Last updated: 28 March 2025

The clauses of this Controller to Controller Agreement (C2C Agreement) are supplemental to and incorporated by reference into, the Marketing Purchase Agreement or any other agreement (the Agreement) between Expedia (us) and Partner (you) referencing or otherwise incorporating this C2C Agreement. Terms that are not defined in this C2C Agreement shall have the meaning given to them in the Agreement.

14.1 Definitions: For the purposes of this C2C Agreement, appropriate technical and organizational measures, controller, personal data, personal data breach, process/processing/processed, processor and supervisory authority (or reasonably equivalent terms) shall each have the meaning given to them in Applicable Data Protection Law, and:

1. API End Customer Data means End Customer Data (other than Merchant of Record Data) submitted by you to the API that is processed by us;
2. Applicable Data Protection Law(s) means any applicable laws and regulations in any relevant jurisdiction relating to the use or processing of End Customer Data;
3. CBPR Country means a country that is a full or associate member of the CBPR System;
4. CBPR Party means an organization that holds a current certification under the CBPR System;
5. CBPR System means the Asia-Pacific Economic Cooperation Cross Border Privacy Rules System;
6. Current Audit Report means a current version of the PCI DSS attestation of compliance and the SSAE 16 Audit Report, or its industry standard successor, for our data center providers;
7. DPF means the EU-U.S. Data Privacy Framework and/or Swiss-U.S Data Privacy Framework  or any successor self-certification program operated by the U.S Department of Commerce and approved by the European Commission from time to time and which has not been invalidated (and in each case, includes the UK Extension to the EU-U.S. Data Privacy Framework and any other country extension to such framework that operates to extend the application of the EU-U.S. Data Privacy Framework to that country);
8. DPF Country means a country in the EEA, United Kingdom, Switzerland and any other countries or regions whose relevant authorities have agreed to extend the operation of the DPF to that country/region;
9. EEA means the European Economic Area;
10. End Customer Data means personal data of an End Customer processed pursuant to the Agreement;
11. Merchant of Record Data means End Customer Data submitted to us under Schedule 2 (API) of the Agreement to process a booking payment on behalf of an End Customer as Merchant of Record;
12. Permitted Purpose means in relation to Schedule 2 (API) of the Agreement, the purpose of (i) fulfilling Bookings; (ii) providing customer support for Bookings; (iii) using anonymized data to improve our services and user experience, including optimizing the booking experience for End Customers; (iv) generating reports for you, including commission statements and any further processing required for reconciliations, complaints handling and similar activities connected with servicing Schedule 2 (API) of the Agreement; (v) creating aggregated and anonymized reports for analytics, business intelligence and business reporting; (vi) fraud prevention; (vii) responding to law enforcement requests and tax audit requests; (viii) facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales); (ix) otherwise complying with our obligations under the Agreement, this C2C Agreement and/or applicable laws; and (x) for the determination, calculation, reporting of Travel Taxes and other applicable taxation purposes as may be required from time to time, and together these constitute the Permitted Purposes;
13. Restricted Transfer Country means a country located in the EEA, Switzerland, the United Kingdom, Brazil, Thailand and Saudi Arabia;
14. Restricted Transfer Data means End Customer Data relating to a Booking made via a point of sale intended by us to be accessed by individuals in a Restricted Transfer Country;
15. Standard Contractual Clauses/ SCCs means the approved European Commission’s Standard Contractual Clauses for the transfer of personal data from the European Union to third countries, as issued on 4 June 2021, as amended, replaced, supplemented, or superseded from time to time, and the full current version of which can be found following this link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
16. In the case of conflict or ambiguity between:
    1. any of the provisions of this C2C Agreement and the provisions of the Agreement, the provisions of this C2C Agreement will prevail to the extent of the subject matter of this C2C Agreement; and
    2. any of the provisions of this C2C Agreement and the SCCs incorporated by reference into them, the provisions of the executed SCCs will prevail.  
        

14.2   Relationship of the parties  

Each party will process Merchant of Record Data in the capacity of independent and autonomous controller.

14.3-14.9   INTENTIONALLY LEFT BLANK 

14.10  Our responsibilities

We (and our Group Members, where applicable) will:

1. only process Merchant of Record Data in connection with a Permitted Purpose;
2. not divulge the whole or any part of the Merchant of Record Data to any person, except in connection with a Permitted Purpose; and
3. cooperate with and provide reasonable assistance to you to assist you with your compliance with Applicable Data Protection Law in the course of your processing of Merchant of Record Data in connection with Schedule 2 (API) of the Agreement.

