Draft
Data Processing Agreement
The agreement under article 28 GDPR for the personal data Advolo processes for operators and brokers.
This data processing agreement (“DPA”) is part of every Agreement between Advolo and a Customer and applies to personal data Advolo processes for the Customer. It meets article 28 of the General Data Protection Regulation (GDPR).
1. Roles and subject
The Customer is controller and Advolo is processor for the personal data in Customer Data described in Annex 1. Advolo processes them only to provide the Platform under the Agreement and on the Customer’s documented instructions; the Agreement, this DPA and the Customer’s use of the Platform’s functions are those instructions. If Advolo believes an instruction breaks the law, it tells the Customer.
2. Confidentiality
Advolo ensures that everyone who processes the data is bound to confidentiality and only has access as far as needed for the work.
3. Security
Advolo takes the technical and organisational measures in Annex 2 and keeps them at a level appropriate to the risk. Advolo may change measures, as long as the level of protection does not go down.
4. Sub-processors
The Customer gives general authorisation for the sub-processors on the published list. Advolo announces a new or replaced sub-processor at least 30 days in advance by e-mail or in the Platform; the Customer may object on reasonable grounds and, if no solution is found, terminate the affected service. Advolo imposes the same data protection obligations on each sub-processor and remains responsible for it.
5. Transfers outside the EU
Advolo processes the data in the European Union. A transfer outside the European Economic Area only takes place with appropriate safeguards under chapter V of the GDPR and after notice under article 4.
6. Assistance
Advolo helps the Customer, as far as reasonable and possible, to answer requests of data subjects (most can be handled by the Customer itself in the Platform), and with security, data protection impact assessments and prior consultation. Requests sent to Advolo directly are forwarded to the Customer without delay.
7. Personal data breaches
Advolo informs the Customer without undue delay and in any case within 36 hours after becoming aware of a personal data breach affecting the Customer’s data, with the information the Customer needs to assess it and to notify the authority and data subjects where required. Advolo takes reasonable measures to limit the consequences and documents every breach.
8. Audits
Advolo makes available the information needed to demonstrate compliance with this DPA. The Customer may have an audit performed by an independent auditor bound to confidentiality, at most once a year and with 30 days’ notice, at its own cost, unless the audit shows a material breach by Advolo.
9. End of processing
At the end of the Agreement the Customer can export its data for 30 days (switching under the terms). Advolo then deletes the personal data, including copies, within 60 days, unless the law requires retention; backups are overwritten within 90 days.
10. Liability and duration
The limitation of liability in the Agreement applies to this DPA, unless the GDPR does not allow it. This DPA runs as long as Advolo processes personal data for the Customer.
Annex 1 – Description of the processing
| Category of data subjects | Personal data | Purpose in the Platform |
|---|---|---|
| Users of the Customer | Name, business e-mail, phone, role | Accounts, notifications, audit trail |
| Passengers | Name, date of birth, nationality, travel document number and expiry, copies of travel documents uploaded to a trip, contact details, special requests (only what the Customer enters) | Trips, passenger lists, documents for the flight |
| Crew | Names, only where the operator enters them in trip notes, checklists or documents | Trips, crew assignment |
| The broker’s clients | Name, company, contact details, notes | Requests, quotes and trips for that client |
| The operator’s direct clients | Name, company, contact details | Quotes and trips for direct clients |
| Visitors of a broker’s website widget | Name, e-mail, phone, company, message, trip searched, consent, IP address | Leads for the broker |
| Contact persons in messages and documents | Names and contact details mentioned | Communication between operator and broker |
Special categories of personal data are not needed for the Platform. The Customer does not enter them, except where a passenger’s special assistance requires it, and then only the minimum. Processing lasts as long as the Agreement; the data are kept as the Customer decides, within the Platform’s functions.
Annex 2 – Technical and organisational measures
- Access: personal logins per named User, passwords hashed, company administrators manage access, roles per company; Advolo staff access only for support and administration, logged.
- Separation: every query is scoped to the Customer’s company; other Customers never see Customer Data.
- Encryption: HTTPS/TLS for all traffic; secrets (such as SMTP credentials) encrypted at rest; push messages end-to-end encrypted.
- Logging and integrity: page requests, events and data changes logged with user and time; the event log is tamper-evident (hash chain); signed agreements and invoices are sealed with a SHA-256 hash.
- Availability: daily backups, kept for 30 days, restore tested quarterly – to be confirmed with the hosting set-up.
- Secure development: security headers, protection against cross-site request forgery, limits on login attempts and on the public widget, checks of uploaded files.
- Organisation: confidentiality obligations for staff, a breach procedure, a responsible disclosure policy.
Draft of 11 November 2026 · All legal documents