Data Processing Addendum

1. Subject matter, duration and nature

The Processor processes personal data on behalf of the Controller solely to provide the booking platform: host and manage bookings, communicate with travellers (confirmations and notices), process the information needed for collection and issue statements. Duration: that of the service agreement, plus the time needed to return or delete the data under clause 9.

2. Types of data and data subjects

• Data subjects: travellers and people who book, and companions whose details are given in the booking.
• Data: identification and contact (name, email, phone), booking data (activity, date, number of people, amount, payment status), and information the traveller voluntarily provides when booking (e.g. notes or needs).
• Processing of special categories of data is not envisaged. The Controller must not request them through the platform unless indispensable and must notify the Processor.

3. Processor obligations

1. Process data only on the Controller's documented instructions, which include these terms and the configured use of the platform, including as regards international transfers. If it considers an instruction infringes the rules, it will inform the Controller.
2. Ensure that persons authorised to process the data are committed to confidentiality.
3. Apply the security measures of article 32 GDPR described in Annex II.
4. Respect the conditions on sub-processors (clause 6).
5. Assist the Controller, taking into account the nature of the processing, in responding to data-subject rights requests, forwarding to it without delay those it receives directly.
6. Assist the Controller in meeting security obligations, impact assessments and prior consultation, where applicable.
7. Notify the Controller, without undue delay and in any case within 48 hours of becoming aware, of any personal data breach, with the information available so it can notify the authority.
8. Make available to the Controller the information necessary to demonstrate compliance and allow reasonable audits, on 30 days' notice, during working hours and subject to confidentiality, without compromising other customers' security.

4. Controller obligations

The Controller warrants that it has a legal basis to process the data and entrust its processing, that it has informed travellers in line with articles 13 and 14 GDPR, that it will use the data only to deliver the activity and meet its legal obligations, and that it will not upload data that is not necessary.

5. Processor's own purposes

This Addendum does not cover processing that For Holidays carries out as an independent controller (payment collection and fraud prevention, invoicing and accounting, platform security and legal compliance), described in the privacy policy.

6. Sub-processors

The Controller gives general authorisation to use the sub-processors in Annex III. The Processor will notify any addition or replacement at least 15 days in advance, by email or in the dashboard, and the Controller may object on reasonable data-protection grounds within that period; if unresolved, it may terminate the service. The Processor will impose on sub-processors obligations equivalent to those in this Addendum and remains liable to the Controller for their performance.

7. International transfers

Where a sub-processor processes data outside the EEA, the Processor will ensure an adequate safeguard under chapter V GDPR (adequacy decision, including the EU-US Data Privacy Framework for certified providers, or standard contractual clauses).

8. Data-subject rights and breaches

Data-subject requests about booking data should be addressed to the Controller. If received by the Processor they will be forwarded to the Controller without delay, unless the Processor acts as an independent controller.

9. Return or deletion

On termination of the service, and at the Controller's choice, the Processor will return or delete the personal data and existing copies within 90 days, unless Union or Spanish law requires their retention (for example the Processor's own accounting and tax obligations). Until then it will keep them blocked.

10. Liability and governing law

Each party is liable under article 82 GDPR and the limitations in the operator terms, to the extent permitted by law. This Addendum is governed by Spanish law and the competent courts are those stated in the operator terms.

Annex I — Description of the processing

• Operations: collection, recording, structuring, storage, consultation, disclosure by transmission (email to travellers and operator), erasure.
• Purpose: provision of the booking platform on behalf of the Controller.
• Frequency: continuous for the duration of the service.
• Retention: as stated in clause 9.

Annex II — Technical and organisational measures

• Encryption of communications via HTTPS/TLS.
• Access control per operator account (row-level security in the database) and logical separation of each operator's data.
• Staff access limited to what is necessary and with individual credentials.
• Card data is not stored: Stripe handles it.
• Server keys and secrets managed as protected environment variables, outside the code and browser.
• Request rate-limiting to protect against abuse.
• Incident-management and breach-notification procedure per clause 3.
• [COMPLETAR: add backups, password/MFA policy and access logs only if confirmed in practice].

Annex III — Authorised sub-processors

• Supabase — database and authentication. Location: [COMPLETAR: Supabase project region].
• Vercel — application hosting and execution. Location: [COMPLETAR: Vercel functions region].
• Stripe — payment and refund processing (also an independent controller for its regulatory obligations).
• Google (Gmail API and, if the Operator enables it, Calendar) — sending transactional emails and syncing events.
• Upstash — request rate-limiting (IP addresses, transient), when enabled.