Travel Agent Affiliate Program (TAAP)

TAAP Privacy Terms – Controller to Controller Agreement (including the SCCs)

Schedule 4 (TAAP)

The original English version of this C2C Agreement may have been translated into other languages. In the event of an inconsistency or discrepancy between the English version and any other language version of this Agreement, the English language version shall prevail.

SCOPE: Where each of Expedia and you are processing personal data as part of an agreement (which may be in the form of online clickwrap terms) entered into with the other party (pursuant to which you have been appointed as a marketing partner under TAAP, and all relevant activities connected to such activity referred to herein as the “Relevant Activities”), then this global controller to controller agreement (“C2C Agreement”) is supplemental to and applies to such agreement entered into between the parties in connection with the Relevant Activities (the “Agreement”), and sets out additional terms, requirements and conditions on which Expedia and you will each process personal data in connection with the Agreement. In this C2C Agreement, “Expedia”, “we” and “us” refers to Expedia, Inc. and/or any other Expedia Group company/ies party to the Agreement. “You” refers to the named entity stated on the Application as described in the Agreement (and all references to either Expedia or you will be construed as plural terms to the extent required by the Agreement).

1. DEFINITIONS AND INTERPRETATION

1.1 This C2C Agreement is subject to the terms of the Agreement and is incorporated into the Agreement. Interpretations and defined terms set out in the Agreement apply to the interpretation of this C2C Agreement unless otherwise defined in this C2C Agreement; and:

each of appropriate technical and organizational measures, controller, personal data, personal data breach, process/processing, and supervisory authority (or reasonably equivalent terms) shall have the meaning given to them in Applicable Data Protection Law;
Applicable Data Protection Law(s) means any applicable laws and regulations in any relevant jurisdiction, relating to the use or processing of personal data;
CBPR Country means a country that is a full or associate member of the CBPR System;
CBPR Party means an organization that holds a current certification under the CBPR System;
CBPR System means the Global Cross Border Privacy Rules System established by the Global CBPR Forum;
Permitted Purpose means the purpose of (i) fulfilling Bookings; (ii) providing support for Bookings; (iii) TAAP registration and account administration; (iv) payment of Commission and other amounts pursuant to the Agreement; (v) generating reports for you and any further processing required for reconciliation, complaints handling and similar activities connected with servicing the Agreement (vi) TAAP Account support; (vii) communications to TAAP Members and Sub-Users; (viii) facilitating any additional services or add-ons that we may make available to you but only where you have elected to enable such service or add-on; (ix) improving our services, including the underlying technology and optimizing end to end process, including the booking or servicing experience or any other optional service or add-on that we offer and you elect to use; (x) creating reports for analytics, business intelligence and business reporting; (xi) fraud prevention; (xii) responding to law enforcement requests and tax authority audit requests; (xiii) facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales); and (xiv) otherwise complying with our obligations under the Agreement, Expedia’s privacy policy and applicable laws and (xv) for the determination, calculation, reporting of Travel Taxes and other applicable taxation purposes as may be required from time to time;
DPF means the EU-US Data Privacy Framework and/or Swiss-US Data Privacy Framework or any successor self-certification program operated by the US Department of Commerce and approved by the European Commission from time to time and which has not been invalidated (and in each case, includes the UK Extension to the EU-US Data Privacy Framework and any other country extension to such framework that operates to extend the application of the EU-US Data Privacy Framework to that country);
DPF Country means a country in the EEA, United Kingdom, Switzerland and any other countries or regions whose relevant authorities have agreed to extend the operation of the DPF to that country/region;
EEA means the European Economic Area;
Restricted Transfer Country means any country in the European Economic Area, Switzerland, the United Kingdom, Brazil, Thailand and Saudi Arabia;
Restricted Transfer Data means TAAP Personal Data relating to a Booking made via a point of sale intended by us to be accessed by individuals in a Restricted Transfer Country;
Standard Contractual Clauses/SCCs means the approved European Commission’s Standard Contractual Clauses for the transfer of personal data from the European Union to third countries, as issued on 4 June 2021, as amended, replaced, supplemented, or superseded from time to time, and the full current version of which can be found following this link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en; and
TAAP Personal Data means personal data provided to us by you via the TAAP Website or otherwise processed in connection with TAAP itself or facilitating Bookings made using the TAAP Website.

