Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of the Terms of Service between SPR Software Ltd, trading as AgentHub ("we", "the Processor"), and the agency that holds the AgentHub account ("you", "the Controller"). It sets out the terms required by Article 28 of the UK GDPR for the Client Data we process on your behalf. It applies automatically; nothing needs to be signed.

Where this DPA and the Terms conflict about personal data, this DPA prevails.

1. Parties and roles

• You are the controller of Client Data: you decide which travellers' details to collect, what to collect, and what to do with it.
• We are your processor: we store, transmit and display Client Data only to provide the Service to you, and only on your documented instructions. Your instructions are the Terms, this DPA and your use of the Service's features.
• For data about agency users themselves — the people who sign in — we are the controller, and our Privacy Policy applies instead.

2. Scope and duration

This DPA applies for as long as you have an account and we hold any Client Data, including the export and deletion period after closure.

3. Nature and purpose of processing

Hosting, storage, transmission, display and deletion of Client Data as needed to:

• receive enquiries through forms and hosted websites;
• prepare, send and track quotes;
• collect passenger details and documents;
• confirm and manage bookings and send booking emails;
• give travellers secure access to their pages through emailed links and codes.

We do not use Client Data for any purpose of our own, and we do not use it to train or improve models.

4. Data subjects and categories of data

Data subjects: your clients — lead bookers, the other travellers on a booking, and people who submit enquiries.

Categories of personal data:

• identity and contact details — names, email addresses, phone numbers, postal addresses;
• booking details — travel dates, destinations, itineraries, preferences, supplier references;
• passenger details — dates of birth, nationality, passport numbers and expiry dates;
• documents you upload about a booking;
• payment references (amounts, deposit and balance status — never card details, which are handled by your own payment arrangements);
• technical data generated when a traveller opens a page — IP address and browser, held for security and rate limiting.

Special category data: free-text health and accessibility notes that travellers choose to give, used only to arrange the trip. You are responsible for having a lawful condition under Article 9 to collect them. Details of children may be included where a child is travelling.

5. Our obligations as processor

We will:

1. Follow your instructions. Process Client Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you first where we can. We will tell you if we believe an instruction breaks data-protection law.
2. Keep it confidential. Make sure everyone who can access Client Data is bound by confidentiality and has access only where their role requires it.
3. Keep it secure. Apply appropriate technical and organisational measures: encryption in transit (TLS) and at rest — our database provider (Neon) and file-storage provider (Cloudflare R2) encrypt everything they store with AES-256, and the Service additionally encrypts passport numbers with AES-256-GCM before storing them, shows them to your users masked, and records each time one is revealed; access controls and audit logging, including every download of a booking document; rate limiting and abuse protection, secured sessions and single-use access links, and monitoring. We review these measures as the Service changes.
4. Use only approved sub-processors. Engage sub-processors only as set out in section 7, under written terms that impose equivalent obligations, and remain responsible for their performance.
5. Help you with data-subject requests. The Service lets you view and edit Client Data directly; for anything it cannot do yet, we will help within a reasonable time so that you can answer requests for access, rectification, erasure, restriction, portability or objection within the statutory period.
6. Help you with your other obligations. Assist, taking account of the information available to us, with security, breach notification and data-protection impact assessments.
7. Tell you about breaches. Notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting Client Data, with the information you need to meet your own notification duties.
8. Delete or return the data. On closure of your account, make Client Data available for export for a reasonable period and then delete it, including from backups in the ordinary cycle, unless the law requires us to keep it. While your account is open, delete Client Data on the schedule in section 12.
9. Show you we comply. Make available the information needed to demonstrate compliance with Article 28, and allow and contribute to audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice and no more than once a year unless a breach has occurred.

6. Your obligations as controller

You will:

• have a lawful basis for collecting and using Client Data, and a lawful condition for any special-category data;
• give travellers your own privacy notice;
• collect only the data you need, and keep it accurate and up to date;
• use the Service's access controls properly and keep your sign-in details secure;
• respond to data-subject requests from your clients;
• not instruct us to process Client Data in a way that breaks the law.

7. Sub-processors

You authorise us to use the sub-processors below. Each has been engaged under written terms that meet Article 28, and we remain responsible to you for their work.

