Data Processing Addendum

Scope and roles

The customer is the controller of travelers' personal data it adds to GroupArrivals. GroupArrivals is the processor and processes that data only to provide the service.

Details of the processing

Subject matter: tracking travelers' flights, check-in at airports, boards and alerts. Duration: the term of the agreement, plus the retention period below. Data subjects: travelers in the customer's groups. Data: names, and optionally email, phone, party, notes, flight numbers and dates, and check-in times. No special category data is required by the service; the customer should not add it.

Instructions

GroupArrivals processes the data only on the customer's documented instructions, which are the agreement and the customer's use of the app's settings. We will tell the customer if we believe an instruction breaks data protection law.

Confidentiality

Everyone at GroupArrivals with access to customer data is bound by confidentiality.

Security measures

Encryption in transit and at rest; separation of each workspace's data enforced in the database; hashed tokens for public links, optional PINs and the ability to revoke links; access for staff only when needed to support the customer; daily backups by our database provider; no traveler names sent to flight data providers.

Subprocessors

The customer authorizes the subprocessors listed in the Privacy Policy: Supabase, Vercel, Resend, Stripe and FlightAware. GroupArrivals will give notice before adding or replacing a subprocessor that handles travelers' data, and the customer may object on reasonable grounds. Each subprocessor is bound by data protection terms at least as protective as these.

Assistance and requests

GroupArrivals will help the customer answer requests from travelers to access, correct or delete their data, mostly through the app's own tools, and will pass on any request it receives directly.

Personal data breaches

GroupArrivals will notify the customer without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach affecting the customer's data, with the information the customer needs to meet its own obligations.

Deletion and return

Travelers' personal data is deleted automatically 60 days after a group's last day, or sooner on the customer's request or when the workspace is deleted. The customer can export a group as a CSV before deletion. Backups are overwritten on their normal cycle.

International transfers

Data is processed in the United States. For transfers from the European Economic Area, the United Kingdom or Switzerland, the parties rely on the EU Standard Contractual Clauses (controller to processor module) and their UK and Swiss addenda, which are incorporated by reference.

Information and audits

GroupArrivals will make available the information reasonably needed to show compliance with this addendum and will answer the customer's reasonable written questions about its security.