RELATIONSHIP OF THE PARTIES

1.2 You and we shall each collect and process personal data to fulfil our respective rights and obligations under the Agreement, as well as your and our respective responsibilities under applicable laws. As such, each of the parties shall: (i) process personal data as independent and autonomous controllers; (ii) comply with Applicable Data Protection Law; and (iii) be responsible for any of its acts or omissions in breach of Applicable Data Protection Law.

YOUR RESPONSIBILITIES

1.3 You must in particular:

satisfy a legal basis in order to make available any TAAP Personal Data provided by you to us to process for the Permitted Purposes;
ensure that End Customers are made aware, via your privacy policy and by any other appropriate means, that their personal data will be shared with us for the Permitted Purposes;
direct End Customers to our privacy policy for more information about our handling of their personal data;
cooperate with and provide reasonable assistance to us to assist us with our compliance with Applicable Data Protection laws in the course of our processing of TAAP Personal Data in connection with the Agreement; and
satisfy a legal basis to send any marketing communications to Customers.

OUR RESPONSIBILITIES

1.4 We (and our Group Members, where applicable) shall:

only process TAAP Personal Data in connection with a Permitted Purpose;
not divulge the whole or any part of the TAAP Personal Data to any person, except in connection with a Permitted Purpose;
cooperate with and provide reasonable assistance to you to assist you with your compliance with Applicable Data Protection Laws in the course of your Processing of TAAP Personal Data in connection with the Agreement; and
display and comply with our lawful and up-to-date cookie notice (if required) and our privacy policy on the TAAP Website.

CUSTOMERS AND THIRD PARTIES

1.5 You acknowledge that we:

may send emails to End Customers relating to Bookings;
may transfer TAAP Personal Data (including banking data) to our third-party service providers for the purposes of:
1. administering, managing and supporting you and your Representatives and Sub-Users’ TAAP Accounts;
2. providing support for Bookings; and
3. paying Commission and other amounts pursuant to the Agreement.

DATA SECURITY AND BREACHES

1.6 You and we, in our respective capacity as controllers, agree that we will:

maintain appropriate technical and organizational measures to protect the TAAP Personal Data you and we each process against a personal data breach; and
in the event of a confirmed personal data breach within systems under that party’s possession or control, promptly notify the other party if the personal data breach both (i) affects TAAP Personal Data that is also processed by the other party under the Agreement; and (ii) is reportable to a supervisory authority, providing full details of the same. In such event, both parties shall cooperate reasonably and in good faith to remedy or mitigate the effects of the personal data breach, and the reasonable costs of such cooperation shall be borne by the party that suffered the personal data breach.

CROSS-BORDER DATA TRANSFERS

1.7 Cross-border data transfers.: The Parties agree and acknowledge that in this clause 1.7, wherever the word ‘transfer’ is used, it includes access being provided by one controller/processor to another controller/processor and:

