This Data Processing Agreement (DPA) governs the processing of personal data that RoundPlan carries out on behalf of the customer subscribing to the service (the Client), under Article 28 of Regulation (EU) 2016/679 (GDPR).
The Client is the controller of the data it enters into the application about its own clients, contacts and travellers. RoundPlan acts as processor and handles that data solely to provide the service.
This DPA forms part of the Terms and Conditions. By accepting the Terms during signup, the Client also accepts this DPA, with no separate signature required. RoundPlan records the date, time and version accepted. A signed counterpart is available on request at support@roundplan.io.
The subject matter is the provision of the RoundPlan service: contact management, trip proposal building, trip management, invoicing and the client portal. Processing lasts for as long as the service agreement is in force, plus the deletion periods in clause 11. Categories of data subjects and types of data are set out in Annex I.
RoundPlan processes personal data only on documented instructions from the Client. Ordinary use of the application by the Client and its staff constitutes those instructions. RoundPlan will inform the Client if, in its view, an instruction infringes data protection law, and may suspend that instruction until the matter is resolved.
RoundPlan does not sell the data, does not disclose it to third parties other than the sub-processors in Annex III or where legally required, and does not use it for its own purposes, including the training of artificial intelligence models.
RoundPlan ensures that every person authorised to process the data is bound by a duty of confidentiality that survives the end of the relationship. Today that person is the owner alone; should employees or contractors join in future, the same written commitment will be required before granting them access.
RoundPlan applies the technical and organisational measures described in Annex II, appropriate to the risk under Article 32 GDPR. These measures may evolve over time, never lowering the level of protection.
The Client gives general authorisation for RoundPlan to engage the sub-processors listed in Annex III. Each is bound by data protection obligations equivalent to those in this DPA, and RoundPlan remains liable for their performance as for its own.
RoundPlan will give at least 30 days’ notice by email of any new or replacement sub-processor. The Client may object within that period on reasonable data protection grounds; if no solution is reached, it may terminate the service without penalty and with a refund of the unused portion.
The application lets the Client view, correct, export and delete its contacts’ and travellers’ data directly, which is the normal route for handling data subject requests. Where that is not enough, RoundPlan will provide reasonable assistance in responding to requests for access, rectification, erasure, restriction, portability or objection.
RoundPlan will likewise assist the Client in complying with Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation), taking into account the nature of the processing and the information available to it.
If a data subject contacts RoundPlan directly, they will be referred to the Client and the Client will be informed without undue delay.
RoundPlan will notify the Client of any security breach affecting its data without undue delay and in any case within 48 hours of becoming aware of it, with the information available: the nature of the incident, the categories and approximate volume of data and data subjects affected, the likely consequences and the measures taken. Notifying the supervisory authority and, where applicable, the data subjects is the Client’s responsibility as controller.
The Client’s database and files are hosted in the European Union (Ireland). Some sub-processors in Annex III are established outside the European Economic Area or may access the data from outside it; in those cases the transfer relies on an adequacy decision or on European Commission Standard Contractual Clauses, together with any supplementary measures required.
On termination, the Client has 30 days to export its data from the application or request a copy. After that period, RoundPlan will delete the data from production systems within 60 days. Encrypted backups are overwritten in their normal rotation cycle, which does not exceed a further 30 days. Only what the law requires, such as billing records, is retained, blocked and unused.
RoundPlan will make available to the Client the information necessary to demonstrate compliance with this DPA. The Client may carry out one audit per year, on 30 days’ notice, during business hours, at its own cost and never with access to other clients’ data. RoundPlan may satisfy this obligation by providing its own documentation or equivalent certifications from its providers.
Each party is liable for damage caused by its own breach of data protection law. The liability caps agreed in the Terms and Conditions apply to this DPA as well, to the extent permitted by applicable law.
This DPA remains in force for as long as RoundPlan processes data on behalf of the Client. Changes are published on this page with their date; if any change reduces the Client’s safeguards, it will be notified 30 days in advance. This DPA is governed by Spanish law and the GDPR, with the courts of Barcelona having jurisdiction.
No special categories of data (Article 9 GDPR) are processed on the Client’s behalf. Should the Client enter health data, for instance allergies or accessibility needs, into free-text fields, it does so under its own responsibility and must have an appropriate legal basis.
The Client’s payment card data is processed by Stripe directly as a controller: RoundPlan neither receives nor stores it. Agency staff data (the user accounts) is processed by RoundPlan as controller and is governed by the Privacy Policy, not by this DPA.
Use of artificial intelligence: when a user runs the AI generation or assisted-adjustment features on an itinerary, the content of that itinerary, which may include travellers’ names and emails, is sent to Google to produce the response. The Client can avoid this processing entirely by not using those features, which are optional: the rest of the application works without them.
Stripe is involved solely in charging the Client’s subscription and does not process traveller data, so it does not act as a sub-processor for the purposes of this DPA.