Data Processing Agreement

1. Scope and Order of Precedence

This Data Processing Agreement (DPA) is between your agency ("you") and {{PLACEHOLDER: company legal name}} ("we"). It forms part of the Terms of Service.

If the DPA and the Terms disagree about personal data, the DPA wins.

2. Roles and Relationship of the Parties

• You are the controller of the personal data in your workspace.
• We are your processor.
• You are responsible for having a legal basis for the data and for telling travellers how it is used.

3. Scope and Details of Data Processing

We process the data to provide TripGate as described in the Terms. This includes storing and organising it, reading it with AI, creating documents, and sending messages you ask us to send.

Processing lasts for as long as the agreement does, plus the deletion period in section 11. Annex 1 has the details.

4. Obligations of the Processor

We will:

• Process the data only on your documented instructions. Using TripGate counts as an instruction. If an instruction seems to break the law, we will tell you.
• Make sure everyone who can access the data is bound by confidentiality.
• Not use the data for our own purposes, including AI training.
• Keep the data secure, as set out in Annex 2.

5. Technical and Organizational Security Measures

We protect the data with technical and organisational measures that suit the risk. These include encryption in transit, separating each agency's data, access controls, logging and backups.

We may improve these measures over time, but we will not lower the overall level of protection. The full list is in Annex 2.

6. Sub-processors and Authorized Subcontractors

You allow us to use the sub-processors listed on the Sub-processors page. Each one is bound by data protection terms at least as strict as this DPA.

We give at least 30 days' notice before adding or replacing a sub-processor.

You can object on reasonable data protection grounds. If we cannot resolve the objection, you may end the affected service and get a refund of any prepaid fees for it.

We remain responsible for our sub-processors.

7. Data Subject Rights Assistance

TripGate has tools to export or erase one traveller's data. You can use them yourself.

If a traveller contacts us directly, we pass the request to you and do not answer it ourselves, unless the law requires it.

We help with other requests where we reasonably can.

8. Personal Data Breach Notification

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and within 72 hours.

We will tell you what happened, what data is affected, and what we are doing about it. We will update you as we learn more, and help you meet your own notification duties.

9. Data Protection Impact Assessments

If you need to carry out an impact assessment, or consult a regulator, we will give you reasonable help and the information we have.

10. Cross-Border and International Data Transfers

Some sub-processors process data outside Sri Lanka. We transfer data only under contracts that keep it protected to the standard of this DPA.

11. Return and Deletion of Personal Data

When the agreement ends, you can export your workspace data for 30 days. After that, we delete it, and the deletion includes backups as they roll over.

We keep only what the law requires us to keep, such as invoices. If you ask, we will confirm the deletion in writing.

12. Audit and Compliance Rights

We will give you the information you reasonably need to show that we comply with this DPA, and we will answer security questionnaires.

You may also carry out one audit a year, at your own cost. You must give 30 days' notice, and the audit must not disrupt the service or expose other customers' data.

13. Annex 1: Details of the Processing Operations

• Whose data: your staff, your travellers and their companions (including children), and your suppliers' contacts.
• What data: names, contact details, travel dates and plans, preferences, messages, documents, and payment status. We do not ask for special categories of data. If a traveller shares health or dietary details in a message, they are processed only as part of that message.
• What we do with it: store it, read it with AI, create itineraries and documents, send messages on your instructions, and back it up.
• How long: for the agreement, plus the deletion period in section 11.

14. Annex 2: Technical and Organizational Measures

• Encryption: all connections use TLS.
• Separation: every record is tied to one agency, and every request is checked against it.
• Access: role-based permissions, optional two-factor login, and admin approval for support access.
• Logging: an activity log of changes, and a download log for inquiry files.
• Files: files attached to inquiries can only be opened by logged-in staff.
• AI: the provider keeps no data after a request, and training is turned off.
• Backups: regular database backups.
• Staff: confidentiality obligations, and production access only for those who need it.
• Retention: raw message data is emptied automatically on the schedule in the Privacy Policy.