14.11  Data security and breaches

You and we in our respective capacities as controllers agree that we will:

1. maintain appropriate technical and organizational measures to protect Merchant of Record Data we each process against a personal data breach; and
2. in the event of a confirmed personal data breach within systems under that party’s possession or control, promptly notify the other party if the personal data breach both (i) affects Merchant of Record Data that is also processed by the other party under the Agreement; and (ii) is reportable to a supervisory authority, providing full details of the same. In such event, both parties shall cooperate reasonably and in good faith to remedy or mitigate the effects of the personal data breach, and the reasonable costs of such cooperation shall be borne by the party that suffered the personal data breach.

14.12  Cross-border data transfers

You and we agree and acknowledge that in this clause 14.12, wherever the word ‘transfer’ is used, it includes access being provided by one controller/processor to another controller/processor and:

1. General: neither you nor we shall (and shall not permit any other party to) transfer Merchant of Record Data outside the territory of origination unless that party takes any required compliance measures to enable such transfer legally in accordance with Applicable Data Protection Law.
2. Asia-Pacific Region and CBPR: 

   1. The parties agree and acknowledge that:

      1. a CBPR Party is bound by a legally enforceable set of obligations to provide comparable protection to Applicable Data Protections Laws; and
      2. Expedia is a CBPR Party.

      Where the Partner is also a CBPR Party, the provisions of this paragraph (b) will be construed to apply two-way.

   2. Subject to paragraph (iii) below, the parties agree that where:

      1. Merchant of Record Data is being transferred from one CBPR Country to another CBPR Country; and
      2. the data importer is a CBPR Party,

      then, to the extent that and for so long as the CBPR System is a recognized method of transfer by a relevant supervisory authority, the CBPR System shall be the agreed mechanism for cross-border transfers of Merchant of Record Data to such CBPR Party.

   3. The CBPR System will only apply for transfers that involve at least one of the parties being located in an Asia-Pacific Region country that is also a CBPR Country.

   4. Expedia confirms that it will provide at least the same level of protection for the Merchant of Record Data as is required under the CBPR System; and it will promptly notify the other party if it makes a determination that it can no longer provide this level of protection. In such event, or if the other party otherwise reasonably believes that Expedia is not protecting the Merchant of Record Data to the standard required under the CBPR System, the other party may either:

      1. instruct Expedia to take reasonable and appropriate steps to stop and remediate any unauthorized processing, in which event the Parties will promptly cooperate in good faith to identify, agree and implement such steps;
      2. agree on an alternate safeguard that may apply to the processing under Applicable Data Protection Law; or
      3. if (A) and (B) fail to resolve the issue, terminate this C2C Agreement and the Agreement (or, at the other Party’s election, any affected portion thereof) without penalty by giving notice to Expedia.

      If the other party also holds a current CBPR System certification, then the above provisions will be deemed to apply as if the obligations are two-way.

