Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the Agency Trade Agreement between Premium Choice Travel DMCC (Premium Choice, we) and your agency. It applies when your agency gives us personal data of Travellers and Clients to make and manage Bookings.

1. Roles

1.1 For Traveller and Client data you give us to fulfil a Booking, your agency is the controller and we process that data on your behalf, as your processor. This covers making the Booking, passing it to the Supplier, issuing documents, handling changes, cancellations and support.

1.2 Suppliers are independent controllers of the data they receive to provide a Travel Service. An airline, for example, uses passenger data under its own obligations to carriers and border authorities.

1.3 We are an independent controller of booking records we keep to meet our own legal, tax, accounting and fraud-prevention obligations.

2. Your instructions

2.1 We process Traveller data only on your documented instructions. Using the Platform to make and manage a Booking is such an instruction, as is this Agreement. The exception is where the law requires otherwise; we will tell you of that requirement unless the law forbids it.

2.2 You confirm you have a lawful basis to give us the data, and that you have given Travellers the information the law requires. That includes that their data will be passed to us and to Suppliers, including Suppliers outside their country.

2.3 Give us only the data a Booking needs. Do not put special category data, such as health information, in free-text fields unless a Traveller needs a specific accommodation and has agreed to it being shared.

3. Our obligations

We will:

• ensure people authorised to process the data are bound by confidentiality;
• apply appropriate technical and organisational security measures. These include encryption in transit, database-enforced separation between agencies, individual logins, access limited to staff who need it, and audit records;
• tell you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting your Travellers' data, with the information you reasonably need;
• help you, taking into account the nature of the processing, to respond to Travellers exercising their rights and to meet your security, breach-notification and impact-assessment obligations;
• when the Agreement ends, delete or return Traveller data. The exception is booking records we must keep by law, which we keep securely for the required period and use only for that purpose;
• make available the information reasonably needed to show we comply with this DPA. [Audit rights: to be confirmed with counsel.]

4. Sub-processors

4.1 You authorise us to use sub-processors to deliver the Platform. We use:

4.2 We will give you at least 14 days' notice of a new sub-processor through the Platform or by email. You may object on reasonable data-protection grounds. If we cannot resolve the objection, you may end the Agreement.

4.3 We impose data-protection obligations on each sub-processor equivalent to those in this DPA, and remain responsible for them.

5. International transfers

Traveller data may be transferred to Singapore, where the Platform is hosted, and to the countries of our sub-processors and of the Suppliers who provide each Travel Service. We make those transfers as UAE Federal Decree-Law No. 45 of 2021 permits and, where the EU or UK GDPR applies, with appropriate safeguards such as standard contractual clauses. [Transfer mechanism to be confirmed with counsel.]

6. Duration

This DPA lasts as long as we process Traveller data for your agency.