Data Processing Agreement

1. Parties and allocation of roles

1.1. Which role a party holds depends on the partnership model (Section 3) and may differ per processing operation. What matters is who determines the purposes and means of the processing, not what the parties call it.

1.2. Tomoclaim is an independent controller for the handling of a claim from the moment a traveller instructs Tomoclaim to pursue it. The legal basis, the retention periods and the correspondence with the airline, the national enforcement body and the courts then rest with Tomoclaim.

1.3. The Partner is an independent controller for its own customer relationship, including any data it collects before referring a traveller to Tomoclaim.

1.4. Questions and requests under this DPA go to privacy@tomoclaim.com. The Partner keeps at least one contact person current in the partner portal.

2. Subject matter and duration

2.1. The subject matter is the processing of personal data required to let travellers submit and pursue a compensation claim under Regulation (EC) No 261/2004 or equivalent legislation through the Partner, and to inform and settle with the Partner in respect of those claims.

2.2. The duration of this DPA starts on the day the Partner accepts it and runs for as long as the Partner Agreement is in force, and thereafter for as long as either party still processes personal data on behalf of the other.

2.3. Termination of the Partner Agreement terminates this DPA, without prejudice to Section 13 and to the provisions that by their nature survive.

3. Nature and purpose of the processing per partnership model

3.1. The partner programme has three models. They differ in who touches which data, and therefore in the allocation of roles:

3.2. Under Referral the Partner processes no personal data of travellers on behalf of Tomoclaim. Sections 5 through 13 then apply solely to the processing Tomoclaim carries out on behalf of the Partner.

3.3. Under White-label the parties hereby set out the allocation between them of the obligations under Articles 13 and 14 GDPR and of the exercise of data subject rights. The essence of that arrangement is made available to data subjects on the portal surface. Tomoclaim is the point of contact, without prejudice to the data subject's right to approach either party.

3.4. Processing takes place solely for the purposes set out above. Neither party uses the data for its own marketing, for profiling, or for disclosure to third parties for consideration.

4. Categories of data subjects and personal data

4.1. The data subjects are: travellers who submit or have a claim submitted, fellow travellers on the same booking, and the contact persons of the Partner who use the partner portal.

4.2. The following categories of traveller data are processed:

• name, e-mail address, telephone number (optional) and address;
• flight details: flight number, flight date, airports and booking reference;
• the nature and duration of the disruption, with its supporting evidence;
• boarding pass, booking confirmation and other claim documents;
• the bank account number (IBAN) and account holder name to which the compensation is paid;
• the signature on the power of attorney or deed of assignment, with the timestamp and version of the document signed;
• the correspondence about the claim, including messages to and from the airline.

4.3. Of the Partner's contact persons the following are processed: name, business e-mail address, role in the portal, and sign-in and usage data such as session timestamps and the IP address in the security logs.

4.4. No special categories of personal data within the meaning of Article 9 GDPR are requested. Where a traveller supplies them unprompted, for example a medical statement supporting a cancellation, they are retained only to the extent the claim requires and are not processed further.

4.5. No solely automated decision-making producing legal effects within the meaning of Article 22 GDPR takes place. The eligibility check on a claim is an aid; the decision to pursue a claim is taken by a human.

5. Instructions

5.1. The processor processes personal data solely on documented instructions from the controller. This DPA, the configuration and use of the partner portal, and instructions given through the portal or by e-mail to the contact address all constitute such instructions.

5.2. Processing required by Union or Member State law is permitted. The processor notifies that legal requirement beforehand, unless that law prohibits such notification on important grounds of public interest.

5.3. If the processor considers an instruction to infringe the GDPR or other data protection provisions, it immediately informs the controller and may suspend execution until the instruction has been amended or confirmed in writing.

6. Confidentiality

6.1. Each party ensures that the persons under its authority who have access to the personal data are bound by confidentiality, either in their employment contract or by a separate undertaking.

6.2. Access is granted solely to persons who need the data to perform this DPA, and is revoked as soon as that need ends.

6.3. Confidentiality continues to apply after termination of this DPA and after the end of the employment or engagement of the person concerned.

7. Security

7.1. Both parties implement appropriate technical and organisational measures within the meaning of Article 32 GDPR, having regard to the state of the art, the cost of implementation and the risk to data subjects.

7.2. Tomoclaim implements at least the following measures:

• encryption of data in transit (TLS 1.2 or higher) and at rest;
• field-level encryption of bank account numbers; logs, overviews, e-mail and the daily finance digest show only the last four digits;
• role-based access on the principle of least privilege; the partner portal has an administrator role, an agent role and a read-only finance role;
• sessions on HttpOnly, Secure and SameSite cookies; never a token in the URL;
• separate development, acceptance and production environments, with only synthetic or anonymised data outside production;
• logging of access to personal data and of status changes on a claim, with a defined retention period;
• daily backups with periodic restore testing;
• periodic review of dependencies for known vulnerabilities, and a release process in which every change is tested automatically before it reaches production.

7.3. For the data it collects before referral the Partner implements measures at least equivalent to 7.2, and protects access to the partner portal with named individual accounts and a strong password. Accounts are not shared; a departing employee is removed from the portal without delay.

