Data Processing Agreement

We process personal data on the agency's behalf to provide the Nelxa service, for as long as the agency's workspace exists and until the data is deleted or returned afterwards.

Hosting, storage, display, transmission (emails, PDFs, portal pages, payment links), automation and, where the agency enables it with its own key, AI-assisted drafting and parsing. All processing follows the agency's documented instructions, which are given through the product's settings and features.

Data subjects: the agency's travellers and their fellow passengers, business contacts and suppliers, and the agency's own staff.

Categories: identification and contact data; identity document details; travel and booking data; financial data (instalments, payments, refunds); contract and signature records; communications; and, where the agency records them for group passengers, dietary and medical notes and emergency contacts.

We process data only on instruction; keep it confidential and bind our staff to confidentiality; apply the security measures below; assist the agency with data subject requests and with its security and impact assessment duties; notify the agency without undue delay of a personal data breach affecting its data; delete or return the data at the end of the service; and make available the information needed to demonstrate compliance.

Tenant isolation by row-level security in PostgreSQL and per-request authorisation in the application; encryption in transit; encryption at rest of provider keys (AES-256-GCM); server-controlled, per-agency file paths; expiring personal links and rate-limited one-time codes for travellers; role-based access for staff; recoverable deletion with a 30-day purge; logging of automation runs and signatures; build-time checks that refuse code reading across agencies.

We use the sub-processors listed below. We will inform account owners before adding or replacing a sub-processor that processes agency data, so the agency can object. Services the agency connects with its own account (Stripe, email providers, AI providers, Google Calendar) act on the agency's own contract with them.

The agency can delete records at any time (trash, purged after 30 days) and can export the group manifest as CSV; Premium workspaces can export financial records as CSV. At the end of the service we delete the workspace data or, on request, return it in a machine-readable form first, except where the law requires retention.

We answer reasonable written audit questions and make available documentation of our measures. On-site audits are agreed case by case in the signed agreement.