数据处理附录

This Data Processing Addendum ("DPA") applies between TEKRAVEL TRAVEL AND TECHNOLOGIES - FZCO ("Tekravel", "we", "us" or "our") and every business that uses Tekravel ("you"), and forms part of the agreement under which you use the platform: the Platform Terms and Conditions you accept in your Admin Panel. It sets out how we process personal data for you when we host your booking website and provide the platform to you, as the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) requires and, where they apply, Article 28 of the EU and UK GDPR. Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning the applicable data protection law gives them, and a "sub-processor" is a service provider we engage to process personal data for you.

1. 1适用范围与角色

   This DPA applies whenever we process personal data for you in providing Tekravel: on your booking website, in the Admin Panel, through our APIs and in the bookings made through them. For that data, you are the controller and we are your processor. If you act for another business, for example as its sub-agent, you confirm that your instructions to us are authorised by that business. This DPA does not cover the personal data we handle as a controller for our own purposes, such as your account and sign-in records, the verification and sanctions screening of your business, our billing and support, and the security of the platform. Our Privacy Policy describes that. When a booking is made, the travel suppliers concerned (airlines, reservation systems, hotel, package and attraction suppliers) receive the traveller details they need to issue and service it. They handle those details under their own terms and privacy policies and are not our sub-processors.

2. 2处理的标的、期限、性质和目的

   • Subject matter: hosting and running your booking website and providing the Tekravel platform to you. • Duration: as long as we provide the platform to you, and after that for as long as we keep the data (see "Deletion or return at the end" below). • Nature: collecting, recording, storing, organising, retrieving, using, transmitting and erasing personal data by automated means, and passing it to the suppliers and service providers that a booking or a service needs. • Purpose: to run your website and Admin Panel, search for and book travel services, process the payments made on your website, issue tickets and vouchers, send the messages you set up, support you and keep the platform secure, and for no other purpose.

3. 3个人数据和数据主体

   数据主体包括： • 您的客户及其为之预订的旅客，包括由成年人在为其预订时提供信息的儿童和婴儿； • 通过您的网站联系您的人员，例如提出咨询或进行聊天的人员； • 您的员工、下级代理机构和其他用户，涉及您在管理后台中管理的有关他们的数据。 个人数据可能包括： • 姓名、电子邮箱地址、电话号码和邮寄地址； • 出生日期、性别、国籍，以及护照或身份证件号码及其有效期；如果您开启护照扫描，还包括扫描图像； • 预订：行程、酒店住宿、预订参考号、会员卡号和特殊要求，这些可能透露健康或宗教信息，例如餐食选择或协助请求； • 付款：金额、状态和参考号，以及已保存银行卡的品牌、后四位数字和有效期；完整卡号由支付服务提供商处理，而非由我们处理； • 客户账户：用户名、密码哈希值、登录记录、IP 地址和设备信息； • 消息：聊天、电子邮件、SMS、WhatsApp 和 Telegram 消息，以及人们发送的文件。

4. 4仅按您的指示处理

   We process the personal data only on your documented instructions. Your instructions are this DPA, the agreement under which you use the platform and the platform contract; the settings you choose and what you and your users do in the Admin Panel and through our APIs; and any other written instruction you give us that is consistent with them. We do not use the data for any other purpose of our own, we do not sell it, and we do not use it to train artificial intelligence models. If a law we are subject to requires us to process the data in another way, we tell you before we do, unless that law forbids it. If we believe an instruction breaks the applicable data protection law, we tell you straight away, and we may hold off carrying it out until you confirm or change it.