General: Neither Party will (and shall not permit any other party to) transfer TAAP Personal Data outside the territory of origination unless that Party takes any required compliance measures to enable such transfer legally in accordance with Applicable Data Protection Law.
Asia-Pacific Region and CBPR:
1. The Parties agree and acknowledge that:
  1. a CBPR Party is bound by a legally enforceable set of obligations to provide comparable protection to Applicable Data Protection Laws; and
  2. Expedia is a CBPR Party.
  Where the Partner is also a CBPR Party, the provisions of this paragraph (b) will be construed to apply two-way.
2. Subject to paragraph (iii) below, the Parties agree that where:
  1. TAAP Personal Data is being transferred from one CBPR Country to another CBPR Country; and
  2. the data importer is a CBPR Party,
3. then, to the extent that and for so long as the CBPR System is a recognized method of transfer by a relevant supervisory authority, the CBPR System shall be the agreed mechanism for cross-border transfers of TAAP Personal Data to such CBPR Party.
4. The CBPR System will only apply for transfers that involve at least one of the Parties being located in an Asia-Pacific Region country that is also a CBPR Country.
5. Expedia confirms that it will provide at least the same level of protection for the TAAP Personal Data as is required under the CBPR System; and it will promptly notify the other Party if it makes a determination that it can no longer provide this level of protection. In such event, or if the other Party otherwise reasonably believes that Expedia is not protecting the TAAP Personal Data to the standard required under the CBPR System, the other Party may either:
  1. instruct Expedia to take reasonable and appropriate steps to stop and remediate any unauthorized processing, in which event the Parties will promptly cooperate in good faith to identify, agree and implement such steps;
  2. agree on an alternate safeguard that may apply to the processing under Applicable Data Protection Law; or
  3. if (A) and (B) fail to resolve the issue, terminate this C2C Agreement and the Agreement (or, at the other Party’s election, any affected portion thereof) without penalty by giving notice to Expedia.
6. If the other Party also holds a current CBPR System certification, then the above provisions will be deemed to apply as if the obligations are two-way.
DPF: The Parties agree that in respect of transfers of Restricted Transfer Data between the Parties to the United States or to a country which has not been deemed "adequate" under the Applicable Data Protection Laws of the originating Restricted Transfer Country:
1. to the extent that and for so long as the DPF is a recognized method of transfer by a relevant authority, the DPF shall be the agreed mechanism for cross-border transfers of data originating from a Restricted Transfer Country to Expedia in the United States; and
2. to the extent that and for so long as the DPF is not a valid method of transfer (including for transfers of Restricted Transfer Data to a country which has not been deemed "adequate" under the Applicable Data Protection Law of the originating Restricted Transfer Country),
  
  the SCCs shall apply to such transfers and we will enter into them on the basis set out in paragraph (h) below. Where Company also holds a current DPF certification, transfers of Restricted Transfer Data to Company can similarly be made under the DPF with SCCs as a fallback mechanism as set out in this paragraph and all relevant paragraphs on the DPF will be construed to apply two-way.
With regards to the DPF, we agree that we will provide the same level of protection as required by the DPF. If you reasonably believe we are not protecting the Restricted Transfer Data to the standard required by the DPF, we may either:
1. rely on the SCCs as set out in paragraph (h) below;
2. if SCCs are not a viable or appropriate solution, propose to you reasonable and appropriate steps to stop and remediate any unauthorized processing, which we will in good faith implement using commercially reasonable efforts; or
3. if the fallbacks in paragraphs (i) or (ii) above are not viable, terminate this C2C Agreement and the Agreement without penalty.
If you are certified under the DPF, you will comply with the Notice and Choice Principles of the DPF (as defined in the EU-US DPF). For the avoidance of doubt, if you are not DPF-certified or accessing or receiving the Restricted Transfer Data in a country deemed ‘adequate’ by the European Commission, then the SCCs will be relied on for transfers of Restricted Transfer Data from us to you.
The Parties agree that they may each disclose this C2C Agreement and any relevant privacy provisions in the Agreement to the US Department of Commerce, the Federal Trade Commission, any European data protection authority, or any other US or EU judicial or regulatory body upon their request and that any such disclosure shall not be deemed a breach of confidentiality.
Extension of SCCs to Non-Restricted Transfer Countries: In relation to transfers of TAAP Personal Data between the Parties originating from a country that is not a Restricted Transfer Country but is otherwise subject to safeguards that, according to Applicable Data Protection Law, must be applied before a transfer can be made of that TAAP Personal Data outside of the country of origin (each a Non-Restricted Transfer Country ), then the Parties agree that:
1. the SCCs set out in paragraph (h) below shall be deemed to extend to such additional transfers to the extent that such deemed extension would satisfy the safeguards of that particular country; and/or
2. where the measures set out in paragraph (h) below are insufficient or require supplementary measures, the parties agree to take such further measures, including, for example, execution of relevant documents, collection of consent, making of required filings, as may be required from time to time in order to satisfy Applicable Data Protection Law.

