Legal
The model data processing agreement that forms part of every Doory agreement: what we do as a processor, with which sub-processors, and which security measures and retention periods apply.
Last updated: 9 September 2026
This is Doory’s model data processing agreement. It is concluded between the building operator using the platform (the controller, hereinafter "Operator") and Spoelie B.V., Weesperstraat 113, 1018 VN Amsterdam, the Netherlands, Chamber of Commerce no. 94087512, trading as Doory (the processor, hereinafter "Processor"). It belongs to and forms part of the main agreement for the use of the Doory platform. The signed version for each customer, with the party details completed therein, prevails.
Terms such as "personal data", "processing", "data subject", "personal data breach" and "sub-processor" have the meaning given to them in the General Data Protection Regulation (GDPR). "Integration" means a connection with a third-party service that the Operator activates itself per building and for which the Operator has its own contractual relationship with that third party.
2.1 Processor processes personal data solely on the instructions of and on behalf of the Operator, for the purpose of providing the Doory platform: bookings of meeting rooms, office units and memberships, visitor registration and reception kiosk, access control, service requests, communication, invoicing signals, onboarding and building reporting.
2.2 The nature, purposes, categories of data subjects and categories of personal data are described in Annex A.
2.3 The Operator is and remains the controller for all processing in the platform, including when an end user books a reservation, membership or other service from the Operator via the platform. The Operator is the selling party, appears as such on the invoice and uses its own invoicing and payment accounts for this. Processor is neither the seller nor a controller in that flow.
2.4 Processor does not process the personal data for its own purposes, with the exception of the following. Processor may use anonymised and aggregated data for statistics on platform use, benchmarks, supporting pricing, improving and securing the platform, and for marketing. Processor does so solely in such a way that the data no longer constitute personal data and cannot be traced back to the Operator, an individual building or an individual data subject, unless the Operator consents to this in writing (for example for a reference or case study).
2.5 Processor does not use the Operator’s production data for demonstrations to third parties. Demo environments contain fictitious data only.
3.1 Processor processes solely on the basis of written instructions from the Operator, as set out in the main agreement, this agreement and the configuration that the Operator manages itself in the platform (such as switching modules, integrations and retention periods on or off per building).
3.2 If Processor processes personal data pursuant to a legal obligation under Union or Member State law, it shall inform the Operator of this in advance, unless that law prohibits such notification on important grounds of public interest.
3.3 Processor shall inform the Operator without delay if, in its opinion, an instruction infringes the GDPR or other data protection legislation.
Processor ensures that persons who process personal data under its authority are bound by a duty of confidentiality and only have access to the extent necessary for their tasks.
5.1 Processor takes appropriate technical and organisational measures as described in Annex C.
5.2 Processor may update the measures, provided that the level of security does not decrease.
6.1 The Operator gives general authorisation for the engagement of the sub-processors listed in Annex B.
6.2 Processor shall inform the Operator in advance of any intended changes (addition or replacement of sub-processors). The Operator may raise a reasoned objection within 30 days; the parties will then jointly seek a reasonable solution.
6.3 Processor imposes obligations on sub-processors equivalent to those in this agreement and remains liable to the Operator for their performance.
7.1 The platform offers integrations with third-party services, including access control systems (such as iLOQ or Bold), payment and invoicing services (such as Mollie or WeFact), email and calendar integrations (such as Microsoft 365) and digital signing services (such as Scrive). The Operator activates these integrations itself per building.
7.2 For these integrations, the Operator itself is the contracting party of the relevant service provider. Those service providers are therefore not sub-processors of Processor and are not listed in Annex B. Processor only provides the technical connection and transfers data on the instructions of the Operator.
7.3 The Operator is responsible for having its own data processing agreement or other appropriate arrangement with the relevant service provider, including the assessment of any transfer outside the EEA, and for including this processing in its own privacy statement and record of processing activities. For questions about processing by that service provider, including data subject requests, the Operator must contact that service provider.
7.4 Processor may require the Operator to record in the platform, before activation, that such an arrangement exists (processor attestation with DPA reference and transfer assessment). Without that record, Processor may refuse activation.
Processor only transfers personal data to countries outside the EEA if an appropriate transfer mechanism applies (adequacy decision, standard contractual clauses or another valid mechanism). The current situation for each sub-processor is set out in Annex B. Transfers resulting from an Integration as referred to in Article 7 are the responsibility of the Operator.
9.1 Processor assists the Operator in handling requests from data subjects (access, rectification, erasure, restriction, portability, objection).
9.2 The platform supports this with built-in DSAR workflows (export and deletion with status tracking), a consent records system and a policy for cases in which data cannot be deleted, or not yet, because of a legal obligation or legitimate interest.
9.3 If Processor receives a request directly from a data subject, it shall refer the data subject to the Operator and inform the Operator without delay.
Taking into account the nature of the processing and the information available to it, Processor provides reasonable assistance in ensuring compliance with the Operator’s obligations under Articles 32 to 36 GDPR. This includes providing information about the platform that the Operator needs for a data protection impact assessment (DPIA), for example for the access control, visitor registration and logging modules.
11.1 Processor shall inform the Operator without undue delay, and no later than 48 hours after discovering a personal data breach, providing the information the Operator needs for its notification obligations under Articles 33 and 34 GDPR.
11.2 In doing so, Processor follows its incident procedure and provides reasonable cooperation in investigating and mitigating the consequences. Processor does not itself notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or data subjects, unless the parties agree otherwise in writing.
12.1 Upon request, Processor makes available the information the Operator needs to assess compliance with this agreement, including the overview of processing activities, the overview of sub-processors and a summary of the security measures.
