Data Processing Agreement (DPA)

Subject matter, scope and entry into force

This Data Processing Agreement (hereinafter, the “DPA”) governs the processing of personal data that Tramoa carries out on behalf of your agency when you use the service. It supplements the Terms of Service and is deemed accepted when you sign up or, if you already had an account, when you continue to use the service from the date of its publication.

If the legislation that applies to you requires a signed version of the DPA, write to us at contact@tramoa.com and we will provide you with one.

Definitions

The terms used in this DPA have the meaning given to them by the GDPR. In particular:

• Controller: your agency, which decides what personal data is processed and for what purposes.
• Processor: Tramoa, which processes personal data on behalf of your agency.
• Sub-processor: a third party that Tramoa engages to provide the service and that processes personal data on behalf of your agency.
• Data subject: the person whose data is processed; for example, someone who writes to your agency on WhatsApp or a traveller on a booking.
• Assistant: the artificial intelligence assistant that Tramoa makes available to your agency to reply to its customers on WhatsApp.
• Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data, or to the unauthorised disclosure of, or access to, such data.
• GDPR: Regulation (EU) 2016/679. EEA: European Economic Area.

The role of each party

With regard to the data of the people who write to your agency on WhatsApp and of the travellers on its bookings, your agency is the Controller and Tramoa is the Processor. Each party complies with the obligations that the GDPR imposes on it in its role.

Your agency's data as a customer of Tramoa (your account, your team, billing, the WhatsApp connection and use of the dashboard) is processed by Tramoa as Controller and is governed by our Privacy Policy, not by this DPA.

WhatsApp. Your agency contracts for the WhatsApp Business platform directly with Meta: it accepts Meta's terms when it connects its number, and Meta processes the messages as your agency's processor under those terms. That is why, for those messages, Meta is not a sub-processor of Tramoa. Tramoa accesses your agency's WhatsApp account with its authorisation, as a Meta Tech Provider, and only to provide it with this service. It is one for the notifications Tramoa sends from its own number to the people at your agency (section 9).

Card payments. If your agency takes card payments from its customers, it does so with its own Stripe account, which it contracts for directly. Card details do not pass through Tramoa.

What processing Tramoa carries out and for how long

Tramoa processes the data in order to provide the contracted service:

• Receiving the messages that arrive on your agency's WhatsApp and sending the assistant's replies on its behalf.
• Understanding the messages and drafting the replies with artificial intelligence, based on the information and instructions your agency gives it. Prices are calculated by the system using your agency's rates.
• Preparing quotes and bookings, storing the data needed for them and, if your agency switches this on, reminders and notifications to its customers.
• Handing the conversation over to a person at your agency when the customer asks for it or when your agency has set this up, and notifying them: in the dashboard, by email and, for the people your agency chooses and verifies, on WhatsApp from Tramoa's number, with the customer's name, their trip and the reason, never the whole conversation.
• Showing the conversations in your agency's dashboard and giving your agency aggregate figures about them.
• If your agency belongs to a group and agrees to share its figures with the head office, giving the head office only aggregate figures: never conversations, names, phone numbers or documents.

The processing lasts for as long as your agency uses Tramoa and for a further 30 days from when its assistant stops replying. After that, the data is erased as set out in section 15.

Data subjects and data

The data subjects are:

• The people who write to your agency on WhatsApp, whether or not they are already customers.
• The travellers included in a quote or a booking, including minors.

The data processed is:

• Identification and contact data: the WhatsApp profile name and the phone number or, if the customer uses a WhatsApp username, the identifier that WhatsApp gives the agency in its place; and the email address, if the customer provides it.
• Content of the messages: text, voice notes, photos and documents.
• Trip data: dates, destination, number and ages of the travellers, preferences and budget.
• Booking data, if your agency switches this on: travellers' names, identity document or passport, date of birth and nationality.
• Payment status, without card details.
• Delivery data provided by WhatsApp: whether a message was sent, delivered or read.

Special categories. The service does not need data concerning health, religion or any other special categories of personal data under Article 9 of the GDPR, and the assistant does not ask for them. If a customer shares such data of their own accord, it is processed only in order to attend to them and with the same measures. Your agency will not configure the assistant to collect such data without first agreeing this in writing with Tramoa.

