Data Processing Agreement

Last updated: January 1, 2026

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person processed by TripReason on behalf of Client under this Agreement. "Processing" means any operation performed on Personal Data.

2. Data Processing Scope

TripReason shall process Personal Data solely for the purpose of providing travel management services as described in the MSA. The categories of data include: employee names, contact details, travel preferences, booking information, payment data, and travel history.

3. Data Controller and Processor

Client is the Data Controller and TripReason is the Data Processor. Client determines the purposes and means of processing. TripReason processes data only on documented instructions from Client.

4. Sub-processors

Client authorizes TripReason to engage sub-processors including: Amazon Web Services (cloud infrastructure), Stripe (payment processing), Twilio (communications), and Intercom (customer support). TripReason shall notify Client of any sub-processor changes.

5. Data Security

TripReason implements technical and organizational measures including: encryption at rest (AES-256) and in transit (TLS 1.3), access controls, multi-factor authentication, regular security audits, and employee training.

6. Data Breach Notification

TripReason shall notify Client within 24 hours of becoming aware of a personal data breach. Notification shall include nature of breach, categories affected, likely consequences, and remedial measures.

7. Data Retention and Deletion

Upon termination of the MSA, TripReason shall delete or return all Personal Data within 90 days, except where retention is required by applicable law. Data is retained for the duration of the Agreement plus 90 days.

8. International Transfers

Personal Data may be stored and processed in the United States, European Union, and India. TripReason ensures appropriate safeguards including Standard Contractual Clauses for cross-border data transfers.

9. Data Subject Rights

TripReason shall assist Client in responding to data subject requests for access, rectification, erasure, restriction, portability, and objection within applicable legal timeframes.