Last updated: 2026-05-10 · v1

Data Processing Agreement (DPA)

Effective Date: 2026-05-11 Last Updated: 2026-05-11 Version: 1.0

This Data Processing Agreement ("DPA") supplements the Terms of Service, Partner Agreement, and Supplier Agreement where personal data is processed in connection with the Gvoya Service. It is designed to satisfy:

• EU GDPR Article 28 (data processor obligations)
• UK GDPR Article 28
• China PIPL Articles 21-23 and 38-40 (entrusted processing + cross-border)
• Singapore PDPA Sections 4-19 (data intermediary)
• California CCPA/CPRA §1798.140(d) (service provider) and §1798.140(j) (contractor)
• Brazil LGPD Articles 38-39 (operator)
• Canada PIPEDA Schedule 1 Principle 4.1.3
• Japan APPI Article 25 (entrusted processing)

The parties to this DPA are GRANDROUTES GLOBAL PTE. LTD. (operating Gvoya) and the customer, partner, supplier, or business counterparty entering into a master agreement with Gvoya (the "Counterparty"). The role each party plays is determined by the underlying agreement and the data flow:

This DPA is supplemented, where applicable, by the EU Standard Contractual Clauses (Commission Decision 2021/914) and the UK International Data Transfer Addendum 2022.

1. Definitions

Capitalized terms not defined here have the meaning given in the GDPR or PIPL as applicable. "Personal Data" means any information relating to an identified or identifiable natural person. "Subject" means a natural person whose Personal Data is processed. "Sub-processor" means any third party engaged by Gvoya to process Personal Data on behalf of the Counterparty.

2. Subject Matter, Duration, Nature, Purpose, Categories

2.1 Subject matter

The processing of Personal Data necessary for Gvoya to perform the booking, AI concierge, and related services described in the Terms.

2.2 Duration

For the duration of the master agreement plus the retention periods set out in §7.

2.3 Nature and purpose

Collection, structuring, storage, retrieval, transmission to Suppliers, AI-assisted matching, transactional communication, payment processing, fraud detection, sanction screening, and audit trail.

2.4 Categories of data subjects

End consumers (B2C), Partner Clients (B2B), passengers named on bookings, supplier representatives.

2.5 Categories of personal data

Identification data (name, email, phone), travel documents (passport — encrypted at rest with AES-256-GCM), account credentials (hashed), AI conversation logs, payment references (last-4 of card, transaction reference; full card never stored), device and usage telemetry (IP truncated to /24, user-agent, page views), special-category data only where voluntarily provided (dietary, accessibility).

3. Counterparty's Obligations

The Counterparty shall:

a. Have a lawful basis under Article 6 GDPR (and analogous bases under PIPL, PDPA, CCPA) for any Personal Data it instructs Gvoya to process; b. Obtain all consents required for the processing, including separate consents required by PIPL Articles 14, 23, 25, 39 for sensitive personal information and cross-border transfer; c. Not instruct Gvoya to process Personal Data unlawfully; d. Maintain its own records of processing under GDPR Article 30 to the extent applicable; e. Notify Gvoya promptly of any change in the legal basis or scope of authorized processing.

4. Gvoya's Processor Obligations

When acting as processor, Gvoya shall:

a. Process Personal Data only on the documented instructions of the Counterparty (the underlying agreement and reasonable interpretive guidance); b. Ensure persons authorized to process Personal Data are bound by confidentiality (employment contracts, internal information-security policy); c. Implement technical and organizational measures detailed in §6; d. Engage Sub-processors only as set out in §5; e. Assist the Counterparty (taking into account the nature of processing) with:

• responses to data subject requests under Articles 15-22 GDPR / equivalent PIPL/PDPA/CCPA rights, within 5 business days of receiving a forwarded request;
• data protection impact assessments under Article 35 GDPR;
• prior consultations with supervisory authorities under Article 36 GDPR;
• personal-data-breach notifications under Article 33-34 GDPR; f. At the Counterparty's choice, return or delete all Personal Data after the end of services, unless retention is required by law; g. Make available all information necessary to demonstrate compliance and contribute to audits under Article 28(3)(h) GDPR.

5. Sub-processors

The Counterparty consents to Gvoya's engagement of the Sub-processors listed below. Gvoya provides at least thirty (30) days' written notice (in-app banner + email) of any addition or replacement; the Counterparty may object in writing within fifteen (15) days, in which case the parties shall negotiate in good faith. If no agreement is reached, the Counterparty may terminate the master agreement on thirty (30) days' notice.

