Data Processing Agreement

1. Parties and subject

This DPA forms part of the service agreement between the subscribing travel agency (Controller) and Trevion UG (haftungsbeschränkt) (Processor). Processor handles traveller, prospect, customer, contact and user data for delivery of BriefSignal.

2. Duration

Processing lasts from the service start until contractual return or deletion. Confidentiality and evidence duties survive where appropriate.

3. Documented instructions

Processor acts only on documented instructions expressed through the contract, settings and authorised user actions. Processor informs Controller if an instruction appears unlawful and may pause it pending clarification.

4. Confidentiality

Only authorised persons bound by confidentiality and requiring access may process data. Access is restricted by role, tenant and task.

5. Security

Risk-based measures include TLS in transit, password hashing, optional 2FA, role and tenant access controls, security logging and masking, backups, patching, vulnerability and incident processes, access revocation, retention and deletion jobs. Detailed TOMs are available confidentially on request.

6. Subprocessors

Controller grants general authorisation for listed subprocessors. Material additions or replacements are notified electronically at least 14 days in advance, allowing objection on substantiated privacy grounds. Equivalent protection is contractually imposed.

7. International transfers

Transfers outside the EEA require a GDPR Chapter V mechanism, including adequacy, Standard Contractual Clauses and supplementary measures where necessary.

8. Data-subject requests

Controller decides requests. Processor provides reasonable assistance for access, correction, deletion, restriction, portability and objection, and forwards direct requests where the Controller can be identified.

9. Breach

Processor notifies Controller without undue delay and aims to provide an initial notice within 24 hours of awareness, including known nature, data subjects, likely impact, measures and contact. Missing details may follow in phases.

10. DPIA and authority

Taking account of the processing and available information, Processor reasonably assists with GDPR Articles 32–36 obligations.

11. Audit

Processor provides compliance information. Controller may audit once annually and additionally after a substantiated incident or authority request with reasonable notice. Documentation or remote review comes first; on-site audits must be necessary, proportionate and confidential.

12. Return and deletion

Controller exports data at contract end. Processor then returns or deletes personal data as chosen, unless law requires retention. Backups are removed through normal overwrite cycles and remain isolated from business use until then.

13. Priority

GDPR Article 82, the service agreement and mandatory law govern liability. This DPA prevails over the Terms for processing matters.

Annex B – Approved subprocessors