Data Processing Terms
Processor identity: Matthew King trading as Travel Desk, Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom. Contact: support@traveldeskshop.com.
1. Roles and scope
The customer remains controller for client personal data it chooses to supply to Travel Desk, including deciding the purpose, lawful basis, accuracy and disclosures to clients. Travel Desk acts as processor only to the extent it processes that data on the customer's documented instructions to provide the service.
2. Processing details
| Subject matter | Hosting, organising, transforming, generating content from, transmitting and deleting customer-supplied data as required by enabled Travel Desk tools. |
|---|---|
| Duration | For the term of the service plus the documented deletion/backup-retention period. |
| Nature/purpose | Travel-agent workflow, content generation, itinerary/quote/client work, support and connected publishing as instructed by the customer. |
| Data subjects | Customer personnel and, where supplied by the customer, travel clients/prospects and other contacts. |
| Data types | Contact details, travel preferences, trip/itinerary information, correspondence and other data the customer chooses to enter. Customers must minimise personal data and should avoid special-category or highly sensitive data unless the enabled feature genuinely requires it and the controller has identified the required lawful basis and Article 9 condition. |
3. Documented instructions
Travel Desk will process processor-data only on the customer's documented instructions, including the instructions inherent in using an enabled feature, unless UK law requires otherwise. If legally permitted, Travel Desk will inform the customer before processing required solely by law.
4. Confidentiality
Travel Desk will ensure people authorised to process processor-data are subject to an appropriate duty of confidentiality.
5. Security
Travel Desk will apply appropriate technical and organisational measures taking account of the nature and risk of the processing. Operational controls include access restriction, private configuration, encrypted transport, audit controls and encrypted verified backup. These terms do not constitute ISO 27001, SOC 2 or other external certification.
6. Subprocessors
The customer gives general written authorisation for the subprocessors needed to provide enabled features, subject to the Subprocessor Register. Travel Desk will provide a reasonable mechanism for notice of a material new subprocessor and an opportunity to raise a data-protection objection. Travel Desk must put applicable data-protection obligations on subprocessors as required by law.
Connected independent controllers are not subprocessors merely because Travel Desk integrates with them. For example, Meta Platform API processing is subject to the Meta Platform Terms and its controller-to-controller Platform Data provisions; the customer's general subprocessor authorisation in this section does not reclassify Meta as Travel Desk's Article 28 processor.
7. Individual rights
Taking account of the nature of processing, Travel Desk will provide reasonable assistance to help the customer respond to data-subject rights requests relating to processor-data.
8. Security incidents and breaches
Travel Desk will notify the customer without undue delay after becoming aware of a personal-data breach affecting processor-data where the notification duty applies, and will provide information reasonably available to assist the customer's assessment and notification obligations.
9. DPIAs and regulator consultation
Taking account of the processing and information available, Travel Desk will provide reasonable assistance with DPIAs and prior consultation obligations relating to the processor-data.
10. International transfers
Travel Desk will not treat a restricted international transfer as authorised merely because a provider is technically available. Where required, the relevant UK transfer mechanism and any required data protection test must be in place for the processor transfer.
11. Return and deletion
At the customer's choice and subject to legal retention requirements, Travel Desk will delete or return processor-data at the end of processing. Data in immutable/encrypted backups may remain beyond account deletion only until the ordinary backup-retention cycle removes it, and should remain beyond ordinary operational use meanwhile.
12. Information, audit and unlawful instructions
Travel Desk will make available information reasonably necessary to demonstrate the obligations in these Data Processing Terms and will permit reasonable, proportionate audits or inspections, subject to confidentiality, security, scope and cost arrangements appropriate to the circumstances. Travel Desk will inform the customer if, in Travel Desk's reasonable view, an instruction infringes applicable data-protection law, unless the law prohibits that notice.
13. Customer responsibilities
The customer must provide lawful instructions, give required privacy information to its clients, maintain an appropriate lawful basis, limit data to what is necessary and avoid using Travel Desk for data or purposes that the selected feature is not designed to protect.