Your agency's instructions

Tramoa processes the data only on your agency's documented instructions, which are:

• The Terms of Service and this DPA.
• What your agency sets up in the dashboard: the information about its trips, the instructions to the assistant, when it hands over to a person, the notifications and the retention periods.
• The instructions it sends us in writing to contact@tramoa.com.

If we believe that an instruction is contrary to the GDPR or to other data protection legislation, we will tell you without delay.

Tramoa does not use the data for its own purposes: it does not sell it, does not use it for advertising and does not train artificial intelligence models with it, nor does it allow its sub-processors to do so. Meta's terms also require this.

Tramoa's obligations

As provided in Article 28 of the GDPR, Tramoa undertakes to:

• Process the data only on your agency's instructions and in order to provide the service.
• Ensure that the persons authorised to process it are bound by a duty of confidentiality.
• Apply the security measures in section 11.
• Comply with the conditions for engaging sub-processors (section 9).
• Help your agency comply with its obligations (section 13).
• Notify you of any personal data breach (section 12).
• Return or erase the data on termination (section 15).
• Give you the information needed to demonstrate that we comply (section 14).

Someone from Tramoa accesses your agency's dashboard only when your agency asks for this or to resolve a security incident, and this is logged.

The AI assistant

• It states that it is an AI in its first message of every conversation, as required by Article 50 of the EU Artificial Intelligence Act.
• It hands over to a person when the customer asks for this and when your agency has set this up. When someone from your agency takes over the conversation, the assistant stays silent until your agency decides to hand it back.
• It does not make decisions with legal effects on customers, nor does it profile them for that purpose (Article 22 of the GDPR). Accepting a booking, taking payment or cancelling remain decisions for your agency and its terms and conditions.
• It uses Claude, by Anthropic. Anthropic processes the data as a sub-processor, does not use it to train its models and deletes it within 30 days at most, unless its systems flag a conversation for possible prohibited use (up to 2 years) or a law requires otherwise.
• It understands voice notes and audio recordings: Speechmatics turns customers' voice notes and the recordings in which the agency explains its trips into text as a sub-processor, and does not use them for training.
• It can reply with voice notes (if your agency turns this on in Instructions): ElevenLabs generates them as a sub-processor from the text of the reply, which is also sent in writing. It does not use them for training, we delete the audio and the text from its servers as soon as it finishes, and the audio carries its watermark for AI-generated content.
• The assistant can make mistakes. Your agency is responsible for the information it gives the assistant (trips, prices and terms and conditions) and for reviewing anything it is concerned about.

Sub-processors

Your agency authorises Tramoa to engage the following sub-processors:

Each sub-processor is bound by contract to protect the data with safeguards equivalent to those in this DPA.

Changes. If we add or replace a sub-processor, we notify you at least 30 days in advance, by email and in the dashboard. Within that period you may object on reasonable data protection grounds; if we do not resolve the matter, you may cancel your plan without penalty.

Transfers outside the EEA

The application and the database are in Ireland. When a sub-processor processes data outside the EEA, the transfer is covered by:

• The EU-U.S. Data Privacy Framework, for the sub-processors that participate in it (Vercel, Cloudflare, Resend, Sentry, Upstash, GitHub and ElevenLabs).
• The Standard Contractual Clauses of the European Commission (Commission Implementing Decision (EU) 2021/914), included in the contract: they are the safeguard for Anthropic and Supabase, and the fallback safeguard for the others should the Framework cease to be valid.
• The adequacy decision for the United Kingdom (Commission Implementing Decision (EU) 2025/2574): Speechmatics is a British company, although it transcribes on its EU servers.

In addition, Tramoa sends each sub-processor only the data it needs, encrypts everything in transit and encrypts backups before they leave our database.