SCCs: Subject to the preceding paragraphs of clause 1.7, the Parties hereby agree to enter into the SCCs which are incorporated by reference into the Agreement on an unchanged basis save for the following selections:

Where Partner is located inside the EEA or otherwise in a country deemed “adequate” in accordance with Article 45 of the GDPR, (Adequate Country) Module one (1) of the SCCs will apply one-way only in respect of transfers from you to us. Otherwise, Module one (1) applies two-way to cover transfers from both you to us and us to you.
For the purposes of clause 11(a) of the SCCs, the optional language is deleted.
For the purposes of clause 13 of the SCCs, the relevant paragraph is “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority”.
For the purposes of clause 17 of the SCCs, the governing law is Ireland.
For the purposes of clause 18(b) of the SCCs, the selection is Ireland.

Restricted Transfer Data. A new clause 19 is added to the SCCs to cover transfers of personal data originating from the United Kingdom, Switzerland, Brazil, Saudi Arabia or Thailand to a country that is neither deemed adequate under the Applicable Data Protection Law of the originating country nor is otherwise exempt from requiring entry into standard contractual clauses as follows:

“Clause 19

UK, Swiss, Brazilian, Saudi and Thai Transfers

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover extra-territorial transfers that fall under the scope of the Reference Privacy Law (referred to in this Clause as a Reference Transfer). For the purposes of such Reference Transfers, the governing law shall be deemed to be the relevant Reference Governing Law, the choice of forum shall be the Reference Country, and the Reference Supervisory Authority shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Reference Transfer as are deemed necessary by the Reference Supervisory Authority to comply with the Reference Privacy Laws, and the Clauses shall be interpreted in accordance with the requirements for Reference Transfers arising under those laws or as otherwise set out in guidance issued by the Reference Supervisory Authority, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Reference Transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the Reference Privacy Laws when engaging in Reference Transfers.

Country	Reference Privacy Law	Reference Transfer	Reference Governing Law	Reference Country	Reference Supervisory Authority
United Kingdom	UK GDPR and Data Protection Act 2018	UK Transfer	United Kingdom	United Kingdom	Information Commissioner's Office (ICO)
Switzerland	Federal Act of Data Protection (FADP)	Swiss Transfer	Switzerland	Switzerland	Federal Data Protection and Information Commissioner (FDPIC)
Brazil	Brazilian General Data Protection Law No. 13,709/18 (Lei Geral de Proteção de Dados)	Brazilian Transfer	Brazil	Brazil	Brazil's National Data Protection Authority (ANDP)
Saudi Arabia	Personal Data Protection Law (PDPL)	Saudi Transfer	Saudi Arabia	Saudi Arabia	Saudi Authority for Data and Artificial Intelligence (SDAIA)
Thailand	Personal Data Protection Act B.E. 2562 (2019) (PDPA)	Thai Transfer	Thailand	Thailand	Personal Data Protection Committee (PDPC)

All references to Reference Privacy Law mean the reference laws as amended, supplemented or replaced from time to time.
All references to a Reference Supervisory Authority mean the referenced authority or any successor body to it.
In relation to the United Kingdom, the provisions of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses shall apply as set out in the form attached as the Addendum.”
Third country transfers: A new clause 20 is added to cover transfers of personal data from any other country not hitherto specified where the SCCs may be extended to ensure appropriate safeguards for transfers of personal data originating from that country to a party located outside of that country as follows:
Is a new clause and will need to be formatted to conform with the previous entries in the same list.