5. 5您作为控制者的责任

   您负责： • 对您在网站上收集并要求我们处理的个人数据具有合法依据，并告知您的客户您如何使用这些数据，通常是通过您网站自己的隐私政策； • 仅收集您的预订和服务所需的数据，并且仅在预订需要时，在平台为此提供的字段中收集敏感数据； • 确保为儿童或其他旅客预订的人员有权提供他们的信息； • 您的指示的合法性以及您所输入数据的准确性； • 选择适合您业务的设置和用户角色，并妥善保管您的用户的登录信息。

6. 6保密

   只有为提供、支持或保障平台而需要个人数据的员工和承包商才能访问这些数据，且仅限于其工作所需的范围。他们每个人均受书面或法定保密义务的约束，该义务在其为我们工作结束后继续有效，并且他们均接受过数据保护和安全方面的培训。

7. 7安全措施

   我们考虑现有技术水平、实施成本以及处理的性质，采取与风险相适应的技术和组织措施，保护个人数据免遭意外或非法的破坏、丢失、篡改、披露或访问。这些措施包括： • 传输中（HTTPS）和静态加密； • 针对我们的员工和您的用户的个人用户账户、基于角色的访问控制和最小权限原则； • 将每个合作伙伴的数据与其他合作伙伴的数据进行逻辑隔离； • 密码仅以不可逆的哈希形式存储，支付网关凭据一经保存便不会再次显示； • 登录记录、管理后台中所做更改的记录以及 API 请求日志； • 公开表单上的机器人防护； • 定期备份我们的数据库，以便在发生事件后恢复数据； • 及时更新我们的软件，并检查我们的代码及其所依赖的软件是否存在安全问题； • 为我们的员工提供数据保护和安全培训； • 用于发现、调查和应对安全事件的书面程序。 我们可能会随着技术和风险的变化而调整这些措施，但绝不会以降低整体保护水平的方式进行调整。

8. 8分处理者

   You give us a general authorisation to engage sub-processors. Our current sub-processors are named in our sub-processor list, published on our website at /subprocessors, with what each one does, the personal data it receives, where it is based and how transfers are protected. Your Master, and any top-level master above it, may access your Admin Panel to support you, handle cases and supervise its part of the network. When it accesses personal data that we process for you, it acts as our sub-processor: we bind it by written contract as we bind our other sub-processors. Your Admin Panel shows your Master's name and contact details, and we tell you on request where it is based and which top-level master is above it. Moving you to a different Master, or placing a new top-level master above it, is a change of sub-processor for your data: we tell you, and you can object, as the next paragraph describes. A Master that stops acting for us is a case in which we must act sooner to keep the service running. Before a new sub-processor starts processing your data, we update that list and tell you by email or in the Admin Panel at least 30 days in advance, unless we must act sooner for security reasons or to keep the service running, in which case we tell you as soon as we can. You can object on reasonable data protection grounds by writing to [email protected] within that period. We will discuss your concerns in good faith and look for a solution; if we cannot find one, you may stop using the service concerned or close your account without any penalty, and we refund, pro rata, any fee you paid in advance for that service or for a period after your account closes. We bind every sub-processor, by written contract, to data protection obligations that protect the personal data at least as well as this DPA, in particular on security, confidentiality and using the data only to provide its services to us. We remain liable to you for our sub-processors' work as for our own.

9. 9国际传输

   We and our sub-processors may process the personal data outside the country where it was collected, including outside the United Arab Emirates, as our sub-processor list shows for each sub-processor. We transfer it only as the UAE Personal Data Protection Law allows: to countries with an adequate level of protection, or with appropriate safeguards such as contractual commitments. Where the EU or UK GDPR applies, we transfer the data only to a country covered by an adequacy decision or under the standard contractual clauses approved by the European Commission (with the UK addendum for UK data), which we sign with the sub-processor concerned. Where the transfer from you to us itself needs such safeguards, those clauses (module two, or module three if you are a processor yourself) and the UK addendum apply between you and us and form part of this DPA, with this DPA providing the details they require.

