1. When this DPA applies
Whenever Processor (Lydira LLC) processes personal data on behalf of Controller that falls within the scope of Regulation (EU) 2016/679 (“GDPR”). It supplements the Master Subscription Agreement and is incorporated by reference when the Customer’s primary establishment is in the EU or EEA.
2. Subject matter + duration
Subject matter: the provision of Lydira, the software travel agencies use to run their sales, operations and accounting. Duration: matches the term of the Master Subscription Agreement. On termination, §10 applies.
3. Data Subjects + categories of Personal Data
Data Subjects: Controller’s employees (advisors, managers); Controller’s end-customers (travellers); Controller’s business contacts (suppliers, referrers).
Personal Data categories: names, business contact info, travel itinerary details, payment method metadata (no card PAN; Stripe holds tokenised data), communication logs across email / SMS / WhatsApp, user account credentials (hashed), session + audit metadata.
Special-category data is not processed by design. If the Customer inputs such data into free-text fields, Processor processes it only under this DPA.
4. Processor obligations
- Process only on Controller’s documented instructions.
- Ensure confidentiality through binding obligations on authorised personnel.
- Implement Art. 32 technical + organisational measures (see §8).
- Engage Sub-processors only under §7’s conditions.
- Assist Controller with DSAR fulfilment + breach notification within 72h.
- Return or delete Personal Data on termination per §10.
- Make compliance evidence available on request.
5. Sub-processors
Controller authorises the Sub-processors listed at /legal/subprocessors. Any change receives ≥ 30 days’ prior written notice. Controller may object on reasonable GDPR grounds; if unresolved, Controller may terminate the affected service and Processor refunds prepaid fees for the unused portion.
Services that Controller connects with its own account (its own email server, messaging provider, consolidator or GDS office) work under Controller’s own contract with that provider and are not Sub-processors of Processor.
6. Security measures (Art. 32)
- Encryption at rest (AES-256) + in transit (TLS 1.2+).
- Principle of least privilege; production database access is restricted and gated through controlled access points.
- Every record change is audit-logged, scoped to each account.
- Application secrets are encrypted and rotated per environment.
- Independent penetration testing and continuous vulnerability scanning (target cadence: at least annual).
- Disaster-recovery objectives: RTO 4h / RPO 24h.
7. International transfers
A workspace in Processor’s EU cell is hosted on AWS in Frankfurt
(eu-central-1), where its application servers, database, file storage and
backups stay. Where personal data transfers outside the EEA, Processor relies
on the EU Standard Contractual Clauses (2021/914) embedded in the DPAs of the
upstream vendors (Stripe, OpenAI, Cloudflare), all listed at
/legal/subprocessors. Signed SCC copies available on
request to security@lydira.com.
8. Return + deletion
Within 30 days of termination, Controller elects either full return (a complete database export plus an archive of stored files) or secure deletion. Deletion completes within 90 days inclusive of backup rotation.
9. Confidentiality of team chat content
The Processor does not read or review the content of conversations the Controller’s users hold with each other in the platform’s team chat (channel messages, direct messages and their attachments). This content, backups included, is accessed only (a) for support work at the Controller’s written request and within the scope it states, or (b) under a binding order of a competent authority or a legal obligation, by the fewest personnel authorised for that task. Every access is logged and, unless the law forbids it, notified to the Controller in writing. The platform’s administration interface has no screen that shows this content, and message text is not written to application logs or to the audit log. Direct messages are sent to no automatic AI feature. Channel messages reach the Sub-processors in §5 only for the AI features the Controller leaves enabled.
10. Governing law
This DPA is governed by the laws of the State of Delaware, and disputes under it are subject to the exclusive jurisdiction of the state and federal courts located in Delaware, without prejudice to the mandatory jurisdiction of a Supervisory Authority. The EU Standard Contractual Clauses incorporated by this DPA are governed by the laws of Ireland, as their Clause 17 requires the law of an EU Member State, and disputes arising from them are resolved by the courts of Ireland (Clause 18).
To execute this DPA, contact legal@lydira.com. The full signable template is delivered under NDA during the Enterprise onboarding playbook (Day 1 kickoff).