Security measures

• Encryption of everything in transit (TLS) and of what is stored in the database and in the backups. WhatsApp permissions and keys are, in addition, encrypted in the application.
• Each agency is isolated: the database separates each agency's data and the code checks this on every access.
• Protected access: password, an optional security code, roles for each person (administrator, editor, viewer), an alert when someone signs in from a new device, sessions tied to the device and a limit on open sessions.
• Logging: sign-ins, configuration changes and sensitive operations are logged, including when someone from Tramoa signs in.
• Perimeter protection: mitigation of denial-of-service attacks by Vercel and the anti-bot check on sign-in by Cloudflare Turnstile.
• Hardened application: Content Security Policy, CSRF protection, request limits, input validation and HTML sanitisation.
• Backups, daily and encrypted, which are deleted automatically after 90 days.
• Monitoring: availability monitoring, error logging, dependency reviews and periodic key rotation.

Personal data breaches

If Tramoa becomes aware of a personal data breach affecting data processed on behalf of your agency, it notifies you without undue delay and, at the latest, within 48 hours of becoming aware of it, so that your agency can notify the authority within its own 72-hour time limit. The notification includes, insofar as it is known:

• What has happened and, if known, the categories and approximate number of data subjects and of records affected.
• Its possible consequences.
• The measures taken or proposed to reduce them.
• Who to contact to find out more.

Helping your agency

Taking into account the nature of the processing, Tramoa helps your agency to:

• Respond to data subjects exercising their rights (access, rectification, erasure, objection, restriction and portability). From the dashboard, a customer can be viewed, exported and deleted. If a customer asks in the chat for their data to be deleted, the assistant passes the request on to a person at your agency. And if they write to us, we pass it on to your agency that same day.
• Carry out a data protection impact assessment (DPIA) when needed, with the technical description of the processing.
• Carry out a prior consultation with the supervisory authority, where applicable.
• Maintain security and manage breaches, as set out in sections 11 and 12.

If an authority or another third party asks us for access to data processed on behalf of your agency, we will tell you before acting on the request, unless the law prohibits this.

Demonstrating that we comply

Tramoa makes available to your agency the information needed to verify that Tramoa complies with this DPA and with Article 28 of the GDPR:

• This public documentation: the DPA, the Privacy Policy and the list of sub-processors.
• Written answers to your reasonable questions.
• Where we have them, third-party certifications or reports on our main sub-processors.

As the service shares infrastructure between agencies, an on-site audit would put the other agencies' data at risk. If a law or your supervisory authority requires one, we will carry it out through an independent auditor, with reasonable prior notice, under confidentiality and at your agency's expense, unless the audit reveals material non-compliance by Tramoa.

Retention periods, return and erasure

• While you use Tramoa, conversations are deleted 24 months after the last message, and passports and travel documents 30 days after the return from the trip. Your agency can shorten both periods in the dashboard and delete a customer whenever it wishes.
• You can export your data at any time from the dashboard, in a structured, commonly used format.
• When WhatsApp is disconnected, Tramoa immediately deletes the permission Meta gave it and the assistant stops replying.
• When the service ends, Tramoa keeps the data for 30 days from when the assistant stops replying, in case your agency comes back, and then erases it irreversibly, except for any data that a law requires to be kept.
• The backups containing it are deleted automatically after 90 days.

The copy of the messages kept by Meta is governed by your agency's contract with Meta.

Your agency's responsibilities

• Having a legal basis for processing its customers' data and informing them, in its own privacy policy, that it uses Tramoa as a processor.
• Having its customers' permission before writing to them on its own initiative (reminders and promotions), as required by law and by WhatsApp's policy, and honouring opt-outs.
• Ensuring that the information and instructions it gives the assistant are correct and lawful.
• Not configuring the assistant to collect special categories of personal data without first agreeing this with Tramoa (section 5).

Changes to this DPA

We may update this DPA when the law, our sub-processors or the service change. The version in force is always the one on this page, with its date. If the change is significant, we notify you at least 30 days in advance, by email and in the dashboard; continuing to use the service after that date constitutes acceptance of the new version.

Language, precedence and governing law

The binding version of this DPA is the Spanish one. Translations are for information only and, in the event of any discrepancy, the Spanish text prevails.

If this DPA and the Terms of Service say different things about data protection, this DPA prevails. In all other respects, the Terms prevail.

This DPA is governed by Spanish law and the GDPR. The parties will attempt to resolve any disagreement amicably and, failing that, the courts and tribunals of the city of Madrid will have jurisdiction, unless a mandatory rule of law provides otherwise.