10. 10协助您履行义务

    考虑到处理的性质以及我们可获得的信息，我们协助您： • 答复您的客户和其他数据主体行使其权利的请求。您可以在管理后台中找到他们的账户和预订；如果请求需要管理后台未提供的操作，例如删除账户或导出其数据，您可以请求我们协助。如果请求直接发送给我们，我们会及时将其转交给您，不得无故拖延，并且除非您要求，我们不会自行答复； • 开展数据保护影响评估，并在法律要求时咨询数据保护机构，方式是向您提供您合理需要的有关我们的处理活动和安全措施的信息； • 按本附录所述，履行您在安全和个人数据泄露方面的义务。 如果您需要超出平台和本附录所提供范围的协助，我们可能会收取合理费用，该费用将事先与您商定。

11. 11个人数据泄露

    If we become aware of a personal data breach affecting the personal data we process for you, we tell you as soon as we become aware of it, and in any case within forty-eight (48) hours, by email to the address on your account. We tell you, as far as we know it at the time and in stages if we cannot tell you everything at once: • what happened and when; • the categories and approximate number of data subjects and records concerned; • the likely consequences; • what we have done or propose to do to deal with the breach and reduce its possible harm; • who you can contact for more information. We take reasonable steps to contain and investigate the breach, keep you informed, and help you notify the authorities and the people affected where the law requires. Telling you about a breach is not an admission of fault or liability.

12. 12合作结束时的删除或返还

    When we stop providing the platform to you, you can ask us for a copy of your customers' personal data that we still hold, in a common machine-readable format. We decide, at our discretion, whether we keep, delete or anonymise the personal data we process for you, and for how long. We make no commitment to keep it for any period or to delete it by any date, so export what you need while you use the platform. We keep bookings, invoices, payments and accounting records, including the traveller and customer details on them (such as names, itineraries, ticket numbers and amounts), for at least seven (7) years after the end of the tax period they belong to. We keep them protected and use them only for the reason we keep them.

13. 13信息与审计

    我们会向您提供为证明我们履行本附录项下义务而合理需要的信息，例如我们安全措施的说明、我们的分处理者名单以及对合理安全问卷的答复。 如果这些信息不足，或数据保护机构有此要求，您可以自行或通过一名负有保密义务且并非我们竞争对手的独立审计师，对我们的合规情况进行审计。您必须至少提前30天向我们发出书面通知，并事先与我们商定审计的范围、时间和持续时长。审计必须在正常营业时间内进行，不得干扰我们的服务，也不得借此访问其他合作伙伴的数据，费用由您承担。您在任意十二个月内可对我们审计一次，除非个人数据泄露影响了您的数据，或数据保护机构要求进行审计。

14. 14责任与优先顺序

    Our liability under this DPA is limited in the same way as our liability for the platform as a whole. We are not liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, business, goodwill or data. Our total liability to you for all claims together, under this DPA and otherwise in connection with the platform, is limited to the greater of (a) the fees you paid us in the twelve months before the event that gave rise to the claim and (b) USD 500. These limits do not apply to fraud, wilful misconduct or gross fault, or where the law does not allow liability to be limited. Nothing in this DPA limits the rights that data subjects have under the law. On the processing of personal data, this DPA prevails over any other terms between you and us where they differ, including the Platform Terms and Conditions. The platform contract may add further data protection commitments, and where it protects the personal data more, it prevails. This DPA applies for as long as we process personal data for you; the obligations that by their nature continue, such as confidentiality, survive its end. This DPA is governed by the laws of the Emirate of Dubai and the federal laws of the United Arab Emirates applicable in Dubai, except where the standard contractual clauses or the UK addendum require another law. A dispute under it is resolved in the same way as other disputes about the platform: it is subject to the exclusive jurisdiction of the onshore courts of the Emirate of Dubai (the Dubai Courts), and not of the courts of the Dubai International Financial Centre. This does not apply to a dispute arising from the standard contractual clauses or the UK addendum, which is resolved by the courts those clauses require (for the standard contractual clauses, the courts of an EU Member State; for the UK addendum, the courts of England and Wales), and it does not limit a data subject's right to bring proceedings before the courts those clauses allow.