Data Processing Addendum

1. Roles

This addendum forms part of the agreement between Archer Studios and each subscribing agency, and applies to the personal data the agency entrusts to the platform.

The agency is the controller of its client data: it decides what is collected and why. Archer Studios is the processor: we process that data only to provide the service. For platform account data, we act as controller as described in the Privacy Policy.

2. Scope of processing

• Subject matter and duration: providing the TravelIQ service for the term of the agency’s subscription.
• Nature and purpose: hosting and processing the agency’s records — clients, leads, trips, bookings, commissions, site content — and sending transactional email on the agency’s behalf.
• Data subjects: the agency’s clients and prospective clients, and its advisors.
• Categories of data: names and contact details, trip details and preferences the agency records (which may include dietary, allergy, and mobility notes), lead submissions, and commission entries. No payment card data — the platform does not collect it.

3. Instructions

We process the agency’s data only on its documented instructions. The agency’s use of the service — the records it creates, the features it turns on, the emails it triggers — constitutes those instructions, together with the agreement and this addendum. If we believe an instruction violates applicable data-protection law, we tell the agency before proceeding.

4. Subprocessors

The agency authorizes the subprocessors we use to run the platform. The current list — who, and for what — is published at Subprocessors.

We give notice before adding or replacing a subprocessor, and the agency may object on reasonable data-protection grounds. Each subprocessor is bound by obligations materially equivalent to this addendum.

5. Security measures

The measures below are the ones described on the security page, and that page follows the same rule as the rest of the site: each claim maps to something running, and nothing is listed here that isn’t.

• Row-level security policies enforced in the production database itself.
• Server-side role scoping: data an advisor is not entitled to — the agency's cut, gross figures, supplier rates — is filtered on the server and never sent to their browser.
• Per-tenant credentials encrypted at rest with AES-256-GCM.
• All traffic served over HTTPS.
• No payment card data anywhere in the platform: card handling is deliberately not built.

6. Breach notification

If we become aware of a personal data breach affecting the agency’s data, we notify the agency without undue delay, describe what we know — the nature of the breach, the records affected, the measures taken — and keep the agency updated as the investigation develops.

7. Assistance

Taking into account the nature of the processing, we assist the agency in responding to data-subject requests — access, correction, export, deletion — and with its own data-protection obligations, including impact assessments, where our help is reasonably needed.

8. Deletion on termination

When the agency’s subscription ends, we return the agency’s data in a portable format on request and then delete it, or delete it directly if no return is requested — except where law requires a copy to be retained, in which case it is kept only as long as that requirement lasts.

9. Governing law

This addendum is governed by the same law as the Terms of Service: the laws of the State of [the company’s state of incorporation] — a visible placeholder until legal review fills it in.