Data Processing Agreement

1. Definitions

• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data.
• Controller: the entity that determines the purposes and means of processing.
• Processor: DutyBoost, which processes personal data on behalf of the Controller.
• Sub-Processor: any third party engaged by the Processor.
• GDPR: Regulation (EU) 2016/679.

2. Scope and Purpose

DutyBoost processes personal data on behalf of the Controller solely to provide the DutyBoost platform services — a Performance-based Customer Acquisition Infrastructure for Global Travel — including DutyCredit generation, redemption validation (including via POS Partner infrastructure), transaction management, refund processing, Revenue Share calculation, and related analytics. DutyBoost does not send emails to travelers; it sends emails only to Airport Retailers, Travel Partners, and POS Partners that decide to work with, integrate, or join the ecosystem.

3. Categories of Personal Data

• Identity data: full name, email address.
• Business data: company name, address, VAT/registration number, business type (Travel Partner, Airport Retailer, or POS Partner).
• Booking data: traveler counts, travel dates, departure airports, ticket prices, PNR references.
• Transaction data: DutyCredit codes, redemption records, purchase values, refund records.
• POS integration data: API credentials, technical configuration, redemption event logs.
• Technical data: IP addresses, browser type, session identifiers.

4. Confidentiality

DutyBoost ensures all personnel who access personal data are bound by confidentiality obligations. Access is restricted on a strict need-to-know basis.

5. Security Measures

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access control with least privilege.
• Multi-factor authentication for all internal platform access.
• Regular security assessments and penetration testing.
• Documented incident response procedures.

6. Sub-Processors

The Controller grants DutyBoost general written authorisation to engage the sub-processors listed below. DutyBoost will notify the Controller of any changes with at least 30 days' notice.

7. Data Subject Rights

DutyBoost shall assist the Controller in fulfilling obligations to respond to data subject rights requests, including access, rectification, erasure, and portability.

8. Breach Notification

In the event of a personal data breach, DutyBoost shall notify the Controller without undue delay and where feasible no later than 72 hours after becoming aware of the breach.

9. Data Retention and Deletion

Upon termination, DutyBoost shall delete or return all personal data within 30 days at the Controller's choice, and certify in writing that deletion has been completed.

10. Governing Law

This DPA is governed by the laws of the Netherlands. Disputes shall be subject to the courts of Amsterdam.

11. Contact

For all data protection enquiries: privacy@dutyboost.com · DutyBoost B.V., a legal entity registered at the Dutch Chamber of Commerce (Kamer van Koophandel) under number 42053181, Amsterdam, the Netherlands.