Data processing addendum

1. Roles

1. For travel booked under your corporate program, you are the controller and silentVIP is your processor. We process personal data only on your documented instructions, which are this addendum, the agreement and your use of the portal.
2. When we pass booking details to airlines, hotels and other suppliers, they act as independent controllers for the travel they provide, because travel can't be provided otherwise.
3. Private travel booked by an individual directly with us is outside this addendum.

2. Processing details (Annex 1)

3. Our obligations

1. Process personal data only on your instructions, and tell you if we believe an instruction breaks data protection law.
2. Make sure everyone who processes it is bound by confidentiality.
3. Help you respond to data subject requests and with data protection impact assessments, as far as is reasonable.
4. Delete or return personal data at the end of the services, within 30 days after the services end, except records the law requires us to keep (trip and billing records, for 7 years).

4. Security measures (Annex 2)

• Single-use email sign-in links that expire after 20 minutes; hashed session tokens in secure, HTTP-only cookies; role-based access with deny-by-default for limited roles
• Every record scoped to its client account, with automated tests for cross-account and cross-role access on every release
• TLS for all traffic with HTTPS enforced; Cloudflare encrypts the portal's database and file storage at rest
• Audit records of sign-ins, changes to policy and roles, approvals, document downloads and staff actions
• Rate limits on sign-in and public forms; origin checks on every form submission; a strict content security policy
• Database point-in-time recovery through Cloudflare D1, with a full export before every schema change; Recovery time objective 4 hours; recovery point objective 1 hour
• Staff complete security and privacy training when they join and every year after; Every member of staff signs a confidentiality agreement before getting access to client data; Access is removed within 1 business day of someone leaving
• Dependencies are reviewed monthly, and critical security fixes are deployed within 7 days

5. Subprocessors (Annex 3)

1. You authorize the subprocessors listed below and at /trust/subprocessors. We give you 30 days notice before adding or replacing one, and you may object on reasonable data protection grounds. If we can't resolve the objection, you may end the affected services without penalty.
2. We impose data protection terms on each subprocessor that are at least as protective as this addendum, and remain responsible for their performance.

• Cloudflare, Inc.: Hosting of the website and client portal, database, file storage, content delivery and privacy-preserving web analytics (United States (global network))
• Resend, Inc.: Sending transactional email: sign-in links, invitations, confirmations and notifications (United States)
• Google LLC (Google Workspace): Staff email and documents used by the travel team (United States)
• Global distribution systems and booking tools used to search, book and ticket travel: Searching, booking, ticketing and changing travel (United States and worldwide)

Airlines, hotels, rail and car rental companies receive traveler details as independent controllers to provide the travel booked; they are listed at /trust/subprocessors.

6. International transfers

1. Personal data is stored as described here: Portal data is stored in Cloudflare D1 with its primary location in eastern North America and is served through Cloudflare's global network. File uploads are held in Cloudflare storage. Email is sent through Resend from the United States.
2. Where personal data from the EU, EEA or Switzerland is transferred to a country without an adequacy decision, the European Commission's standard contractual clauses (module two, controller to processor) apply and are incorporated by reference. For UK personal data, the UK International Data Transfer Addendum applies.
3. Travel suppliers in the destination country receive the data needed for each booking, which is a transfer necessary to perform the travel the traveler asked for.

7. Personal data breaches

1. We tell you without undue delay, and within 72 hours, after confirming a breach affecting your personal data, with what we know about its nature, the data and people affected, its likely consequences and what we're doing about it.
2. We update you as we learn more, and help you meet any duty to notify regulators or individuals.

8. Audits

1. We make available the information needed to show compliance with this addendum, and allow audits once a year, on 30 days' notice, by written questionnaire or, where that is not enough, by an independent auditor both parties agree. Audits are at your cost, during business hours, and subject to confidentiality.

9. Order of precedence

1. If this addendum conflicts with the agreement on the protection of personal data, this addendum wins. If it conflicts with the standard contractual clauses, the clauses win.