1. Roles and instructions
Processing roles follow the facts and applicable law. Agency traveler data should be processed on authorized documented instructions, subject to legal exceptions.
2. Security, confidentiality and vendors
Define access scope, technical controls, confidentiality, vendor obligations, subprocessor notice and legitimate international transfers.
3. Rights, incidents, audits
Document assistance for personal-data requests, security incidents, regulatory obligations and proportionate audits.
4. Deletion and return
Define authentic data retention/export, deletion of live documents and backups, plus legacy Base44 deletion limitations.