Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Roamze Business Terms between Roamze and the business that uses Roamze’s tools for tour operators and guides (“you” or the “Business”). It applies when Roamze processes Customer Personal Data on your behalf.

1. Definitions

• Customer Personal Data: personal data about your customers, prospective customers and staff that you or they submit through Roamze, such as inquiries, bookings, customer lists, text messages, emails, waivers and chat conversations with your website assistant.
• Data Protection Laws: the privacy laws that apply to the processing, including the California Consumer Privacy Act as amended (CCPA), other US state privacy laws and, where they apply, the EU and UK GDPR.
• Subprocessor: a third party Roamze engages to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

2. Roles

For Customer Personal Data, you are the controller (or “business” under the CCPA) and Roamze is your processor (“service provider”). Roamze is a controller of the data it needs to run your account (such as your login, billing contact and usage of Roamze) and of its own consumer users’ data. Our Privacy Policy covers that.

3. Instructions

Roamze processes Customer Personal Data only to provide the service you use, as described in Annex 1, and on your documented instructions. Your use and configuration of Roamze are your instructions. Roamze will tell you if it believes an instruction breaks Data Protection Laws.

4. Service-provider commitments (CCPA)

Roamze will not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose other than providing the service to you, including for targeted advertising;
• combine it with personal data from other sources, except as the law allows;
• use it to train or improve AI models, unless you opt in to that use in writing or in your account settings.

5. Confidentiality and personnel

Roamze limits access to Customer Personal Data to people who need it to provide, support or secure the service. Those people are bound by confidentiality obligations.

6. Help with your obligations

Taking into account the nature of the processing, Roamze will help you answer requests from your customers to access, correct, delete or port their data, and with any data protection assessments. Today we do this on request: email support@roamze.com and we will respond within 10 business days. If one of your customers contacts Roamze directly about data you control, we will pass the request to you.

7. Subprocessors

You authorise Roamze to use the subprocessors listed on our subprocessors page. Roamze will:

• put a written agreement with each subprocessor that protects the data at least as well as this DPA;
• give you at least 30 days’ notice by email before a new subprocessor processes Customer Personal Data;
• if you object on reasonable data-protection grounds, work with you on an alternative. If none is possible, you may end the affected service and get a refund of any prepaid fees for it.

Roamze remains responsible for its subprocessors.

8. Security incidents

Roamze will notify you without undue delay, and in any case within 72 hours of becoming aware of a Security Incident that affects your Customer Personal Data. The notice will include what we know at the time:

• the nature of the incident;
• the categories and approximate number of people and records affected;
• the likely consequences;
• the steps taken and proposed;
• a contact for more information.

We will update you as we learn more. A notice is not an admission of fault.

9. Security

Roamze maintains the technical and organisational measures in Annex 2 and may improve them over time. It will not materially reduce the overall protection they provide.

10. Return and deletion

When your account ends:

• you can request an export of your Customer Personal Data for 30 days;
• after that, Roamze deletes it within a further 30 days, except where Annex 3 or the law requires us to keep it. Signed waivers are the main exception (see Annex 3).
• data in backups and logs expires on their normal cycle and is not restored except to recover from a failure.

Today, exports and deletion are handled on request by email. Automated offboarding is being built.

11. Audits and information

Once a year, or after a Security Incident, Roamze will:

• answer a reasonable security questionnaire;
• share a summary of its security programme and any third-party assessment reports it holds, under confidentiality.

If that information doesn’t reasonably show compliance with this DPA, you may run an audit yourself or through an independent auditor bound by confidentiality. You must give 30 days’ notice, hold it during business hours, and pay for it.

12. Where data is processed

Roamze and its subprocessors process Customer Personal Data in the United States. Where the EU or UK GDPR applies to a transfer, the parties will use the applicable standard contractual clauses. These will be attached on request.

13. Order of precedence and liability

If this DPA conflicts with the Business Terms on data protection, this DPA wins. Each party’s liability under this DPA is subject to the limits in the Business Terms, unless the law doesn’t allow it.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption: HTTPS for all traffic, with HSTS. Encryption at rest by our hosting providers. Connected-account credentials are additionally encrypted with AES-256-GCM. Access, invite, claim and waiver links are stored only as one-way hashes.
• Tenant isolation:Roamze’s API checks every request for business data against the signed-in user’s business. Customer lists, text messages and assistant transcripts are readable only by Roamze’s backend service.
• Waivers: signed waivers are append-only, carry a SHA-256 hash of the signed text, and are stored in private storage. They are opened only through links that expire after five minutes.
• Payments:card details are entered on Stripe and never reach Roamze’s servers.
• Integrity of incoming data: webhooks from Stripe, Twilio and our email provider are verified by signature.
• Access control:production access is limited to Roamze’s founder. The admin tools sit behind an additional identity-aware access layer. Secrets are kept in a managed secrets vault.
• Environments: production and test environments are separate cloud projects. Test environments do not hold real customer data.
• Change control: changes are made through pull requests with automated tests. Database changes are applied by a checksummed migration process that is verified before each production deploy.
• Logging: cloud administrative audit logs are kept for 400 days in a locked bucket.
• Security programme: a written information-security programme based on ISO/IEC 27001:2022, with a risk register, incident-response plan and supplier reviews. Current status is published on our Trust & Security page.

Annex 3: Retention

Draft periods, subject to counsel review. Until automated retention is in place, Roamze applies them on request.