Data Processing Addendum

1. Roles

This Data Processing Addendum (DPA) forms part of the agreement between your organisation (the controller) and NextPass (the processor). It governs the processing of personal data that NextPass carries out on your behalf.

2. Scope and purpose

NextPass processes personal data only to provide the platform: operating access control, recording entry and exit passages, and producing attendance, leave and reporting outputs, and only on your documented instructions.

3. Categories of data and data subjects

Data subjects: the people your organisation enrols — such as employees, students, staff and visitors.

Personal data: identity and credential data (names, IDs, cards, fingerprint templates, car stickers) and access and attendance events (passages, timestamps, doors and derived records).

4. Security

NextPass maintains appropriate technical and organisational measures, including role-based access, an audit trail, and controls over the sync channel between the platform and physical controllers, to protect personal data against unauthorised access, loss or disclosure.

5. Sub-processors

NextPass may engage sub-processors to help deliver the service. We remain responsible for their compliance and will inform you of intended changes so you can object on reasonable grounds.

6. Assistance and sub-processing of rights requests

NextPass will assist you, taking into account the nature of the processing, in responding to data subject requests and in meeting your security, breach-notification and impact-assessment obligations.

7. Return and deletion

On termination, NextPass will delete or return the personal data it processes on your behalf, save where storage is required by law.

8. Contact

To put a signed DPA in place or ask about our sub-processors, contact info@nextleap.al.