3. DPF: You and we agree that in respect of transfers of Restricted Transfer Data between you and us originating from a DPF Country to the United States or to a country which has not been deemed "adequate" under the Applicable Data Protection Laws of the originating Restricted Transfer Country:
   1. to the extent that and for so long as the DPF is a recognized method of transfer under Applicable Data Protection Law, the DPF shall be the agreed mechanism for cross-border transfers of data originating from a DPF Country to Expedia in the United States; and
   2. to the extent that and for so long as DPF is not a valid method of transfer (including for transfers of Restricted Transfer Data to a country which has not been deemed "adequate" under the Applicable Data Protection Laws of the originating Restricted Transfer Country), the SCCs shall apply to such transfers and we will enter into them on the basis set out in paragraph (h) below. Where you also hold a current the DPF certification, transfers of Restricted Transfer Data to you can similarly be made under the DPF with SCCs as a fallback mechanism as set out in this paragraph and all relevant paragraphs on the DPF will be construed to apply two-way. 
4. With regards to the DPF, we agree that we will provide the same level of protection as required by the DPF. If you reasonably believe we are not protecting Merchant of Record Data to the standard required by the DPF, we may either:
   1. rely on the SCCs as set out in paragraph (h) below;
   2. if SCCs are not a viable or appropriate solution, propose to you reasonable and appropriate steps to stop and remediate any unauthorized processing, which we will in good faith implement using commercially reasonable efforts; or
   3. if the fallbacks in paragraphs (i) or (ii) above are not viable, terminate this C2C Agreement and the Agreement without penalty. 
5. If you are certified under the DPF, you will comply with the Notice and Choice Principles of the DPF (as defined in the EU-U.S. DPF). For the avoidance of doubt, if you are not DPF certified or accessing or receiving the Merchant of Record Data in a country deemed ‘adequate’ by the European Commission, then the SCCs will be relied on for transfers of Restricted Transfer Data from us to you. 
6. You and we agree that we may each disclose this C2C Agreement and any relevant privacy provisions in the Agreement to the US Department of Commerce, the Federal Trade Commission, any European data protection authority, or any other US or EU judicial or regulatory body upon their request and that any such disclosure shall not be deemed a breach of confidentiality. 
7. Extension of SCCs to Non-Restricted Transfer Countries: In relation to transfers of Merchant of Record Data between you and us originating from a country that is not a Restricted Transfer Country but is otherwise subject to safeguards that, according to Applicable Data Protection Law, must be applied before a transfer can be made of that Merchant of Record Data outside of the country of origin (each a Non-Restricted Transfer Country), then you and we agree that:
   1. the SCCs set out in paragraph (h) below shall be deemed to extend to such additional transfers to the extent that such deemed extension would satisfy the safeguards of that particular country; and/or
   2. where the measures set out in paragraph (h) below are insufficient or require supplementary measures, the parties agree to take such further measures, including, for example, execution of relevant documents, collection of consent, making of required filings, as may be required from time to time in order to satisfy Applicable Data Protection Law.
8. SCCs. Subject to the preceding paragraphs of clause 14.12, you and we hereby agree to enter into the SCCs which are incorporated by reference on an unchanged basis save for the following selections:
   1. Where Partner is located inside the EEA or otherwise in a country deemed “adequate” in accordance with Article 45 of the GDPR, (Adequate Country) Module one (1) of the SCCs will apply one-way only in respect of transfers from you to us. Otherwise, Module one (1) applies two-way to cover transfers from both you to us and us to you.
   2. For the purposes of clause 11(a) of the SCCs, the optional language is deleted.
   3. For the purposes of clause 13 of the SCCs, the relevant paragraph is “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority”.
   4. For the purposes of clause 17 of the SCCs, the governing law is Ireland.
   5. For the purposes of clause 18(b) of the SCCs, the selection is Ireland.

   6. Restricted Transfer Data. A new clause 19 is added to the SCCs to cover transfers of personal data originating from the United Kingdom, Switzerland, Brazil, Saudi Arabia or Thailand to a country that is neither deemed adequate under the Applicable Data Protection Law of the originating country nor is otherwise exempt from requiring entry into standard contractual clauses as follows:

      “Clause 19

      UK, Swiss, Brazilian, Saudi and Thai Transfers 

      The parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover extra-territorial transfers that fall under the scope of the Reference Privacy Law (referred to in this Clause as a Reference transfer). For the purposes of such Reference transfers, the governing law shall be deemed to be the relevant Reference Governing Law, the choice of forum shall be the Reference Country, and the Reference Supervisory Authority shall be the competent supervisory authority. The parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Reference transfer as are deemed necessary by the Reference Supervisory Authority to comply with the Reference Privacy Laws, and the Clauses shall be interpreted in accordance with the requirements for Reference transfers arising under those laws or as otherwise set out in guidance issued by the Reference Supervisory Authority, without the parties having to enter into separate standard contractual clauses prepared specifically for their Reference transfers. The parties shall further do all such acts and things as may be necessary to ensure compliance with the Reference Privacy Laws when engaging in Reference transfers. 

      Country	Reference Privacy Law	Reference Transfer	Reference Governing Law	Reference Country	Reference Supervisory Authority
      United Kingdom	UK GDPR Data Protection Act 2018	UK Transfer	United Kingdom	United Kingdom	Information Commissioner’s Office (ICO)
      Switzerland	Federal Act of Data Protection (FAPD)	Swiss Transfer	Switzerland	Switzerland	Federal Data Protection and Information Commissioner (FDPIC)
      Brazil	Brazilian General Data Protection Law No. 13,709/18 (Lei Geral de Proteção de Dados)	Brazilian Transfer	Brazil	Brazil	Brazil’s National Data Protection Authority (ANPD)
      Saudi Arabia	Personal Data Protection Law (PDPL)	Saudi Transfer	Saudi Arabia	Saudi Arabia	Saudi Authority for Data and Artificial Intelligence (SDAIA)
      Thailand	Personal Data Protection Act B.E. 2562 (2019) (PDPA)	Thai Transfer	Thailand	Thailand	Personal Data Protection Committee (PDPC)

      and:

      1. All references to Reference Privacy Law means the reference laws as amended, supplemented or replaced from time to time.
      2. All references to a Reference Supervisory Authority means the referenced authority or any successor body to it.
      3. In relation to the United Kingdom, the provisions of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses shall apply as set out in the form attached as the Addendum.”

