Data Processing Addendum

1. Scope

This Data Processing Addendum applies where Beyond Raw Data processes personal data through TourIQ on behalf of a customer organization. It supplements the User Agreement or other written service agreement.

2. Processing instructions

The customer instructs Beyond Raw Data to process personal data only to provide, secure, support, maintain, and improve TourIQ; comply with law; prevent fraud or misuse; and perform documented customer instructions.

3. Categories of data

• Customer and passenger identity, contact, booking, travel, and payment records.
• Staff, guide, driver, vendor, vehicle, expense, invoice, and operational records.
• Authentication, audit, security, support, technical, and usage records.
• Sensitive data only where the customer lawfully enters it and it is necessary for the tour operation.

4. Controller obligations

The customer is responsible for lawful collection, notices, consents, data accuracy, user permissions, customer communications, and determining retention periods for its business data.

5. Processor obligations

• Process personal data only on documented instructions unless required by law.
• Ensure personnel with access are subject to confidentiality obligations.
• Use reasonable technical and organizational security measures.
• Assist with data subject requests, breaches, audits, and deletion where reasonably possible.
• Notify the customer of legally binding disclosure requests unless prohibited by law.
• Delete, return, anonymise, or restrict customer personal data after termination according to the agreement and legal retention requirements.

6. Sub-processors

Beyond Raw Data may use hosting, database, storage, payment, email, messaging, analytics, support, and security providers to operate TourIQ. Sub-processors must be subject to suitable confidentiality and data protection obligations. A current list should be maintained and made available on request.

7. International transfers

Where processing or storage occurs outside Kenya, the parties will rely on appropriate safeguards or other transfer conditions permitted by Kenyan data protection law.

8. Signatures