7.4. The parties review the measures at least annually and adjust them where the state of the art or the risk gives cause to do so.

8. Sub-processors

8.1. The Partner gives Tomoclaim general written authorisation to engage sub-processors. Tomoclaim imposes on each sub-processor at least the same obligations as are set out in this DPA, and remains fully liable to the Partner for their performance.

8.2. As at the effective date of this version the following sub-processors are engaged:

8.3. Tomoclaim announces a new or replacement sub-processor at least thirty days in advance through the partner portal and the Partner's contact address. Within that period the Partner may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Partner may terminate the Partner Agreement free of charge as at the effective date of the change.

8.4. The current list is published on this page. A change to the list results in a new version number (Section 15).

9. Transfers outside the European Economic Area

9.1. Personal data is processed within the European Economic Area as a matter of principle.

9.2. The transfer to Netlify, Inc. in the United States relies on the EU-US Data Privacy Framework if and for as long as the recipient is certified under it, and otherwise on the standard contractual clauses of Implementing Decision (EU) 2021/914, module three, supplemented by a transfer impact assessment and additional measures: encryption in transit and at rest, and no access to the content of claim files.

9.3. An airline, supervisory authority or dispute resolution body outside the European Economic Area may receive data to the extent necessary for the claim. That disclosure relies on Article 49(1)(b) and (e) GDPR: performance of the contract with the data subject, and the establishment or defence of legal claims respectively.

9.4. If a transfer mechanism ceases to be available, Tomoclaim informs the Partner and within a reasonable period either puts an alternative safeguard in place or ends the transfer.

10. Assistance

10.1. Taking into account the nature of the processing, the processor provides the controller with reasonable assistance in responding to requests from data subjects under Chapter III GDPR: access, rectification, erasure, restriction, portability and objection.

10.2. Where a party receives a request addressed to the other, it forwards it within three business days and does not answer it itself.

10.3. The processor provides assistance with a data protection impact assessment and with prior consultation of the supervisory authority, to the extent the information required is reasonably available only to the processor.

10.4. Assistance is provided free of charge to the extent it follows from the normal performance of this DPA. For manifestly unfounded or excessive, in particular repetitive, requests a reasonable fee may be charged, subject to prior written notice.

11. Personal data breach notification

11.1. A party that becomes aware of a personal data breach affecting the data covered by this DPA notifies the other party without undue delay and in any event within 48 hours of discovery.

11.2. The notification goes to privacy@tomoclaim.com or to the Partner's contact address respectively and contains at least: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point. Where not all information is available, the remainder follows in phases, without delaying the first notification.

11.3. The processor never notifies the supervisory authority or data subjects on behalf of the controller, unless the controller requests it to do so in writing.

11.4. Both parties keep a record of breaches and make it available to the other on request, to the extent it concerns the joint processing operations.

12. Audit

12.1. The processor makes available to the controller all information necessary to demonstrate compliance with Article 28 GDPR.

12.2. The controller may have an audit carried out at most once per calendar year, and in addition following a breach affecting its data or at the request of a supervisory authority.

12.3. An audit is announced at least thirty days in advance, takes place during business hours, does not unreasonably disrupt operations, and is carried out by the controller itself or by an independent auditor who does not compete with the processor and who signs a confidentiality undertaking.

12.4. Instead of an on-site audit the processor may submit a recent report by an independent third party or a valid certification, provided it covers the points to be examined.

12.5. Each party bears its own costs. The cost of an external auditor is borne by the controller, unless the audit establishes a material shortcoming.

13. Deletion and return

13.1. On termination the processor deletes the personal data, or returns it in a common, machine-readable format, at the controller's choice. That choice is communicated within thirty days of termination; absent a choice, the processor deletes.

13.2. Deletion takes place within ninety days, including backups once their regular retention period expires. For as long as data exists only in a backup, it is no longer actively processed.

13.3. The processor may retain data to the extent a statutory retention obligation so requires — in particular the seven-year tax retention obligation for invoices and statements (Article 52 of the Dutch State Taxes Act) — and then processes it solely for that purpose.

13.4. On request the processor confirms the deletion in writing.

14. Liability

14.1. The parties' liability under this DPA is governed by the liability provision in the Partner Terms. That limitation is without prejudice to Article 82 GDPR: it does not apply to a claim by a data subject, nor to an administrative fine.

14.2. Where a party compensates damage or pays a fine attributable in whole or in part to the other, it is entitled to claim back from that other party the part corresponding to their share of responsibility, in accordance with Article 82(5) GDPR.

15. Version, changes and governing law

15.1. This DPA is version 2026-10. The partner portal records which version the Partner accepted and when.

15.2. Tomoclaim may amend the text where legislation, the state of the art or the service gives cause to do so. A new version is announced at least thirty days in advance, receives a new version number and is accepted by the Partner in the portal. An amendment has no retroactive effect.

15.3. This DPA is governed by the laws of the Netherlands. Disputes are submitted to the competent court in Amsterdam, in accordance with the Partner Terms.