“Clause 20
Other third country transfers
The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover cross-border transfers that fall under the scope of any other applicable laws and regulations in any relevant jurisdiction, relating to the use or processing of personal data (Applicable Data Protection Laws ) requiring terms and protections broadly equivalent to these Clauses in order to transfer personal data from that country (referred to in this clause as the Third Country) to another (referred to in this Clause as a Third Country transfer). For the purposes of such Third Country transfers, the governing law shall be deemed to be the laws of the Third Country, the choice of forum shall be the Third Country and the data protection authority or other relevant regulatory body of that country shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Third Country transfer as are deemed necessary by such supervisory authority to comply with the Applicable Data Protection Law of that Third Country, and the Clauses shall be interpreted in accordance with the requirements for Third Country transfers arising under those laws or as otherwise set out in guidance issued by the relevant supervisory authority, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Third Country transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the Applicable Data Protection Law(s) when engaging in Third Country transfers.”
1. In respect of the above SCCs, they will apply to the processing as follows:
  1. each party acting as a data exporter or data importer under the SCCs will be deemed to have entered into the SCCs in its own name and on its own behalf.
  2. Annex 1 (SCCs Processing Overview) to this C2C Agreement constitutes Annex 1 of the SCCs.
  3. Annex 2 (Technical and Organizational Measures) to this C2C Agreement constitutes Annex 2 of the SCCs and applies only to Expedia where (a) only one-way SCCs apply for transfers of Restricted Transfer Data from you to us; or (b) Partner has provided, and Expedia has accepted, adequate technical and organizational measures to satisfy Partner's Annex 2 requirements of the SCCs. Where the aforementioned conditions are not met, Annex 2 will be construed to apply to both parties and all references to Expedia and Expedia Group will be construed to reference either party accordingly.
  4. the Addendum to this C2C Agreement constitutes the UK Addendum for the purposes of the SCCs.
  5. if there is any conflict between any clause of this Agreement and the SCCs, the SCCs will prevail.

1.8 PCI.

You warrant and represent that you shall:

only obtain, use, transmit and store End Customer cardholder data to the extent required to comply with your obligations under the Agreement and this C2C Agreement;
where you obtain, use, transmit, store or process End Customer's cardholder data, you shall comply with the PCI DSS as issued by the PCI Security Standards Council, as updated from time to time;
provide us with a copy of your annual certification of compliance; and
promptly notify us of any breach of the PCI DSS or any personal data breach affecting End Customer cardholder data.

We acknowledge that we are responsible for the security of cardholder data that we possess, store, process, or transmit and shall comply with the PCI DSS as issued by the PCI Security Standards Council, as updated from time to time. We shall provide you with a copy of our annual certificate of compliance upon request.

1.9 Notices.

Any notices under this C2C Agreement will be deemed effective if delivered by email to the contact(s) provided by either party to the other for these purposes in accordance with the notice provisions in the Agreement. In the case of Expedia, this will require an email being sent to the account/relationship manager from time to time and copied to the Expedia privacy mailbox provided from time to time.

ANNEX I – SCCs PROCESSING OVERVIEW

MODULE ONE: Controller to Controller (you to us)

A. LIST OF PARTIES

Data exporter(s):

Party	The party/ies identified as “you”, TAAP Member or equivalent term
Address	As specified in the Agreement
Contact name, position & contact details for all Expedia Group parties	Effective Notice is deemed made when an email is sent to the account/relationship manager using email address provided to Expedia from time to time
Activities relevant to data transferred under SCCs	Relevant Activities, being: Bookings made via the TAAP Website made available by us to you under the Agreement and connected activities in accordance with the Agreement and the C2C Agreement For the Permitted Purposes in accordance with the Agreement and the C2C Agreement Additional services upon request, including marketing/communication services, single sign on services, partner loyalty scheme integration and sponsored listings
Role	Controller

Data importer(s):

Party	The non-EU parties identified as “us” or “Expedia” in the Agreement
Address	As specified in the Agreement
Contact person’s name, position and contact details	Effective notice is deemed made when an email is sent to both (1) account/relationship manager; and (2) the Expedia privacy mailbox, in each case using email address(es) provided to Partner from time to time
Activities relevant to the data transferred under these Clauses	Bookings made via the TAAP Website made available by us to you in accordance with the Agreement
Role	Controller