Current Sub-processors (as of 2026-05-11)

The current authoritative list is published at /dpa#subprocessors with a change log; we maintain Article 28(2) GDPR specific authorization through this DPA and the change-notification procedure above.

6. Security Measures (Annex II)

Gvoya implements measures appropriate to the risk under Article 32 GDPR / PIPL Article 51:

6.1 Encryption

• TLS 1.2+ for all data in transit
• AES-256-GCM for highly sensitive fields at rest (passport numbers, encrypted credential storage for crawler operations)
• Bcrypt cost-12 password hashing
• Encrypted backups with rotated keys

6.2 Access control

• Role-based access (StaffRole matrix with 11+ roles including dedicated legal role with no PII access by default)
• JWT session tokens with 8-hour expiry
• Two-factor authentication for staff (planned v1.1)
• Just-in-time access elevation logged in AuditLog

6.3 Logging and monitoring

• Hash-chained AuditLog for all sensitive mutations (publish, approve KYC, sanction screen, contract sign, EvidencePack export)
• DefenseEvent log with hash chain for security incidents
• Sentry error tracking across all four apps (web/admin/b2b/supplier)
• Annual penetration testing; quarterly internal review

6.4 Resilience

• Daily PostgreSQL backups, point-in-time recovery on Neon
• Geo-redundant R2 object storage
• DDoS mitigation via Cloudflare
• Two-tier rate limiting on all four apps

6.5 Personnel

• All staff bound by confidentiality
• Background checks at hiring (where lawful)
• Security awareness training annually
• Privileged access reviewed quarterly

7. Retention

Personal Data is retained per the Privacy Policy §7. Gvoya's automated legal-retention worker cron anonymizes Consent records older than seven (7) years (clearing IP truncated, user-agent, anon-id) at 03:00 UTC daily.

8. International Transfers

For transfers from the EU/EEA to a third country, Gvoya relies on:

• Adequacy decisions where the recipient country has one (Switzerland, UK, Japan, Republic of Korea, etc.);
• Standard Contractual Clauses (Commission Decision 2021/914) Module Two (controller→processor) and Module Three (processor→processor) with all four annexes completed;
• Supplementary measures including encryption in transit and at rest, contractual override of US executive-branch access requests where lawful, Transfer Impact Assessments per Schrems II;
• Binding Corporate Rules for intragroup transfers when Gvoya scales internationally.

For transfers from the UK, Gvoya uses the UK International Data Transfer Addendum 2022 to the EU SCCs.

For transfers from China, separate consent is required under PIPL Article 39; Gvoya uses the PRC Standard Contract for Cross-Border Transfer of Personal Information (CAC) where the volume threshold applies, and seeks Cybersecurity Review where the volume threshold or critical-information-infrastructure threshold triggers.

9. Data Subject Requests

Where Gvoya receives a data subject request directly relating to data processed for the Counterparty, Gvoya forwards the request to the Counterparty within five (5) business days and assists the Counterparty in fulfilling the request within the legal deadlines (30 days GDPR, 45 days CCPA, 15 days LGPD).

10. Breach Notification

Gvoya notifies the Counterparty of a personal-data breach affecting the Counterparty's data without undue delay and in any event within seventy-two (72) hours of becoming aware. The notification includes the nature of the breach, categories and approximate number of subjects, likely consequences, and measures taken or proposed.

11. Audit Rights

Once per calendar year (more often only on reasonable suspicion of breach), the Counterparty may audit Gvoya's compliance with this DPA, with thirty (30) days' notice and reasonable confidentiality undertakings. Gvoya may satisfy audit requests through industry-standard third-party reports (e.g., SOC 2 Type II once available) where they cover the scope of the request.

12. Liability

Liability under this DPA is governed by the limits set out in the master agreement (Terms / Partner Agreement / Supplier Agreement) except as required by GDPR Article 82 (which establishes a separate joint-and-several liability regime among controllers and processors). Statutory liability cannot be limited.

13. Term and Termination

This DPA is effective for as long as the master agreement subsists and any Personal Data continues to be processed. Provisions naturally surviving (return/deletion, audits, confidentiality) survive termination.

14. Order of Precedence

In case of conflict between this DPA and the master agreement on matters of personal data, this DPA prevails. In case of conflict between this DPA and the EU SCCs (where they apply), the EU SCCs prevail.

15. Contact

Data Protection Officer: dpo@gvoya.com Privacy team: privacy@gvoya.com EU/EEA Representative (Article 27): dpo@gvoya.com UK Representative: dpo@gvoya.com

GRANDROUTES GLOBAL PTE. LTD. (operating Gvoya), Singapore.