   7. Third country transfers. A new clause 20 is added to cover transfers of personal data from any other country not hitherto specified where the SCCs may be extended to ensure appropriate safeguards for transfers of personal data originating from that country to a party located outside of that country in accordance with paragraph (g) above as follows:

      “Clause 20

      Other third country transfers

      The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover cross-border transfers that fall under the scope of any other applicable laws and regulations in any relevant jurisdiction, relating to the use or processing of personal data (Applicable Data Protection Laws) requiring terms and protections broadly equivalent to these Clauses in order to transfer personal data from that country (referred to in this clause as the Third Country) to another (referred to in this Clause as a Third Country transfer). For the purposes of such Third Country transfers, the governing law shall be deemed to be the law of the Third Country, the choice of forum shall be the Third Country and the data protection authority or other relevant regulatory body of that country shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Third Country transfer as are deemed necessary by such supervisory authority to comply with the Applicable Data Protection Law of that Third Country, and the Clauses shall be interpreted in accordance with the requirements for Third Country transfers arising under those laws or as otherwise set out in guidance issued by the relevant supervisory authority, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Third Country transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the Applicable Data Protection Law(s) when engaging in Third Country transfers.”

9. In respect of the above SCCs, they will apply to the processing as follows:
   1. each party acting as a data exporter or data importer under the SCCs will be deemed to have entered into the SCCs in its own name and on its own behalf. 
   2. Annex 1 (SCCs Processing Overview) to this C2C Agreement constitutes Annex 1 of the SCCs. 
   3. Annex 2 (Technical and Organizational Measures) to this C2C Agreement constitutes Annex 2 of the SCCs and applies only to Expedia where (a) only one-way SCCs apply for transfers of Restricted Transfer Data from you to use; or (b) Partner has provided, and Expedia has accepted, adequate technical and organizational measures to satisfy Partner’s Annex 2 requirements of the SCCs. Where the aforementioned conditions are not met, Annex 2 will be construed to apply to both parties and all references to Expedia and Expedia Group will be construed to reference either party accordingly.  
   4. the Addendum to this C2C Agreement constitutes the UK Addendum for the purposes of the SCCs.
   5. if there is any conflict between any clause of this Agreement and the SCCs, the SCCs will prevail.

14.13 PCI

You warrant and represent that you shall:

1. only obtain, use, transmit and store End Customer cardholder data to the extent required to comply with your obligations under the Agreement and this C2C Agreement; 
2. where you obtain, use, transmit, store or process End Customer’s cardholder data, you shall comply with the PCI DSS as issued by the PCI Security Standards Council, as updated from time to time; 
3. provide us with a copy of your annual certification of compliance; and 
4. promptly notify us of any breach of the PCI DSS or any personal data breach affecting End Customer cardholder data.  

14.14 We acknowledge that we are responsible for the security of cardholder data that we possess, store, process, or transmit and shall comply with the PCI DSS as issued by the PCI Security Standards Council, as updated from time to time. We shall provide you with a copy of our annual certificate of compliance upon request.

14.15 Notices

Any notices under this C2C Agreement will be deemed effective if delivered by email to the contact(s) provided by either party to the other for these purposes in accordance with the notice provisions in the Agreement. In the case of Expedia, this will require an email being sent to the account/relationship manager from time to time and copied to the Expedia privacy mailbox provided from time to time. 

ANNEX I – SCCs PROCESSING OVERVIEW

MODULE ONE (1), Part One (1): Controller to Controller (you to us)

A. LIST OF PARTIES

Data exporter(s):

Data importer(s):

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Irish Data Protection Authority 

MODULE ONE (1): Part Two (2): Controller to Controller (us to you)

A. LIST OF PARTIES

Data exporter(s):

The Party/ies identified as Data Importers in Module one (1), Part one (1) (you to us) above. See Module one (1), Part one (1) for further details.

Data importer(s):

The Party/ies identified as Data Exporter(s) in Module one (1), Part one (1) (you to us) above. See Module one (1), Part one (1) for further details.

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

As per Module one (1), Part one (1)

ANNEX II - TECHNICAL AND ORGANIZATIONAL MEASURES

The technical and organizational measures that apply to us/Expedia for the purposes of Module one (1), Part one (1) are set out below. These will also apply to Partner in accordance with the C2C Agreement in circumstances where Partner is connecting into Expedia’s systems or is a Data Importer under the SCCs for any relevant transfer of personal data and Partner has not provided an alternative set of measures that have been accepted by Expedia.

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Addendum)

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1 Tables

Part 2: Mandatory Clauses

Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.