B. DESCRIPTION OF TRANSFER

Categories of data subject	TAAP Members and their Sub-Users
Categories of Personal Data	Host Agency / Managing Account: Identification data: Agency Trade Name Travel Accreditation Type (IATA/ARC/CLIA/True ID/Other) and Number Registered Company Number Contact details: Agency Website URL (required in Canada and Italy; optional elsewhere) Address (Street, City, State/Province, Zip/Postal Code, Country) Agency Phone Number Fax Number (required only in Japan) Financial data: Name on Bank Account Bank account number Bank details Payment card details Tax ID Individual Agents/ Sub-Users: Identification data: Agent’s first and last name Agency Trade Name (the agent’s own agency, if applicable) Host Agency Name (the agency the agent is affiliating with) Agency Trade Name Travel Accreditation Type (IATA/ARC/CLIA/True ID/Other) and Number Registered Company Number Contact details: Address (Street, City, State/Province, Zip/Postal Code, Country) Agency Phone Number Travel information: Booking history and travel preferences Lodging and travel information to facilitate pick-ups or transportation, including End Customer hotel, arrival and departure information (date, time, method, and drop-off and pick-up locations). Other information (as requested by, and agreed with, the TAAP Member, including without limitation personal data required in connection with): Reporting, monitoring and analytics (including commission and booking data) Single sign on, loyalty schemes Correspondence
Sensitive Data	None, unless it is voluntarily provided by an individual to meet their accessibility needs for travel.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).	Continuous or ad hoc basis in accordance with the needs of TAAP Member’s business
Nature of the processing	All processing operations required to facilitate purposes set out below
Purpose(s) of the data transfer and further processing	Permitted Purposes, as defined in the Agreement
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period	In accordance with the retention policy of Expedia Group, provided that to the extent that any TAAP Personal Data is retained beyond the termination of the Agreement for back up or legal reasons, Expedia will continue to protect such personal data in accordance with the Agreement
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing	https://support.expediapartnersolutions.com/hc/en-us/articles/360000986389-EPS-Data-Services-Vendor-List as updated from time to time.
Categories of data subject	Customers
Categories of Personal Data	Identification data: First and last names Frequent flyer program and number (flights) TSA number (USA only) Contact details: Email address Telephone numbers (fixed and mobile) Date of birth (for flights) Nationality (from passport) Financial details: Payment card details Tax ID (Brazil POSa only)
Sensitive Data	None, unless it is voluntarily provided by an individual to meet their accessibility needs for travel.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).	Continuous or ad hoc basis in accordance with the needs of TAAP Member’s business
Nature of the processing	All processing operations required to facilitate purposes set out below
Purpose(s) of the data transfer and further processing	Permitted Purposes, as defined in the Agreement
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period	In accordance with the retention policy of Expedia Group, provided that to the extent that any TAAP Personal Data is retained beyond the termination of the Agreement for back up or legal reasons, Expedia will continue to protect such personal data in accordance with the Agreement
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing	https://support.expediapartnersolutions.com/hc/en-us/articles/360000986389-EPS-Data-Services-Vendor-List as updated from time to time

C. COMPETENT SUPERVISORY AUTHORITY

Irish Data Protection Authority

MODULE ONE: Controller to Controller (us to you)

A. LIST OF PARTIES

Data exporter(s):

The Party/ies identified as Data Importers in Module one (1) (you to us) above. See above for further details.

Data importer(s):

The Party/ies identified as Data Exporter(s) in Module one (1) (you to us) above. See above for further details.

B. DESCRIPTION OF TRANSFER

Categories of data subject Categories of Personal Data Sensitive Data	As per Module one (1)
Frequency of transfer Nature of processing Purposes	As per Module one (1)
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period	In accordance with the retention policy of TAAP Member
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing	Not applicable

C. COMPETENT SUPERVISORY AUTHORITY

As per Module one (1)

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES

The technical and organizational measures that apply to us/Expedia for the purposes of Annex one (1) Part one (1) are set out below. These will also apply to Partner in accordance with the C2C Agreement in circumstances where Partner is a Data Importer under the SCCs for any relevant transfer of personal data and Partner has not provided an alternative set of measures that have been accepted by Expedia.