Provider	Purpose	Location of processing	Transfer basis
Render Services, Inc.	Application hosting and scheduled jobs; short-term server logs (request method, path and status — never the query string, which carries travellers' access links — and application log lines with personal data redacted), retained for 7 days on our current plan as published by Render	EU — Frankfurt, Germany for the service and its data; Render's own operations and support are in the United States	UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses as fallback (Render DPA §6.4)
Databricks, Inc. (Neon)	Primary database	EU — Frankfurt, Germany (AWS eu-central-1, the region we selected); Databricks' own operations and support are in the United States	EU Standard Contractual Clauses incorporated into the Databricks DPA, applied to UK transfers through the UK International Data Transfer Addendum (Databricks DPA §8.1 and Annex B)
Cloudflare, Inc.	File storage (R2, EU jurisdiction), DNS, edge routing for custom domains (whose request logs record method, path and status only, retained for 3 to 7 days as published by Cloudflare), inbound support-email routing, Turnstile bot protection	EU jurisdiction for stored files; global edge network for request routing; Cloudflare's own operations and support are in the United States	Data Privacy Framework while Cloudflare's certification is live (Cloudflare DPA §6.4); otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, deemed executed (§6.2(b))
Stripe Payments Europe Ltd (Ireland), with Stripe, LLC (United States)	Subscription billing and referral payouts for agencies (no traveller data)	Ireland and the United States	Data Privacy Framework while Stripe, LLC's certification is live (Stripe Data Transfers Addendum §§2–3); otherwise the UK International Data Transfer Addendum, deemed executed with Stripe, LLC (§5)
Resend, Inc.	Outbound email delivery — quotes, booking emails, access codes	United States	EU Standard Contractual Clauses with the UK International Data Transfer Addendum, deemed entered into and incorporated (Resend DPA §6.4); Resend also commits to the EU-US Data Privacy Framework and its UK Extension (§6.7)
Functional Software, Inc. (Sentry)	Error monitoring; personal data and free text are scrubbed before reports leave our server	EU data region — Frankfurt, Germany (the region we selected); Sentry's own operations and support are in the United States	Data Privacy Framework, including its UK Extension, while Sentry's certification is live; otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, incorporated by reference and deemed signed (Sentry DPA Schedule 3)
Help Scout, Inc.	Support help desk (agency correspondence only; travellers are not directed to it)	United States	EU-US Data Privacy Framework and its UK Extension while Help Scout's certification is live (Help Scout DPA §7(b)); otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum (§7(c), Annexes B and C)
Better Stack, Inc.	Uptime monitoring — probes public health endpoints only; receives no personal data	EU — Czech Republic	Not applicable: no personal data processed

Changes. We will give you at least 30 days' notice by email before adding or replacing a sub-processor that will process Client Data. If you object on reasonable data-protection grounds and we cannot resolve it, you may close your account before the change takes effect without penalty for the remainder of your billing period.

8. International transfers

Our application and database run in the European Union, which the UK treats as adequate. Where a sub-processor is established outside the UK and the EEA, or holds data there, the transfer is covered by the basis in the table above: the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the provider's certification under the UK Extension to the EU-US Data Privacy Framework. We will not transfer Client Data outside the UK or EEA on any other basis without your prior written agreement.

9. Breach notification

Section 5(7) above sets our notification duty. A notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and will be followed up as more becomes known.

10. Liability

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except that nothing limits either party's liability to data subjects under Article 82 of the UK GDPR.

11. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

12. Retention and deletion

We keep Client Data for as long as you need it to serve your clients, and no longer. Quotes, bookings, booking documents and the names and dates of birth of travellers stay for as long as your account is open, unless you delete them or a client asks you to; the schedule below removes what has served its purpose. It is enforced by a job that runs nightly, and each removal within your account is recorded in your audit trail with a count and the period that applied — never the data itself.

Client Data	Removed
Passport numbers	90 days after the booking's travel end date, or after its cancellation. The traveller's name and date of birth remain; the booking shows that the number was removed.
Enquiries that were closed without a quote or booking	24 months after they were last changed.
Client records with no enquiry, quote or booking	24 months after they were last changed.
Emailed access links and codes	Links: when they expire, 30 days after sending, or 7 days after they are used. Codes: one day after they are issued.
The IP address and browser recorded when a traveller submits an enquiry or accepts a quote	24 months after the submission or acceptance. The record of the act itself — who, when, and the wording agreed to — remains.
The IP address and browser recorded when a traveller opens a page through an access link or code	90 days. The record that the page was opened remains.
Uploaded files that no quote, booking or page refers to any more	30 days after they stop being referred to.

Data that has been removed cannot be recovered. Where you need a passport number after the trip, you will need to ask the traveller again. Our operator documentation publishes the full schedule and how the job is run.

Contact

Data-protection questions and requests: support@agenthub.travel · SPR Software Ltd, Crown House, 27 Old Gloucester Street, London, WC1N 3AX.