Effective: October 9, 2026
For customers who need a signed processor agreement — typically anyone handling guests from the EEA or the UK. It takes effect automatically with the Terms of Service; no signature is required, but we will sign a copy on request.
This addendum forms part of the Terms of Service between PLATINUM TRAVEL INC. ("Processor") and the Customer ("Controller"). It applies whenever we process personal data on the Customer's behalf, and prevails over the Terms of Service on that subject if the two conflict.
The Controller determines the purposes and means of processing. The Processor processes only on documented instructions, which are: the Terms of Service, this addendum, and the Controller's use of the features in the product.
If we believe an instruction breaches applicable data protection law, we will tell the Controller and may pause that processing.
Everyone we authorise to access personal data is bound by a duty of confidentiality, and access is limited to those who need it to run or support the service.
The Controller authorises the following subprocessors. Those marked optional are engaged only if the Controller enables that feature.
We impose data protection obligations on each subprocessor no less protective than those in this addendum, and remain liable for their performance. We will give at least 30 days' notice before adding or replacing one; the Controller may object on reasonable data protection grounds, and if we cannot resolve the objection they may terminate the affected service without penalty for the unused period.
The product lets the Controller find, correct, export and delete records themselves, which is how most requests are answered. Where that is not enough, we will provide reasonable assistance, taking into account the nature of the processing.
If a data subject contacts us directly, we will not respond on the Controller's behalf beyond telling them to contact the Controller, and we will forward the request.
We will also assist, so far as we reasonably can, with data protection impact assessments and prior consultations relating to the service.
We will notify the Controller without undue delay after becoming aware of a personal data breach affecting their data, and in any event within 72 hours, with the information we hold at the time and updates as we learn more.
Notifying supervisory authorities and data subjects is the Controller's responsibility, since they hold the relationship. We will support it.
The Controller may export their data at any time while the account is open. A request to close the account locks it at once and deletes the data permanently 7 days later, so export comes first. After deletion we hold nothing other than backups that expire on their own cycle and anything we must retain by law.
On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will provide the information needed to demonstrate compliance with this addendum. On-site audits are by prior agreement, at the Controller's cost, and must not disrupt the service or expose another customer's data.
Where personal data originating in the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the parties agree the applicable Standard Contractual Clauses apply, with the Controller as data exporter and the Processor as data importer, and Annexes I to III above completing them.
The limitations of liability in the Terms of Service apply to this addendum, except where applicable data protection law does not allow them to.
Data protection enquiries: platinumtravelca@gmail.com. PLATINUM TRAVEL INC., 2980 Number 3 Rd, Richmond, BC V6X 2B3.
The English text is the governing version; translations are provided for convenience.
PLATINUM TRAVEL INC. · 2980 Number 3 Rd, Richmond, BC V6X 2B3 · platinumtravelca@gmail.com