This Data Processing Addendum (the "DPA") forms part of the Terms of Service between [Company] ("we", the "Processor") and the Customer ("you", the "Controller"). It applies to the personal information about your clients and their travelling companions that you store in [Product name] ("Customer Personal Data"). If this DPA and the Terms conflict, this DPA wins for Customer Personal Data.
1. Roles
You decide what Customer Personal Data you store and why: you are the controller (a "business" under the California Consumer Privacy Act and similar state laws) and we are your processor (a "service provider" or "processor" under those laws).
2. Details of the processing
- Subject matter and purpose: hosting and processing Customer Personal Data to provide the Service.
- Duration: while you have an account, then as in section 9.
- Data subjects: your clients, their travelling companions and family members, including minors, and your suppliers' contacts.
- Categories of data: names, contact details, addresses, dates of birth, gender, family relationships, notes and tasks, and, as you choose to record them, travel preferences and booking details.
- Sensitive data: health, accessibility and dietary information, and travel document numbers, when you record them. You are responsible for the consents section 8 of the Terms requires.
3. Instructions
We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use of the Service, unless the law requires otherwise, in which case we will tell you first unless the law forbids it.
4. Confidentiality
Everyone we authorise to process Customer Personal Data is bound by confidentiality and has access only as far as their role needs.
5. Security
We keep the technical and organisational measures in the Annex, and may improve them but not weaken them.
6. Subprocessors
You authorise the subprocessors on our Subprocessors page. We bind each one to data-protection terms at least as protective as this DPA and remain responsible for them. We will give you at least 30 days' notice by email before adding or replacing one; if you object on reasonable data-protection grounds and we cannot address the objection, you may terminate the affected Service and receive a refund of prepaid fees for the remaining period.
7. Helping you answer requests
The Service lets you find, correct, export and delete a person's information yourself. Where you need more, we will help you respond to requests from data subjects and regulators, as far as the nature of the processing allows. We forward to you any request we receive directly.
8. Security incidents
We will tell you without undue delay, and aim to do so within 72 hours, after becoming aware of a breach of security affecting Customer Personal Data, with the information you need to meet your own notification duties, and keep you informed as we learn more.
9. Return and deletion
For 30 days after your subscription ends or your account is closed you can export all Customer Personal Data. After that we delete it from the Service, and from backups as they roll off within [N days], unless the law requires us to keep it.
10. Information and audits
We will make available the information reasonably necessary to show we meet this DPA, including answers to security questionnaires, once a year or after a security incident.
11. US state privacy laws
For Customer Personal Data we will not:
- sell or share it (including for cross-context behavioural advertising);
- retain, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you;
- combine it with personal information we receive from anyone else or collect ourselves, except as those laws allow;
- use it to train artificial-intelligence models.
We will comply with the obligations those laws place on service providers and processors, provide the same level of protection they require, and tell you if we can no longer meet them. You may take reasonable steps to stop and remedy unauthorised use. We understand and will comply with these restrictions.
Annex: security measures
- Tenant isolation: every agency's data is separated by row-level security in the database, and an automated test suite checks on every change that one agency cannot read, write or move another's records.
- Encryption: TLS for all traffic; encryption at rest for the database, backups and file storage; field-level encryption for travel document numbers [ships with travel documents].
- Sessions: sign-in tokens live in cookies that page scripts cannot read; requests from other sites are refused.
- Access: multi-factor authentication for users [in development]; least-privilege access for our staff and systems; production access limited to named people.
- Backups: daily, with point-in-time recovery where our database provider offers it.
- Audit log: sign-ins, role changes, exports and document views are recorded [in development].
- Error reports: scrubbed before they leave the Service: no screen recordings, no form contents, no search terms, no cookies; records are identified by opaque ids only.
- Payment cards: handled entirely by our payment processor; card numbers never reach our systems.