DPA & Confidentiality Annex

1. Purpose

This Annex applies where a collaborator, supplier, or partner processes personal data on behalf of Avangarde Tourism or receives access to clients' personal data through the platform.

2. Roles

The role of each party is determined for each activity:

• Avangarde Tourism may act as data controller for the relationship with the client.
• The collaborator or supplier may act as data processor, independent controller, or joint controller, depending on the activity performed.
• Where the supplier determines the purposes and means of its own processing, it acts as an independent controller for that processing.

3. Subject matter of processing

Processing covers data necessary for quoting, booking, confirmation, delivery of tourist services, assistance, complaints, invoicing, and operational communication.

4. Duration

Processing takes place for the duration of the collaboration and thereafter only as long as necessary for legal obligations, complaint resolution, defence of rights, or data return/deletion.

5. Categories of data subjects

• Clients.
• Persons included in bookings.
• Minors, where included in travel.
• Contact persons.
• Collaborators and supplier representatives.

6. Categories of data

• Name, surname, contact details.
• Identity data and travel documents.
• Booking details and preferences.
• Payment data limited to status and identifiers.
• Special data, only where necessary: allergies, reduced mobility, medical assistance.
• Communications and supporting documents.

7. Instructions

The data processor processes data only on the basis of Avangarde Tourism's documented instructions and only for authorised purposes.

8. Confidentiality

Persons with access to data must be bound by confidentiality and may only be granted access where they genuinely need it to carry out their activity.

9. Security

The collaborator/supplier must implement appropriate measures, including:

• Strong passwords and individual access.
• Prohibition on sharing accounts.
• Device protection.
• Limiting data downloads.
• Deletion of data no longer needed.
• Incident reporting.
• Securing communications.
• Restricting internal access.

10. Sub-processors

The data processor may not engage sub-processors who process personal data without the prior authorisation of Avangarde Tourism or without compliance with the applicable contractual conditions.

11. Security incidents

Any incident, loss, unauthorised access, disclosure, misdirected message, account compromise, or suspected breach must be reported immediately to contact@avangardetourism.com.

12. Rights of data subjects

The collaborator/supplier shall assist Avangarde Tourism in responding to requests for access, rectification, erasure, objection, portability, or other data subject rights.

13. Return and deletion of data

Upon termination of the collaboration or at Avangarde Tourism's request, data must be returned, deleted, or anonymised, except where retention is required by law.

14. Audit and verification

Avangarde Tourism may request reasonable information to verify compliance with this Annex, including policies, evidence of deletion, access lists, incident explanations, or compliance documents.

15. International transfers

Data may not be transferred outside the European Economic Area without a legal basis and the necessary safeguards, except where the transfer is necessary to deliver the tourist service requested by the client.

16. Breach

Breach of this Annex may result in suspension of access, termination of collaboration, damages, and other measures provided for by law or contract.