SUBJECT	MEASURE
Measures of pseudonymisation and encryption of personal data	Expedia Group supports industry standard encryption protocols for data transmission based on Expedia Group’s Information Classification and Handling Standard. Data handling requirements are based on a categorical basis. Depending on the data being handled, different security requirements are in place across Expedia Group. For example, credit card data is considered Highly Sensitive and required to be encrypted both in transit and at rest. Personal data of the customer (and its employees) is pseudonymized (and anonymized) by Expedia Group when possible and as required according to EG’s Information, Classification and Handling Standards. Credit card numbers are tokenized/pseudonymized to eliminate processing of cleartext credit card numbers. Expedia Group utilizes encrypted connections through VPN, SSL, etc. and utilizes multi-factor authentication mechanisms.
Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services	Expedia Group maintains responsibilities and procedures for the management and operation of all information processing facilities to ensure complete, valid and accurate processing of data. The monitoring of key processing facilities is in place, with a robust SOX program where controls over data processing and integrity are tested and attested to on an ongoing basis. Industry standard logging and monitoring is in place on EG’s systems to ensure and protect against unauthorized access, modification and/or deletion. Expedia Group maintains service resilience through redundant architecture, data replication, and integrity checking.
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident	Expedia Group’s systems are specifically designed to impede or prevent common attacks and ensure availability for operation, monitoring and maintenance. For this purpose, Expedia Group regularly carries out simulated tests and audits to confirm that its systems maintain availability. Servers are patched against Expedia Group’s robust patching policy and protected by industry standard AV/AM programs. Additionally, vulnerability assessments, thorough testing, and network reviews are conducted to ensure EG’s systems are maintained. Availability and reliability monitoring is in place to ensure Expedia sites remain online, with minimal interruptions of service. Expedia Group maintains a Disaster Recovery Plan that accounts for emergencies and contingency plans to ensure that customer services are uninterrupted according to severity and are tested regularly to ensure viability.
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing	Expedia Group’s technical and organizational measures are audited annually by external assessors as well as through robust internal testing. · EG conducts annual PCI assessments utilizing a third-party assessor and ensures ongoing compliance with PCI. EG’s comprehensive internal testing function is comprised of quarterly vulnerability testing, internal and external penetration testing, network, system and firewall scanning and reviews. Additionally, an internal audit department conducts annual risk assessments to prioritize operational audits.
Measures for user identification and authorisation Measures for the protection of data during transmission Measures for the protection of data during storage	Expedia Group systems are aligned with industry best practices and have in place communication practices such as time-out sessions, lock-out protocols, and robust password and authentication controls. Expedia Group maintains requirements for account provisioning and oversight to prevent unauthorized access or misuse of Expedia Group information and uses industry best practices as required, such as the Least Privilege Access principle, unique ID’s and multi factor authentication for strong authentication purposes.
Measures for ensuring physical security of locations at which personal data are processed	A Security Operations Center provides 24x7 coverage, with a formal incident response plan reviewed and tested at least annually. All systems are regularly controlled and tested by external service providers. Each Expedia Group customer receives their own customer ID. All datasets of the respective customer are stored under this ID and all customer data is logically segregated. Due to administration rights and database structures, the customer can only access datasets which are assigned to that user ID and data centers/AWS controls. Only persons who are expressly authorized by Expedia and have a ‘need to know’ have access to personal data. Controls and monitoring are in place to ensure least privileged access and unauthorized access attempts to the system.
Measures for ensuring events logging	Expedia Group maintains robust logging and monitoring requirements to account for the who, what, where, when, target, source, and success/failure of the logged event.
Measures for ensuring system configuration, including default configuration Measures for internal IT and IT security governance and management Measures for certification/assurance of processes and products	Expedia Group’s (EG) Information Security program is aligned with industry frameworks and standards, working through its risk management program to ensure a robust and comprehensive security posture. Expedia Group maintains secure operational processes to support the security, availability, integrity and confidentiality of the environment and customers’ data. Expedia Group’s build standards only enable system components, services, and protocols that serve a business requirement. Operating Systems, databases, and off-the-shelf applications must be: discoverable to satisfy legal and regulatory audit requirements; support configuration management tools, or deploy configuration management that successfully enforces security controls; enable encryption for all remote administrative access to a system; and display proper use of the system and/or that the system is being monitored to detect improper use and other illicit activity. There is no expectation of privacy while using the system. Expedia Group takes a layered / defence-in-depth strategy to security. Critical capabilities and controls are in place across the enterprise (e.g.: anti-malware, WAF, network segmentation, DLP, etc.), utilizing a suite of policies, operations and technologies to ensure the environment is monitored through a central security organization and alerts responded to accordingly. Expedia's systems are hosted on Amazon Web Services (AWS) and in Data Centers that provide Expedia Group with annual SOC 2 reports to ensure compliance.
Measures for ensuring data minimisation Measures for ensuring data quality Measures for ensuring limited data retention Measures for ensuring accountability	Minimisation: Expedia Group ensures only minimum amount of data is collected, processed and stored.   We only use identifiable format where necessary. Retention: The Expedia Group data retention policy sets out different retention periods and backups depending on the category of data, including any legal obligation or other exemption which requires such data to be retained until certain legal obligations, such as tax and accounting purposes, have been extinguished. Quality: Expedia Group has a formalized, quality management program, the Customer Experience Management (CEM) program. We are always striving for improvement within EG’s environment and seeking to streamline processes for higher efficiencies resulting in consistent, high-quality services and interactions with our partners, clients and travelers. Accountability: Expedia Group ensure accountability oversight with consistent implementation of policies, industry regulations/frameworks and legal requirements by maintaining a formalized Governance program, and Legal/Privacy body.
Measures for allowing data portability and ensuring erasure	Expedia Group is directly responsible for ensuring compliance with data protection laws (including in relation to requests from data subjects). Expedia Group responds to all subject requests, including Access, deletion and portability in accordance with applicable data protection law. EG’s data retention policy sets out different retention periods and backups depending on the category of data, including any legal obligation or other exemption which requires such data to be retained until certain legal obligations, such as tax and accounting purposes, have been extinguished. In the event that Expedia Group is unable to destroy Personal Data, Expedia Group shall continue to extend relevant protections of the Agreement between the parties governing such personal data and terminate any further processing.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter	Expedia Group conducts due diligence into the information security practices of its vendors and requires vendors to meet comprehensive security requirements, including obligations requiring vendors to have in place and maintain appropriate technical and organisational measures. Expedia Group has formalised a detailed Security Impact Assessment (“SIA”) process. All new vendors accessing data are screened prior to engagement and during the term where necessary. Additionally, Expedia Group also has robust vendor processor terms that are imposed on all vendors, ensuring the flow down of obligations to any of their sub-processors.

