Data Processing Agreement

This agreement is between NORBA TRAVEL OÜ, a private limited company registered in the Estonian Business Register under registry code 17597060, with its registered address at Tornimäe tn 5, 10145 Tallinn, Estonia, and VAT number EE103029739 ("Norba", the processor), and the business that holds a Norba account and sends us personal data through the API or the dashboard ("you", the controller). It is the contract Article 28(3) of Regulation (EU) 2016/679 (the GDPR) requires.

It sets out in full the data-processing terms of clause 6 of the Terms of Service, which incorporates it, so it binds both of us from the moment you accept those terms, without a separate signature. If you have signed the Norba Production Agreement, this agreement applies alongside it.

Where this agreement and the rest of the Terms of Service differ on the processing of personal data, this agreement prevails. Terms used here — personal data, processing, controller, processor, sub-processor, data subject, personal data breach, supervisory authority — have the meaning the GDPR gives them.

• Subject matter: the booking services described in Part A of the Terms of Service.
• Duration: for as long as your account is open, and afterwards until the data is deleted or returned under clause 11.
• Nature and purpose: searching, pricing, booking, ticketing and servicing flights with the airlines you choose; sending the notifications and webhooks you set up; keeping the records of those operations; and supporting you when you ask us to.
• Categories of data subjects: your travellers, and the contact persons you give for them.
• Categories of personal data: names, date of birth, gender, nationality; travel-document type, number, issuing country and expiry; email address and telephone number; itineraries and booking references; frequent-flyer numbers; seats, bags and other extras; special service requests; and the payment card you send with a booking, which is passed to the airline for that one transaction and never stored.
• Special categories: we do not ask for them. A special service request — a meal, or assistance at the airport — can reveal information about health or religion; if you send one, we pass it to the airline only so that it can provide the service.

• You have a lawful basis for every piece of personal data you send us, and you give your travellers the information Articles 13 and 14 of the GDPR require, including that their data reaches us as your processor and the airline as an independent controller.
• You send only the data a booking needs, and only in the fields designed for it. Passenger documents or card numbers do not belong in free-text fields, metadata, webhook URLs or support messages.
• Your instructions comply with data-protection law.

• Instructions. We process the data only on your documented instructions — this agreement, the Terms of Service and the API calls you make, including the choice of airline that decides where a booking is sent — and this applies to transfers to a third country as well. If EU or Member State law requires us to process it otherwise, we tell you before we do, unless that law forbids it on important grounds of public interest.
• Unlawful instructions. If we believe an instruction infringes the GDPR or other data-protection law, we tell you immediately.
• Confidentiality. Everyone at Norba authorised to access the data is bound by confidentiality, by contract or by law.
• Security. We apply the technical and organisational measures in Annex A, and keep them appropriate to the risk as Article 32 requires. We may improve them; we do not reduce the overall level of protection.
• Records. We keep the record of processing activities Article 30(2) requires.
• No other use. We do not use the data for our own purposes, sell it or combine it with data from other customers, except to keep the service secure and to account for what was booked and billed, as the Privacy Policy describes.

You give us a general authorisation to engage sub-processors. The current list — what each one does, where it is, and the safeguard for any transfer — is published on the Sub-processors page, which forms part of this agreement.

• We tell you by email, at least 30 days in advance, before we add or replace a sub-processor, and we update the list.
• You may object, on reasonable grounds relating to data protection, before the change takes effect. We will discuss the objection with you in good faith; if we cannot meet it, you may end the service affected by the change without paying any termination charge.
• We impose on each sub-processor, by contract, data-protection obligations that are no less protective than this agreement, and in particular sufficient guarantees of appropriate technical and organisational measures.
• We remain fully liable to you for the performance of each sub-processor's obligations.

The airlines you book with, and the distribution platforms through which an airline exposes its NDC (New Distribution Capability) interface, receive passenger data because a ticket cannot be issued without it. An airline processes that data as an independent controller, under its own privacy notice and conditions of carriage, and not as our sub-processor.

