Data processing addendum

This addendum forms part of our terms of service. It applies whenever we process personal data on behalf of an agency using Travagon. The agency is the controller and we are its processor, under the UK GDPR and the Data Protection Act 2018. Where this addendum and the terms conflict about personal data, this addendum wins.

• We process the personal data only on the agency's documented instructions, which are these terms and the agency's use of Travagon, unless the law requires otherwise; we will tell the agency if we think an instruction breaks data protection law.
• Everyone who can access the data is bound by confidentiality.
• We keep the data secure with the measures in section 6.
• We help the agency respond to people exercising their rights, including with built-in tools to export and erase a customer's data.
• We help the agency with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the nature of the processing and the information available to us.
• We make available the information needed to show we meet these obligations, and allow and contribute to reasonable audits, on reasonable notice and no more than once a year unless a breach or regulator requires it.

The agency gives general authorisation for us to use sub-processors. The current list is on our sub-processors page. We will update that page at least 30 days before a new sub-processor starts processing agency data. If the agency has a reasonable data protection objection, it can tell us within that period; if we can’t address it, the agency may cancel and receive a pro-rata refund of fees paid for the remaining period.

We impose data protection obligations on each sub-processor equivalent to this addendum, and remain responsible for their performance.

Agency data is hosted in Germany. Where a sub-processor processes it outside the UK and the European Economic Area, we make sure the transfer is covered by a mechanism recognised under UK law, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.

• Encryption in transit for all traffic (HTTPS).
• Passport numbers and connected-account credentials encrypted at rest with AES-256-GCM, using a separate data key for each agency; HR documents encrypted on disk.
• Each agency's data separated at the database level (row-level security), with roles and permissions controlling what each staff member can see.
• Passport numbers shown masked; every reveal logged with the person, time, reason and IP address. Access to employee records logged separately.
• An audit log of significant actions in each account.
• Two-factor authentication required for account owners and for our own administrators.
• Support access to an agency account only through a time-limited session (2 hours), with every action in it logged and marked as support.
• Rate limits on public endpoints, and server logs that leave out query strings, cookies and sign-in headers.
• Daily backups, kept for 14 days.
• Optional automatic deletion of passport details a set number of days after travel, chosen by the agency.

If we become aware of a personal data breach affecting agency data, we will tell the agency without undue delay, and in any event within 48 hours, with the information we have about what happened, the data affected and what we are doing about it, so the agency can meet its own duty to notify the ICO within 72 hours where required.

The agency can export its data at any time. When its subscription ends, it has 30 days to export; we then delete the agency’s data from our live systems, and it is removed from backups as they are overwritten within 14 days, unless the law requires us to keep it.

Questions about this addendum, or a request for a signed copy: [privacy email].