Last updated: 1 June 2024

Scope: Where (a) Supplier is using a New Distribution Capability (NDC) exclusively or in combination with a global distribution system (GDS) to distribute data to Expedia; and (b) Expedia and Supplier are processing personal data in connection with providing or receiving services or promoting or marketing (or remarketing) the services, products or supply of the other party (in each case, as such activities or services are further described under the relevant agreement entered into between the parties (the “Agreement”), herein collectively referred to as “Relevant Activities”), this global controller to controller agreement (“C2C Agreement”) is supplemental to and applies to such Agreement, and sets out additional terms, requirements and conditions on which Expedia and Supplier will each process personal data in connection with the Agreement. In this C2C Agreement, “Expedia” refers to Expedia, Inc. and/or any other Expedia group company/ies party to the Agreement. “Supplier” refers to one or more third-party vehicle rental suppliers that contract with Expedia for Relevant Activities (and all references to either Expedia or Supplier will be construed as plural terms to the extent required by the Agreement).

1. DEFINITIONS AND INTERPRETATION

1.1 This C2C Agreement is subject to the terms of the Agreement and is incorporated into the Agreement. Interpretations and defined terms set forth in the Agreement apply to the interpretation of this C2C Agreement unless otherwise defined herein; and:

1. “appropriate technical and organizational measures“, “controller”, “personal data”, “process”, “processor“, “personal data breach” and “supervisory authority” or their equivalent terms each have the meaning given to them in Applicable Data Protection Law(s).
2. “Applicable Data Protection Law(s)” means any applicable laws and regulations in any relevant jurisdiction relating to the use or processing of Relevant Personal Data.
3. “CBPR Country” means a country that is a full or associate member of the CBPR System.
4. “CBPR Party” means an organization that holds a current certification under the CBPR System.
5. “CBPR System” means the Asia-Pacific Economic Cooperation Cross Border Privacy Rules System.
6. "Customers" means an individual whose personal data is processed by a Party in connection with the Agreement. 

7. “DPF” means the EU-U.S. Data Privacy Framework and/or Swiss-U.S Data Privacy Framework or any successor self-certification program operated by the U.S Department of Commerce and approved by the European Commission from time to time and which has not been invalidated (and in each case, includes the UK Extension to the EU-U.S. Data Privacy Framework and any other country extension to such framework that operates to extend the application of the EU-U.S. Data Privacy Framework to that country).
8. “Permitted Purpose” means for the purpose of (a) facilitating the Relevant Activities (including providing customer support); (b) improving the provision of the Relevant Activities, including the underlying technology; (c) account administration and support between the Parties; (d) facilitating payment of commission, fees and/or other amounts pursuant to the Agreement; (e) generating reports for the other Party and any further processing required for reconciliation, complaints handling and similar activities connected with servicing the Agreement; (f) creating reports for analytics, business intelligence and business reporting; (g) fraud prevention; (h) responding to law enforcement requests and tax authority audit requests; (i) facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales); (j) otherwise complying with a Party’s obligations under the Agreement and applicable laws; and (k) for the determination, calculation and reporting of Travel Taxes and other applicable taxation purposes as may be required from time to time.
9. “Relevant Personal Data” means personal data collected or otherwise processed by Expedia or Supplier in connection with the Agreement.
10. “Restricted Transfer Country” means any country in the European Economic Area, Switzerland, the United Kingdom and Brazil.
11. “Restricted Transfer Data” means any Relevant Personal Data relating to a booking made via a point of sale intended by a Party to be accessed by Customers in a Restricted Transfer Country.
12. “SCCs” means the approved European Commission’s Standard Contractual Clauses for the transfer of personal data from the European Union to third countries, as issued on 4 June 2021, and as amended, replaced, supplemented, or superseded from time to time, and the full current version of which can be found at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en.

1.2 In the case of conflict or ambiguity between: 

a. any of the provisions of this C2C Agreement and the provisions of the Agreement, the provisions of this C2C Agreement will prevail to the extent of the subject matter of this C2C Agreement; and

b. any of the provisions of this C2C Agreement and the SCCs incorporated by reference into them, the provisions of the executed SCCs will prevail.

2. RELATIONSHIP OF THE PARTIES 

Each of Expedia and Supplier acknowledge that for the purpose of Applicable Data Protection Law, each party is an autonomous and independent controller.

3. General mutual obligations

3.1 Each Party will: 

a. comply with all Applicable Data Protection Law applicable to controllers when processing Relevant Personal Data;

b. ensure that it has an appropriate lawful basis under Applicable Data Protection Law for its processing of Relevant Personal Data, including for the sharing of Relevant Personal Data with the other Party for use by that Party as an independent and autonomous controller for a Permitted Purpose in accordance with the Agreement;

c. implement and maintain all appropriate technical and organizational measures and safeguards to protect Relevant Personal Data they each process from and against a personal data breach, taking into account the risks represented by the processing and the nature of the Relevant Personal Data. To the extent the Supplier is using NDC for its distribution, the Supplier agrees to comply with the security measures set out in Annex 2 (Technical and Organizational Measures) to this C2C Agreement as if the references to Expedia and Expedia Group are construed to apply to the Supplier and the Supplier’s group unless Supplier has provided, and Expedia has accepted, adequate technical and organizational measures to satisfy ’Expedia’s security requirements for third-party plug-in to its systems; and 

d. not share, distribute, sell or otherwise permit access to Relevant Personal Data with any third party save for any data sharing that is necessary to fulfil a Permitted Purpose or as otherwise agreed between the Parties in the Agreement. 

