Legal

Data Processing Agreement

Effective date: August 16, 2026  ·  HipQuality Vacations

This Data Processing Agreement ("DPA") is entered into between HipQuality Vacations ("Data Controller" or "we") and any corporate travel partner, travel management company, or international supplier ("Data Processor" or "Partner") that processes personal data on behalf of HipQuality Vacations or shares personal data with us in connection with travel services.

This DPA supplements and is incorporated into any master services agreement, supplier agreement, or booking terms between the parties. In the event of conflict, this DPA governs with respect to data protection matters.

1. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person, including names, passport numbers, contact details, dietary requirements, medical information, and payment data.
  • "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
  • "Data Subject" means the individual to whom Personal Data relates (typically, the traveler or client).
  • "Applicable Data Protection Law" means the California Consumer Privacy Act (CCPA/CPRA), the EU General Data Protection Regulation (GDPR) where applicable, and any other applicable privacy legislation.

2. Scope and Purpose of Processing

Personal Data shared under this DPA is processed solely for the purpose of fulfilling travel bookings, providing travel-related services, and complying with legal obligations. Permitted processing activities include:

  • Transmitting traveler details to airlines, cruise lines, hotels, and ground operators to fulfill reservations;
  • Processing payment information for booking deposits and final payments;
  • Communicating itinerary details, travel documents, and service updates to travelers;
  • Complying with government-mandated passenger data requirements (e.g., Advance Passenger Information).

3. Data Controller Obligations

HipQuality Vacations, as Data Controller, shall:

  • Collect Personal Data only with appropriate legal basis (consent, contract performance, or legitimate interest);
  • Provide Data Subjects with clear notice of how their data will be used at the time of collection;
  • Ensure that Personal Data shared with Partners is accurate, relevant, and limited to what is necessary;
  • Honor Data Subject rights requests (access, correction, deletion) within legally required timeframes;
  • Maintain records of processing activities as required by Applicable Data Protection Law.

4. Data Processor Obligations

Partners acting as Data Processors shall:

  • Process Personal Data only on documented instructions from HipQuality Vacations;
  • Implement appropriate technical and organizational security measures to protect Personal Data against unauthorized access, loss, or disclosure;
  • Not engage sub-processors without prior written authorization from HipQuality Vacations;
  • Notify HipQuality Vacations of any Personal Data breach within 72 hours of becoming aware of it;
  • Delete or return all Personal Data upon termination of the relationship, unless retention is required by law;
  • Make available all information necessary to demonstrate compliance with this DPA upon request.

5. International Data Transfers

Where Personal Data is transferred outside the United States or the European Economic Area, the transferring party shall ensure that appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission;
  • Binding Corporate Rules where applicable;
  • Adequacy decisions recognized by relevant data protection authorities.

Partners operating in the EU or processing data of EU residents must comply with GDPR Chapter V requirements for international transfers.

6. Security Measures

Both parties shall implement and maintain appropriate technical and organizational measures, including:

  • Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest;
  • Access controls limiting Personal Data access to authorized personnel on a need-to-know basis;
  • Regular security assessments and vulnerability testing;
  • Employee training on data protection and privacy obligations;
  • Incident response procedures for data breaches.

7. Data Retention

Personal Data shall be retained only for as long as necessary to fulfill the purposes described in this DPA, or as required by applicable law. Standard retention periods:

  • Booking records: 7 years (tax and legal compliance);
  • Passport and travel document copies: Deleted within 30 days of travel completion;
  • Marketing preferences: Until consent is withdrawn;
  • Payment records: 7 years (financial regulations).

8. Data Subject Rights

Data Subjects have the right to request access to, correction of, deletion of, or restriction of processing of their Personal Data. Requests should be submitted to jamie@hipquality.travel. We will respond within 30 days (or 45 days where permitted by law).

9. Governing Law

This DPA is governed by the laws of the State of California. For Partners subject to GDPR, the applicable EU member state law shall govern data protection matters to the extent required.

10. Contact

Data protection inquiries should be directed to:
HipQuality Vacations
jamie@hipquality.travel