Data processing agreement

1. Subject matter and duration

This agreement governs the processing of personal data that the customer (the business, "controller") enters or transmits when using FlightPeek Business and that the provider ("processor") processes on its behalf (Art. 28 GDPR).

It becomes part of the contract when FlightPeek Business is booked or a business is activated, and applies for as long as the provider processes the customer's data.

2. Nature and purpose of processing

Storing and displaying pickups in the dashboard and in the members' app, matching them with flight status, calculating leave times, notifying dispatch and drivers by push and email, and providing the data via calendar feed, webhook, API and the passenger pickup page — in each case as the customer sets up and uses these features.

Where the provider offers email import and the customer uses it, a forwarded booking confirmation is only analysed to detect flight numbers and dates. The email itself is not stored.

3. Types of data

Pickup details: flight number, date, passenger note (for example name and number of passengers), external booking reference, handover time, carry-on flag, meeting point. Details the customer sets about its members: role, invitations, assigned pickups, drive times, notification settings. Members' own accounts (email address, name, sign-in) are the provider's own responsibility under its privacy policy. Technical data: access times and logs.

Special categories of personal data (Art. 9 GDPR) are not the subject of this agreement. If the customer nevertheless enters such data, for example a wheelchair requirement in a note, the customer is responsible for the legal basis; the data is protected like all other data.

4. Data subjects

The customer's passengers, members of the business (owner, dispatch, drivers) and senders of forwarded booking confirmations.

5. Instructions

The provider processes the data only on documented instructions from the customer. Instructions are the settings and features the customer chooses in the dashboard, and instructions by email. If the provider considers an instruction unlawful, it informs the customer.

The provider does not process the data for its own purposes, except for usage statistics without a persistent identifier and without passenger data, as described in the privacy policy.

6. Confidentiality

Persons with access to the data are bound to confidentiality. Access to production systems is restricted to the provider's management.

7. Technical and organisational measures

The provider takes measures in accordance with Art. 32 GDPR, in particular:

Servers and database at Hetzner Online GmbH in ISO 27001 certified data centres in Germany. Encrypted transmission (TLS) for app, dashboard, API and webhooks; webhooks are only sent to HTTPS addresses and are signed with HMAC-SHA256.

Passwords only as bcrypt hashes, API keys only as hashes. Sign-in codes are valid for 15 minutes, access tokens for 15 minutes; members' sessions expire after 7 days without use. In the dashboard they are kept in cookies that scripts cannot read. Pickup links for passengers are valid until 24 hours after landing.

Role-based access: drivers only see their own pickups, dispatch only the business's flights; flights a driver marks as private are invisible to the business. Business settings and billing are reserved for the owner; API keys and the import address are managed by the owner and dispatch. Data of different businesses is logically separated.

Error and access logs contain no request contents and no passwords.

8. Sub-processors

The customer approves the following sub-processors. The provider contractually binds them to a level of protection equivalent to this agreement.

The provider informs the customer by email at least 30 days in advance of any new or replaced sub-processor. The customer may object for an important data protection reason; if no agreement is reached, the customer may terminate the contract with effect from the change.

Email import requires an inbound email service that receives forwarded emails. The provider announces it under the procedure above before enabling email import. Flight data and position services only receive flight numbers, dates and airport codes, no personal data, and are therefore not sub-processors. Payment processing via Stripe concerns the contractual relationship with the customer, not the data of its passengers.

Hetzner Online GmbH, Gunzenhausen, Deutschland

Operation of servers and database in data centres in Germany.

Resend (Plus Five Five, Inc.), USA

Sending emails: invitations, sign-in codes, alerts to dispatch and the evening summary. These emails may contain passenger notes. Transfer to the USA based on the EU Standard Contractual Clauses; Plus Five Five, Inc. is also certified under the EU-US Data Privacy Framework.

Google Ireland Limited / Google LLC (Firebase Cloud Messaging)

Delivery of push notifications to Android devices. Alerts to dispatch may contain passenger notes. Google LLC is certified under the EU-US Data Privacy Framework.

Apple Distribution International Ltd. / Apple Inc. (Apple Push Notification service)

Delivery of push notifications to iPhones. Alerts to dispatch may contain passenger notes. Apple Inc. is certified under the EU-US Data Privacy Framework.

9. Assistance

The customer can correct and delete pickup details in the dashboard and export data as CSV. In addition, the provider assists the customer with data subject requests, security of processing, data protection impact assessments and notifications to supervisory authorities. If a passenger contacts the provider directly, the provider forwards the request to the customer.

10. Personal data breaches

The provider informs the customer without undue delay, where possible within 48 hours of becoming aware of a breach, with the information the customer needs for its notification under Art. 33 GDPR.

11. Deletion after the end of the contract

Until the end of the contract the customer can export its pickups as CSV. No later than 30 days after the end of the contract the provider deletes the business's data — business profile, memberships, pickups with notes, alert log and keys — unless there is a legal obligation to retain it. On request this happens earlier. Data contained in backups disappears when those backups expire as scheduled.

Drivers' own accounts remain. Flights in them that are still assigned to the business are cleared of all the business's details (note, booking reference, handover, pickup link). If the customer removes a member, this happens immediately. If a driver has marked a flight as private, the note stays in their account; the booking reference and pickup link are removed immediately.

12. Evidence and audits

The provider makes available to the customer the information needed to demonstrate compliance with Art. 28 GDPR. On-site audits are possible with reasonable notice, at most once a year and during normal business hours, where written evidence is not sufficient.

13. Liability and final provisions

Liability is governed by Art. 82 GDPR; otherwise the FlightPeek Business terms apply. In the event of conflict, this agreement prevails in matters of data protection.

The law of the Republic of Cyprus applies. If any provision is invalid, the remainder of the agreement remains effective.