12.2 If that information proves demonstrably insufficient in a specific case, Processor will cooperate with an inspection. Such an inspection takes place following a personal data breach affecting the Operator or when a supervisory authority requests it, is announced at least 30 days in advance, disrupts the services as little as possible, is subject to confidentiality and is at the Operator’s expense.
13.1 Processor applies the retention periods in Annex D. These periods can be configured per building; if the Operator sets a different period, that counts as an instruction within the meaning of Article 3. The Operator is responsible for the lawfulness of that choice and for complying with any statutory retention obligations.
13.2 Upon termination of the main agreement, Processor shall, at the Operator’s choice, return all personal data in a commonly used format or delete it, within 30 days of the request, except for data that Processor is legally required to retain. Deletion will be confirmed in writing upon request. Processor ensures that its sub-processors also delete the data, with the exception of regular backups that expire in accordance with the usual backup schedule.
14.1 The liability of the parties under this agreement is governed by the liability provisions of the main agreement.
14.2 This limitation applies solely between the parties. It does not affect the rights of data subjects under Article 82 GDPR or fines imposed on a party by a supervisory authority.
15.1 This agreement remains in force for as long as Processor processes personal data for the Operator. Articles that by their nature continue to apply, including confidentiality, remain in force thereafter.
15.2 This agreement is governed by Dutch law.
If the Operator itself processes personal data outside the platform, for example with cameras, paper or digital visitor and attendance lists, key plans outside the platform or its own mailboxes, this falls entirely under the Operator’s own responsibility. Processor has no role in, no access to and no control over this, and such processing is not covered by this agreement.
Only processing relating to modules and integrations that are active for the Operator applies.
| Processing | Data subjects | Personal data | Purpose |
|---|---|---|---|
| Authentication and session management | Users, administrators | Email, hashed password, session metadata, hashed IP and browser characteristics | Access control, account security |
| Member and building management | Members, company contacts, administrators | Identity and contact details, booking metadata, notes | Service delivery and building operation |
| Bookings (meeting rooms, units) | Members, external bookers, guests | Identity and contact details, company name, attendee text, booking and payment metadata | Booking, invoicing, reception coordination |
| Visitor registration and kiosk | Visitors, hosts | Guest’s name and, if the Operator sets it up that way, company name, expected time, host, arrival status | Reception, notifying the host |
| Email communication (if mail integration is active) | Members, contacts, administrators | Sender and recipient metadata, subject, preview text, sync metadata | Support and operational communication |
| Bulk communication preferences | Members, contacts | Identity, email, opt-out status, time, reason | Respecting opt-outs |
| Checkout and invoicing signals | Buyers and companies of the Operator | Identity, address, invoice and payment metadata | Contract and invoicing on behalf of the Operator |
| Push notifications (mobile app) | Users | Push token, device identifier, platform, app version | Operational notifications |
| Physical access (if active) | Members, operators | Access identifiers, integration metadata | Access control |
| Access and lock events | Members, operators | Time, door, user | Only if the Operator activates storage; by default the platform does not store these events |
| AI assistance with onboarding | Administrators, contacts in supplied data | Data supplied by the Operator for setting up a building | Speeding up onboarding |
| Privacy requests (DSAR) and proof of consent | Data subjects | Request IDs, scope metadata, proof of consent | Handling of rights, accountability |
| Security and audit logging | Users, administrators, operators | Actor IDs, event metadata, hashed network characteristics | Security monitoring, accountability |
Processor does not process special categories of personal data as part of the standard services.
These are Processor’s sub-processors. Services that the Operator activates itself as an Integration (Article 7) are not listed here.
| Sub-processor | Purpose | Location / transfer |
|---|---|---|
| D-TT | Technical management, development and hosting of application and database, on its own infrastructure at Amazon Web Services in the EU | EEA |
| Anthropic | AI assistance with onboarding and related features | United States, with appropriate safeguards |
| Expo Push Service | Routing push notifications (mobile app) | United States / worldwide, with appropriate safeguards |
This overview will be supplemented as soon as additional services, such as transactional email delivery or error monitoring, are put into use. We announce changes in advance in accordance with Article 6.
Default periods as configured in the platform. Periods can be configured per building; statutory retention obligations take precedence.
| Data | Period | Action on expiry |
|---|---|---|
| Sessions and session security metadata | 35 days | Delete |
| Password reset tokens | 7 days | Delete |
| Invitations | 90 days | Delete |
| Visitor registrations | 90 days | Delete |
| Email communication content | 180 days | Anonymise; content and addresses erased, metadata retained |
| Notifications | 1 year | Delete |
| Check-in data (welcome email, notes) | 1 year | Redact |
| Service request messages ("Requests") | 1 year | Redact |
| Availability and contact form data | 1 year | Erase contact fields |
| Access and lock events | Not stored by default; if activated, 2 years or the period set by the Operator | Delete |
| Building import records | 2 years | Delete |
| Audit logs | 3 years | Delete |
| Privacy request records (DSAR) | 3 years | Delete |
| Contracts and signed documents | 5 years after the end of the contract concerned | Delete, unless a longer statutory or tax retention obligation applies |
| Invoices and tax records | 7 years (statutory) | Retained by the Operator’s invoicing service |
Email us at [email protected]. We respond within one working day and in any case within the statutory period of one month.
Doory’s own platform entity is still being incorporated; until then, Spoelie B.V. (Chamber of Commerce no. 94087512) acts as Processor. For each customer, the signed version of this agreement prevails.