PaxFlow Data Processing Agreement
This PaxFlow Data Processing Agreement (“DPA”) forms part of the Agreement between PaxFlow ehf and the Customer and governs personal data processed by PaxFlow as processor on the Customer’s behalf in connection with the Services. It is incorporated into the PaxFlow General Terms and applies to all subscriptions, whether established through a selected Subscription Plan or an applicable Subscription Schedule. PaxFlow acts separately as controller for User Account Data processed for its own purposes under its Privacy Policy. This DPA applies in accordance with applicable Icelandic and EEA data protection law.
1. Definitions
“Data Protection Laws”, “controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings assigned by the GDPR and other applicable Data Protection Laws. “Sub-processor” means a processor engaged by PaxFlow to process Customer Personal Data on the Customer’s behalf. “Customer Personal Data” means personal data contained in Customer Data that PaxFlow processes as processor on the Customer’s behalf, including traveller and operational workforce data, but excluding User Account Data processed by PaxFlow as independent controller.
2. Roles of the Parties
For Customer Personal Data, the Customer is controller and PaxFlow is processor. Each Party shall comply with its obligations under Data Protection Laws. The Customer determines what personal data is collected through the Services, including through Customer-configured forms, and is responsible for identifying a valid lawful basis, any applicable Article 9 condition, and necessary notices, consents and authorisations. Processing details appear in the Appendix.
3. Processing on Instructions
PaxFlow shall process Customer Personal Data only on the Customer’s documented instructions, including as set out in the Agreement, this DPA and the Appendix, unless required to do otherwise by applicable law; in which case PaxFlow shall inform the Customer of that legal requirement before processing, unless the law prohibits such notification.
The Customer instructs PaxFlow to aggregate or anonymise Customer Personal Data to develop and improve the Services, including statistical and forecasting models. Data that has been anonymised is no longer Customer Personal Data.
4. Confidentiality
PaxFlow shall ensure that persons authorised to process the Customer Personal Data are subject to an appropriate duty of confidentiality.
5. Security
PaxFlow shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, consistent with Article 32 of the GDPR.
6. Sub-processors
The Customer gives PaxFlow general authorisation to engage Sub-processors. PaxFlow shall make a current list of Sub-processors available to the Customer on request or as set out in an applicable Subscription Schedule. PaxFlow shall notify the Customer of intended additions or replacements; the Customer may object on reasonable data-protection grounds within thirty (30) days of notice. If the Parties cannot resolve the objection, either Party may terminate the affected Services in accordance with the Agreement. PaxFlow shall impose data-protection obligations materially equivalent to this DPA on each Sub-processor and remains liable for their performance.
6A. Customer-Enabled Integrations and AI Assistants
Where the Customer or its Users enable a Third-Party Service, booking-system integration or external AI assistant (including a connection through the Model Context Protocol or a personal API key), that enablement and each request made through it constitute the Customer’s documented instruction for PaxFlow to make Customer Personal Data available to, and act on requests from, that third party within the permissions of the connecting User. Such third parties are engaged by the Customer and are not Sub-processors of PaxFlow. The Customer is responsible for its agreement with the third-party provider and for ensuring that disclosures to it, including any transfer outside the EEA, are lawful. PaxFlow records requests made through AI assistant connections in the Customer’s audit log and does not use Customer Personal Data received or returned through such connections to train AI models, other than in aggregated and anonymised form under clause 3.
7. Data Subject Rights
Taking into account the nature of the processing, PaxFlow shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligations to respond to requests to exercise data subject rights. If PaxFlow receives such a request directly from a data subject, it shall, where lawful, refer the data subject to the Customer.
8. Assistance
PaxFlow shall assist the Customer in ensuring compliance with its obligations relating to security of processing, notification of personal data breaches, data protection impact assessments, and prior consultation, taking into account the nature of the processing and the information available to PaxFlow.
9. Personal Data Breach
PaxFlow shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, provide reasonably available information to assist the Customer in meeting its obligations under Data Protection Laws, and take reasonable steps to mitigate the effects of the breach.
10. International Transfers
PaxFlow processes Customer Personal Data primarily in Iceland and the EEA. Any transfer of Customer Personal Data outside the EEA shall comply with applicable Data Protection Laws, including, where required, an adequacy decision, approved Standard Contractual Clauses or another valid transfer mechanism, together with any legally required supplementary safeguards. The Parties shall cooperate in implementing additional transfer arrangements reasonably required by applicable Data Protection Laws.
11. Return and Deletion
Upon termination or expiry of the Agreement, PaxFlow shall, at the Customer’s choice, return or delete Customer Personal Data unless applicable law requires retention. The Customer may request a standard export within thirty (30) days after termination in accordance with clause 13.3 of the General Terms. Where no export request is received during that period, the Customer instructs PaxFlow to delete the remaining Customer Personal Data, subject to legally required retention and applicable backup retention procedures. Additional extraction, conversion or migration services may be charged as provided in the General Terms, without limiting mandatory GDPR obligations.
12. Audit
PaxFlow shall make available information reasonably necessary to demonstrate compliance with this DPA, including relevant security and compliance documentation, and shall allow for and contribute to audits, including inspections, as required by applicable Data Protection Laws, subject to reasonable prior notice, confidentiality obligations and reasonable arrangements regarding scope, timing and frequency.
12A. Costs of Additional Assistance
PaxFlow may charge reasonable fees for additional assistance, bespoke exports or work requested by the Customer beyond standard Services, except to the extent prohibited by applicable Data Protection Laws. Nothing in this clause limits PaxFlow’s mandatory processor obligations.
13. User Account Data (PaxFlow as Controller)
PaxFlow processes User Account Data as a controller in accordance with its Privacy Policy (paxflow.io/privacy-policy). The processor obligations in this DPA do not apply to PaxFlow’s processing of User Account Data in that capacity.
Appendix: Details of Processing
| Subject matter | Provision of the PaxFlow Services to the Customer. |
|---|---|
| Duration | The Subscription Term, plus the return/deletion period set out in clause 11 of this DPA. |
| Nature and purpose | Hosting, storing and processing personal data in order to operate the tour-operations platform and deliver the Services (including bookings, communications, forms and operations management), and generating forecasts and recommendations for the Customer from its own data. |
| Categories of data subjects | The Customer’s End Clients (travellers, tour participants and booking contacts); the Customer’s employees, guides, drivers, contractors and other individuals whose data the Customer submits through the Services. User Account Data processed by PaxFlow as independent controller is excluded. |
| Types of personal data | Personal data submitted or collected by the Customer through the Services, including names, contact details, booking, travel and operational details, communications, form responses, and workforce assignments, availability, qualifications and work reports. The Customer determines the specific fields and purposes of collection. |
| Special category data | The Services do not require special-category data by default. The Customer may choose to collect such data, including health-related information, through configurable forms or free-text fields. The Customer is responsible for the relevant lawful basis and Article 9 condition, notices and appropriate safeguards; PaxFlow processes such data on documented instructions and subject to its processor obligations. |
End of PaxFlow Data Processing Agreement (Version 1.1)
