Data Processing Addendum

1. Roles

For traveller data submitted to book Products, the Agency is the controller and Rate Extra is the processor acting on the Agency's documented instructions. For its own contracting and compliance records, Rate Extra is a controller.

2. Instructions and purpose

Rate Extra processes traveller data only to fulfil the booked Products, to communicate operational information (for example driver details) and to comply with law. Booking through the API or portal constitutes the Agency's instruction.

3. Sub-processors

Rate Extra informs the Agency of changes to sub-processors with reasonable notice; the Agency may object on reasonable grounds.

• TravelDistro operations and its fulfilment partners for the booked vertical.
• Vercel and Resend for hosting and transactional email.
• Safaryar Holidays (Sindibad Turizm Ticaret A.Ş.) acts as an independent contracting party for Hotel API bookings, not as a sub-processor of Rate Extra.

4. Security measures

• Signed API requests and signed webhooks; secrets stored server-side.
• Transport encryption for all services.
• Access to traveller data limited to staff and partners who need it to fulfil the booking.
• Personal fields in transfer bookings anonymised 12 months after closure.

5. Breach notification

Rate Extra notifies the Agency without undue delay after becoming aware of a personal data breach affecting traveller data, and provides the information reasonably available to support the Agency's own obligations.

6. Assistance and audits

Rate Extra assists the Agency with data subject requests and impact assessments relating to the processing, and makes available information reasonably necessary to demonstrate compliance.

7. Return and deletion

On termination, traveller data is deleted or anonymised in line with the Privacy Policy, except where retention is required by law.

8. Governing law

This Addendum forms part of the Contract and is governed by the same law and jurisdiction.