The data is stored in the European Union. We transfer it to a country outside the European Economic Area only where Chapter V of the GDPR allows it:

• to a sub-processor established outside the EEA, on the basis of an adequacy decision of the European Commission — for the United States, the EU–US Data Privacy Framework, where the provider is certified under it — or otherwise of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 3, processor to processor), with the supplementary measures the transfer needs;
• to an airline or its distribution platform outside the EEA, when you book that airline: the transfer is necessary to perform the contract of carriage your traveller asked for, and you instruct it by choosing the airline.

The Sub-processors page states the mechanism for each provider. On request we give you a copy of the relevant safeguards, with commercial terms removed.

If one of your travellers contacts us directly to exercise a right under Articles 15 to 22 of the GDPR about data we process for you, we pass the request on to you without undue delay and do not answer it ourselves except to say we have done so. We help you answer such requests, by appropriate technical and organisational measures and as far as the nature of the processing allows — the API returns the orders and passenger details you hold with us, and the dashboard lets you set how long passenger identity is kept.

Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 of the GDPR: security, notifying and communicating personal data breaches, data protection impact assessments and prior consultation with a supervisory authority.

We notify you of a personal data breach affecting the data we process for you without undue delay, and in any case within 48 hours of becoming aware of it, by email to the account's owner. The notice gives what Article 33(3) of the GDPR asks for, as far as we know it at the time: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. What we do not know yet, we send as soon as we do.

We take the measures needed to contain the breach and limit its effects, and we do not notify your travellers or a supervisory authority on your behalf unless you ask us to or the law requires it. A notice under this clause is not an admission of fault.

We make available to you the information needed to demonstrate that we meet Article 28 of the GDPR and this agreement, and we allow for and contribute to audits, including inspections, by you or an independent auditor you appoint who is bound by confidentiality.

• Give us at least 30 days' written notice of an audit, and tell us its scope.
• Audits take place no more than once a year, unless there has been a personal data breach affecting your data or a supervisory authority requires one.
• An audit is carried out during business hours, without disrupting the service, and without access to other customers' data or to information that would compromise the security of the platform.

While the service runs, we keep the records of what you requested, booked and were notified of, and remove personal data from them where the law or your instructions require it:

When the service ends — your agency's account is closed — we keep the personal data we process for you for 180 days, so that it can be returned to you or the account restored; ask at hello@norba.io within that time. Then we delete it, as Article 28(3)(g) of the GDPR requires: the passengers on your orders, the request logs, searches, airline answers, change notifications and webhook deliveries are scrubbed, and any remaining copies deleted.

What EU or Member State law requires us to keep stays, protected by this agreement for as long as it is kept — above all invoices and payments. The Privacy Policy (clause 6) sets out the schedule for the data we hold as controller.

Each party's liability under this agreement is governed by the limitation of liability in the Terms of Service, except where Article 82 of the GDPR or other mandatory law does not allow it to be limited. Nothing here limits either party's liability to data subjects.

This agreement lasts for as long as we process personal data for you. We may update it to reflect a change in the law, in a supervisory authority's guidance or in the service, on the notice the Terms of Service provide for their own changes; a change that reduces the protection of your data needs your agreement. Like the Terms of Service, it is governed by the law of the Republic of Estonia, and Harju County Court (Harju Maakohus) in Tallinn has exclusive jurisdiction over any dispute arising out of or in connection with it.

At the level of detail we publish; more is available to you under clause 10.

• Encryption in transit: TLS on every connection to the API, the dashboard and the booking site.
• Encryption at rest: passenger names, dates of birth, travel documents and contact details encrypted field by field with AES-256-GCM in order records, under keys held outside the database.
• Payment cards: passed to the airline for the transaction they were sent for, and never written to a database, a log or a backup.
• Separation between customers: row-level security in the database, so one agency's rows cannot be reached from another's connection.
• Access control: API keys stored hashed; passwords hashed with bcrypt; two-factor authentication available on every account; roles that limit who in your team can manage keys and see data; staff access limited to what support needs.
• Logging: security events — sign-ins, failed sign-ins, key changes — recorded and visible to you; request bodies of booking, traveller, sign-in and account endpoints never stored.
• Location: production data hosted in the European Union.
• People: confidentiality obligations for everyone with access, and a breach-response process under clause 9.