Data Processing Agreement (DPA)
This Agreement defines the technical data stewardship roles between Staurax ("Hostel Cloud") and individual Hostel Operators regarding the cloud hosting, processing, and security of resident personal data.
1. Contractual Context
This Data Processing Agreement ("DPA") governs the cloud-based hosting and indexing of resident records, identity documentation, and room directories managed by the Hostel Operator through Hostel Cloud. This document complements the Hostel Owner Agreement and general Terms of Service.
2. Data Roles: Controller vs. Processor Nuance
Data stewardship roles depend on the specific data flow and operational control:
Hostel Operator as Data Controller
The Operator establishes the lawful basis for collecting resident CNICs, student ID scans, parent contact details, and room dues under provincial lodging regulations. The Operator controls what resident records are uploaded and maintained in their private property roster.
Hostel Cloud as SaaS Host & Processor
Regarding resident documentation uploaded by operators into the SaaS management dashboard, Hostel Cloud processes, stores, and indexes records on the instructions of the Operator to deliver platform services.
3. Data Elements & Subjects
- Data Subjects: Hostel residents, student applicants, hostel wardens, administrative staff, and emergency contacts.
- Processed Information: Names, contact numbers, email addresses, CNIC/Form-B numbers and uploaded scans, student registration cards, room allocations, fee vouchers, and payment slips.
- Duration: Processing continues for the duration of the Operator’s active subscription or platform account, subject to standard archival and deletion procedures.
4. Confidentiality & Personnel Safeguards (PECA Section 41)
In accordance with Section 41 of the Prevention of Electronic Crimes Act, 2016 (PECA) concerning subscriber information confidentiality:
- All Hostel Cloud personnel and contractors authorized to access server systems are bound by written non-disclosure and confidentiality obligations.
- Personnel access is restricted on a strict least-privilege, need-to-know basis required for platform maintenance and technical support.
5. Technical Security Measures
Hostel Cloud maintains the following organizational and technical security measures:
6. Sub-processors & Infrastructure Providers
The Operator authorizes Hostel Cloud to engage vetted sub-processors for technical delivery:
- Cloud infrastructure, database, and object storage providers.
- Transactional SMS and automated email delivery gateways.
- Digital payment gateway providers for subscription processing.
7. Security Incident & Breach Notification
In the confirmed event of a security incident compromising the confidentiality or integrity of resident documentation stored on our systems:
- Hostel Cloud will notify affected Hostel Operators without undue delay upon verifying the incident.
- The notification will provide available details regarding the nature of the breach, estimated affected records, and remediation steps taken.
- Operators remain responsible for fulfilling any statutory notices required to individual residents or local police authorities.
8. Data Return & Deletion
Operators may update or remove resident records directly through dashboard tools. In the event of subscription termination or account deletion, tenant data is processed via automated tenant purge routines, subject to standard disaster recovery backup cycles.