Data Processing Agreement (DPA)
The processor terms between the subscribing tour operator (controller) and TravelBookingWidgets (processor), incorporated into the Terms of Service. Structured around UK GDPR Article 28 and the Kenya Data Protection Act 2019 processor duties.
1. Roles, subject matter and scope
This DPA applies where TravelBookingWidgets (VHK Tech Ltd, company number 10522820, "Processor") processes personal data on behalf of the subscribing tour operator ("Controller") to provide the platform. The Controller determines the purposes and means of that processing; the Processor acts only on the Controller's documented instructions.
The details of the processing — subject matter, duration, nature and purpose, data categories and data-subject categories — are set out in Annex A. The security measures are set out in Annex B.
2. Documented instructions
The Terms of Service, the Controller's workspace configuration, and any written instructions agreed between the parties constitute the Controller's documented instructions. The Processor will inform the Controller if an instruction appears to infringe data protection law, and will notify the Controller if it cannot comply with an instruction.
3. Confidentiality
The Processor ensures that personnel authorised to process personal data are bound by confidentiality obligations and access personal data only on a need-to-know basis.
4. Security
Taking into account the state of the art, costs of implementation and the nature of the data, the Processor maintains the technical and organisational measures in Annex B, including encryption in transit and at rest, multi-factor-capable authentication, strict per-operator data separation via row-level security, encrypted storage of mailbox credentials, file-type and size checks and rate limiting. Attachment virus scanning is currently off; these draft measures remain subject to owner and legal review. The Processor may update these measures without reducing the overall level of protection.
5. Subprocessors
The Controller gives general written authorisation to the Processor's subprocessors listed at /legal/subprocessors. The Processor will give at least [30] days' advance notice of any new or replacement subprocessor by updating that page and emailing workspace owners, during which the Controller may object on reasonable data-protection grounds. If the parties cannot resolve an objection, the Controller may suspend the affected processing or terminate the affected service, with a pro-rata refund of prepaid unused fees.
The Processor imposes data-protection obligations equivalent to this DPA on each subprocessor and remains fully liable to the Controller for subprocessors' performance.
6. Data-subject rights
Taking into account the nature of the processing, the Processor assists the Controller in fulfilling its obligations to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection). Today this assistance is provided via a request to privacy@travelbookingwidgets.com — self-service export tooling is in development.
7. Personal-data breach
The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data, providing the nature of the breach, the categories and approximate numbers concerned, likely consequences and measures taken or proposed. Regulatory notification duties sit with the Controller as controller (for example, 72 hours to the UK ICO, and notification to Kenya's ODPC where required); the Processor assists with information for those notifications and maintains its own breach records.
8. Impact assessments and consultation
The Processor provides reasonable assistance with data protection impact assessments and prior consultation with regulators, taking into account the information available to the Processor.
9. International transfers
Proposed safeguards for legal review: identify restricted transfers, confirm applicable UK IDTA/Addendum and provider agreements, assess transfer risks and applicable Kenyan requirements. Signed safeguards and processing locations have not been verified; the draft subprocessor inventory identifies outstanding location questions.
10. Return and deletion
Proposed return/deletion process for legal review: agree export or deletion with the Controller and provide a 30-day recovery window after explicit archive. Termination alone does not trigger archive or purge. No automatic 60-day deletion deadline is evidenced. Before approval, confirm deletion coverage, retained financial records, backup expiry and handling of third-party copies; unresolved purge and subject-erasure gaps prevent a complete-erasure promise.
11. Audit, records and accountability
The Processor maintains records of processing under UK GDPR Article 30(2) (and Kenya DPA 2019 equivalents), makes available to the Controller the information necessary to demonstrate compliance with this DPA, and allows for and contributes to audits — via compliance summaries on an annual request cycle, and, only where reasonably required and on [30] days' notice, an inspection that does not jeopardise other operators' data or confidentiality.
12. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms of Service. This DPA forms part of the Terms of Service; if there is a conflict about personal-data processing, this DPA prevails.
Annex A — Details of processing
| Item | Description |
|---|---|
| Controller | The subscribing tour operator |
| Processor | VHK Tech Ltd (company number 10522820) trading as TravelBookingWidgets |
| Subject matter | Management of the Controller's traveller, booking and correspondence data in the platform |
| Duration | The subscription term plus the post-termination exit window |
| Nature and purpose | Capture, storage, quoting and document generation, communications (email/WhatsApp), payment-request initiation and payment metadata — solely to operate the Controller's travel business on the platform |
| Categories of data subjects | Controller's staff; travellers and guests; the Controller's supplier contacts |
| Categories of personal data | Identity and contact details (names, emails, phone numbers, addresses); trip and booking details; documents; communications content; payment metadata (amount, currency, status, tracking references — never card data) |
| Special-category data | The platform is not designed for special-category data; the Controller must not submit it |
| Processing locations | Database, authentication and file storage in the EU (Ireland, Supabase); application servers in the United States (Vercel); other providers per the subprocessor list at /legal/subprocessors |
Annex B — Technical and organisational measures
- Encryption of personal data in transit and at rest.
- Two-step verification for operator accounts; optional multi-factor authentication.
- Operator accounts isolated from one another by database row-level security.
- Mailbox and integration credentials stored encrypted; secrets vaulting.
- Upload file-type and size checks; rate limiting; session and audit logging. Virus scanning is off and attachments are labelled "not virus-scanned".
- Access control on a need-to-know basis; personnel confidentiality obligations.
- Backup tier, expiry and restore capability require dashboard evidence and a documented restore drill before legal approval.