Data Processing Agreement

What is a DPA?

When TravoPilot processes personal data (such as traveller names, emails and booking details) on behalf of your business, your business is the Data Controller and TravoPilot is the Data Processor. Under GDPR (Article 28) and similar regulations, a written Data Processing Agreement must be in place between the controller and processor.

When do you need a DPA?

You need a signed DPA with TravoPilot if:

• Your business is subject to GDPR (you operate in or target customers in the EU/EEA).
• Your business is subject to UK GDPR, Switzerland’s revDPA, or similar data protection laws in other jurisdictions.
• Your customers are natural persons whose personal data passes through TravoPilot (e.g. travellers interacting with the AI assistant).

If you operate solely in jurisdictions without data protection law requirements, a DPA may still be requested by your enterprise customers or data protection officer.

What our DPA covers

The TravoPilot DPA addresses the following requirements:

• Subject matter and duration of processing (the Services, for the term of the subscription).
• Nature and purpose of processing (delivering the AI platform, including conversation handling, analytics and automation).
• Types of personal data processed (traveller contact details, booking information, interaction transcripts).
• Categories of data subjects (travellers, agents and other end users of the customer’s services).
• Technical and organisational security measures (see our Security page).
• Sub-processors (list of third-party infrastructure and service providers used to deliver the platform).
• Data subject rights assistance obligations.
• International transfer mechanisms (Standard Contractual Clauses where applicable).
• Data deletion and return upon termination.

How to get a signed DPA

To request a Data Processing Agreement:

1. Email legal@travopilot.com with the subject line “DPA request”.
2. Include your company name, registration number and the jurisdiction whose law applies to your business.
3. We will send a pre-signed DPA within 5 business days.
4. Sign and return — we will countersign and provide a fully executed copy.

Business plan customers with dedicated CSM support can also request DPA execution as part of onboarding.

Sub-processors

TravoPilot uses a limited number of sub-processors to deliver the platform. The current list includes:

• Amazon Web Services (AWS) — cloud infrastructure (compute, storage, databases) and transactional email (SES). Region: varies by customer configuration.
• Cloudflare — CDN, DDoS protection and HTTPS termination.

We will notify Business plan customers at least 30 days before adding or replacing a sub-processor, giving you the right to object.

Related documents

• Privacy Policy — how we handle personal data submitted through our website.
• Security — technical and organisational measures in detail.
• Terms & Conditions — the service agreement that governs your subscription.