into account the nature of processing and the information available (Art. 28(3)(f) GDPR).
3. Caravel keeps a record of the processing activities carried out on behalf of its customers (Art. 30(2) GDPR).

Clause 9 — Personal data breaches

1. Caravel notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data (Art. 33(2) GDPR) and in any case within 24 hours at the latest, by email to the account address (same period as the Caravel apps DPA).
2. The notification includes, as far as possible and possibly in phases: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point for more information (Art. 33(3) GDPR; Clause 9.2 of the Annex to Decision 2021/915).
3. Notifying the supervisory authority (in Portugal, the CNPD) within 72 hours and communicating with data subjects (Arts. 33 and 34 GDPR) are the Customer's responsibility. Caravel assists with the information it holds.
4. Reference: EDPB Guidelines 9/2022 on personal data breach notification under GDPR (version 2.0, 28 March 2023): https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en

Clause 10 — Retention, deletion and return

1. During the subscription: form messages are deleted automatically when they reach the retention period configured by the Customer in the dashboard, 180 days by default under review. The Customer can delete them earlier.
2. At the end of the subscription (cancellation or non-payment, under the terms of sale: suspension 15 days after the due date and deletion 60 days later, with prior notice), Caravel, at the Customer's choice, returns the data (export in a commonly used format such as CSV under review) and deletes the rest, unless Union or Portuguese law requires storage (Art. 28(3)(g) GDPR; Clause 10(d) of the Annex to Decision 2021/915). If the Customer makes no request, the data is deleted at the end of the period set out in the terms of sale.
3. Deleted data disappears from the encrypted backups at the end of the backup retention cycle, up to under review weeks. Until then, backups are used only for restoration after an incident.
4. Caravel confirms deletion in writing at the Customer's request.

Clause 11 — Demonstrating compliance and audits

1. Caravel makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR (Art. 28(3)(h) GDPR; Clause 7.6 of the Annex to Decision 2021/915), primarily in writing (answers to questionnaires and an up-to-date description of the Annex II measures).
2. If that information is insufficient, or if a supervisory authority so requires, the Customer may carry out or mandate an audit, including inspections, by an independent auditor bound by confidentiality, no more than once a year and with 30 days' prior notice, except in case of a data breach or an authority's order. Each party bears its own costs under review.
3. An audit may not give access to other customers' data or compromise the security of the service.

Clause 12 — International transfers

1. Form data is hosted on servers in the European Union (under review, see Annex III).
2. Caravel does not transfer the data outside the European Economic Area, except where a sub-processor listed in Annex III does so. In that case the transfer is made only on the basis of an adequacy decision (Art. 45 GDPR — e.g. for the United States, the EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795, for certified entities) or appropriate safeguards, in particular the Commission standard contractual clauses adopted by Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR).
3. Caravel informs the Customer, under Clause 7, before introducing any new transfer.

Clause 13 — Liability, precedence, governing law and jurisdiction

1. Each party is liable under Article 82 GDPR. Between the parties, the limitation of liability in the Terms of use applies (amount paid in the previous 12 months, except wilful misconduct or gross negligence), to the extent permitted by law and without prejudice to data subjects' rights under review.
2. In case of conflict between this agreement and other terms agreed between the parties, this agreement prevails on data protection.
3. Governing law: Portuguese law, including the GDPR and Law No. 58/2019. Jurisdiction: courts of the district of Porto, without prejudice to mandatory rules.
4. Caravel may update this agreement to reflect legal or service changes, notifying the Customer by email 30 days in advance; changes that reduce the protection of the data require the Customer's agreement.

Annex I — Description of the processing

Annex II — Technical and organisational measures (Art. 32 GDPR)

Only existing measures are listed. Items marked under review must be checked on the Caravel Sites server before publication.

1. Encryption in transit: all sites and the dashboard are served over HTTPS (TLS) only, with a certificate for the Customer's domain; HTTP redirects to HTTPS.
2. Per-customer isolation: each Customer's data is kept separate from other customers' under review; each dashboard account only sees its own site's messages.
3. Encrypted backups: automatic backups under review.
4. Configurable retention and automatic deletion: the dashboard deletes messages when they reach the period set by the Customer (180 days by default).
5. Minimisation: forms request only the necessary fields; fields are configurable; sites use no third-party cookies or trackers under review.
6. Access control: administrative server access by SSH key only under review; firewall; database not exposed to the Internet under review; dashboard access with individual password under review.
7. Form abuse protection: under review.
8. Logs: server logs do not store message content under review; log retention under review.
9. People: access limited to those who need it; confidentiality commitment (Clause 5).
10. Incident response: procedure for analysis, containment and notification to the Customer within 24 hours (Clause 9).
11. Updates: system and dependencies updated regularly under review.

Annex III — Authorised sub-processors

Not sub-processors under this agreement:

• Stripe — processes the Customer's subscription payments to Caravel. It receives no data about site visitors. Governed by the caravelsuite.com Privacy Policy.
• The domain registrar and the Customer's own email provider — contracted by the Customer (the domain is registered in the Customer's name).