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Addendum)

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract. This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1 Tables

Table 1: Parties
Start Date	The Date of the SCCs to which these are attached (EU SCCs).
Parties Key Contact	Exporter: As per EU SCCs.	Importer: As per EU SCCs.
Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCCs	The version of the Approved EU SCCs which this Addendum is appended to.
Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
Annex IA: List of Parties Annex 1B Description of Transfer Annex II: Technical and organisational measures	As per EU SCCs
Table 4: Ending this Addendum when the Approved Addendum changes
Which Parties may end this Addendum as set out in Section 19	Neither Party

Part 3: Mandatory Clauses

Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

TAAP Privacy Terms – Controller to Controller Agreement (including the SCCs)

Schedule 4 (TAAP)

RELATIONSHIP OF THE PARTIES

YOUR RESPONSIBILITIES

OUR RESPONSIBILITIES

CUSTOMERS AND THIRD PARTIES

DATA SECURITY AND BREACHES

CROSS-BORDER DATA TRANSFERS

UK, Swiss, Brazilian, Saudi and Thai Transfers

Other third country transfers

ANNEX I – SCCs PROCESSING OVERVIEW

MODULE ONE: Controller to Controller (you to us)

A. LIST OF PARTIES

A. LIST OF PARTIES

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Last Update Date: March 31, 2026