Data Processing Agreement

1. Details of the processing

• Subject and duration: providing Carreh for Business for the duration of the contract and until deletion under section 10.
• Nature and purpose: hosting, organising, reading (including with AI), displaying, exporting and deleting travel and expense records, as the Customer configures and instructs.
• Data subjects: the Customer's employees, contractors and other users, and people named in their travel and expense records.
• Personal data: identity and contact details, role and department, travel requests, itineraries, bookings and travel documents, receipts, expenses, reimbursements, approvals and comments, sign-in records.
• Special categories: none intended. Travel documents may incidentally contain identity document numbers; the Customer only uploads them where it has a lawful basis.

2. Instructions

Carreh processes personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use and configuration of the Service, unless EU or member state law requires otherwise; in that case Carreh informs the Customer first unless the law forbids it. Carreh tells the Customer if it considers an instruction unlawful.

3. Confidentiality

Everyone at Carreh authorised to process the personal data is bound by confidentiality.

4. Security

Carreh implements the technical and organisational measures in Annex 1 and keeps them appropriate to the risk. Carreh may update them provided the overall level of protection does not decrease.

5. Sub-processors

The Customer authorises Carreh to use the sub-processors listed here. Carreh gives workspace Owners at least 30 days' notice by email of a new sub-processor. The Customer may object on reasonable data protection grounds; if no solution is found, the Customer may end the affected Service and receive a refund of prepaid fees for the remaining period. Carreh imposes data protection obligations on each sub-processor equivalent to this DPA and remains responsible for them.

6. International transfers

Where personal data is transferred outside the European Economic Area to a country without an adequacy decision, Carreh relies on the European Commission's Standard Contractual Clauses, with additional measures where needed.

7. Assistance

Taking into account the nature of the processing, Carreh helps the Customer answer data subject requests (the Service lets Owners and Admins find, export, correct and delete records), and with security, breach notifications, impact assessments and consultations with supervisory authorities.

8. Personal data breaches

Carreh notifies the Customer without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting Customer personal data, with the information available at the time, then updates it as the investigation continues.

9. Return and deletion

The Customer can export its data at any time. When the contract ends, the Customer has 30 days to export; Carreh then deletes the personal data within 90 days, except where EU or member state law requires it to be kept. Backups are overwritten on their normal schedule.

10. Audits

Carreh makes available the information needed to demonstrate compliance with this DPA. The Customer may audit once a year, on 30 days' written notice, during business hours, under confidentiality and at its own cost, or rely on current independent certifications of Carreh's sub-processors where they cover the processing.

11. Liability and precedence

The limitations of liability in the Terms apply to this DPA, as far as the law allows. For the processing of personal data, this DPA prevails over the Terms.

12. Annex 1: technical and organisational measures

• Separation: Carreh for Business has its own accounts, database, storage and keys, separate from Carreh's consumer apps. Each company's data is kept separate, and every request is checked against the user's company membership and role.
• Access control: one-time sign-in codes sent by email; sessions stored only as hashes; Carreh staff need an email code and an authenticator app code; staff open workspace content only with the Customer's approval, for a limited time, recorded in the action log.
• Encryption: TLS in transit; encryption at rest by the hosting provider; authenticator secrets encrypted with AES-256-GCM; codes and tokens hashed with SHA-256 and a secret key.
• Logging: an append-only, tamper-evident action log of sign-ins and administrative actions.
• Resilience: managed database with point-in-time recovery and backups; restore procedures tested before launch.
• Development: code review, automated tests including tests that one company cannot reach another's data; secrets kept out of source code.
• Minimisation: no advertising trackers; AI providers do not train on Customer data.