3.2 Transparency and disclosures: Each party will ensure that all Customers are made aware in a timely manner, via its privacy policy and/or by any other appropriate means, that their personal data will be shared with the other party for the Permitted Purposes (or such category of parties in general terms, if permitted under Applicable Data Protection Law); and will direct Customers to the other party’s privacy policy (specifically or generally) for more information about their handling of their personal data.

3.3 Naming the other Party: Neither Party will name the other in any public statement or disclosure to an individual or to a Supervisory Authority or other legal body relating to privacy without obtaining prior written approval from the other, unless legally prohibited from liaising with the other party.

3.4 Connectivity Providers: Where a Party (Instructing Party) directs the other (Instructed Party) to receive or transfer Personal Data via a third party (a Connectivity Provider) who is acting as a processor on behalf of the Instructing Party and as a third party intermediary recipient or transferor vis-à-vis the Instructed Party, then the Instructing Party confirms that it shall be liable to the Instructed Party for the acts and omissions of its Connectivity Provider, subject to any agreed limitation of liability agreed between the Parties in the Agreement.

3.5 Cross-Border Data Transfers:

The Parties agree and acknowledge that in this clause 3.5, wherever the word ‘transfer’ is used, it includes access being provided by one controller/processor to another controller/processor and:  

a. General: neither Party will (and shall not permit any other party to) transfer Relevant Personal Data outside the territory of origination unless that Party takes any required compliance measures to enable such transfer legally in accordance with Applicable Data Protection Law. 

b. Asia-Pacific Region and CBPR: 

i. The Parties agree and acknowledge that: 

   A. a CBPR Party is bound by a legally enforceable set of obligations to provide comparable protection to Applicable Data Protections Laws; and 

   B. Expedia is a CBPR Party. 

Where the Supplier is also a CBPR Party, the provisions of this paragraph (b) will be construed to apply two-way. 

ii. Subject to paragraph (iii) below, the Parties agree that where: 

   A. Relevant Personal Data is being transferred from one CBPR Country to another CBPR Country; and 

   B. the data importer is a CBPR Party,     

then, to the extent that and for so long as the CBPR System is a recognized method of transfer by a relevant supervisory authority, the CBPR System shall be the agreed mechanism for cross-border transfers of Relevant Personal Data to such CBPR Party. 

iii. The CBPR System will only apply for transfers that involve at least one of the Parties being located in an Asia-Pacific Region country that is also a CBPR Country. 

iv. Expedia confirms that it will provide at least the same level of protection for the Relevant Personal Data as is required under the CBPR System; and it will promptly notify the other Party if it makes a determination that it can no longer provide this level of protection. In such event, or if the other Party otherwise reasonably believes that Expedia is not protecting the Relevant Personal Data to the standard required under the CBPR System, the other Party may either: 

   A. instruct Expedia to take reasonable and appropriate steps to stop and remediate any unauthorized processing, in which event the Parties will promptly cooperate in good faith to identify, agree and implement such steps; 

   B. agree an alternate safeguard that may apply to the processing under Applicable Data Protection Law; or 

   C. if (A) and (B) fail to resolve the issue, terminate this C2C Agreement and the Agreement (or, at the other Party’s election, any affected portion thereof) without penalty by giving notice to Expedia. 

If the other Party also holds a current CBPR System certification, then the above provisions will be deemed to apply as if the obligations are two-way. 

c. DPF: The Parties agree that in respect of transfers of Restricted Transfer Data between the Parties to the United States or to a country which has not been deemed "adequate" under the Applicable Data Protection Laws of the originating Restricted Transfer Country: 

i. to the extent that and for so long as the DPF is a recognized method of transfer by a relevant authority, the DPF shall be the agreed mechanism for cross-border transfers of data originating from a Restricted Transfer Country to Expedia in the United States; and 

ii. to the extent that and for so long as the DPF is not a valid method of transfer (including for transfers of Restricted Transfer Data to a country which has not been deemed "adequate" under the Applicable Data Protection Law of the originating Restricted Transfer Country), 

the SCCs shall apply to such transfers and we will enter into them on the basis set out in paragraph (h) below. Where Supplier also hold a current DPF certification, transfers of Restricted Transfer Data to Supplier can similarly be made under the DPF with SCCs as a fallback mechanism as set out above.   

d. With regards to the DPF, Expedia agrees that it will provide the same level of protection as required by the DPF. If Supplier reasonably believe we are not protecting the Restricted Transfer Data to the standard required by the DPF, Expedia may either:  

i. rely on the SCCs as set out in paragraph (h) below; 

ii. if SCCs are not a viable or appropriate solution, propose to Supplier reasonable and appropriate steps to stop and remediate any unauthorized processing, which we will in good faith implement using commercially reasonable efforts; or 

iii. if the fallbacks in paragraphs (i) or (ii) above are not viable, terminate this C2C Agreement and the Agreement without penalty.  

e. If Supplier is certified under the DPF, Supplier will comply with the Notice and Choice Principles of the DPF (as defined in the EU-U.S. DPF). For the avoidance of doubt, if Supplier is not DPF-certified or accessing or receiving the Restricted Transfer Data in a country deemed ‘adequate’ by the European Commission, then the SCCs will be relied on for transfers of Restricted Transfer Data from Expedia to Supplier.  

f. The Parties agree that they may each disclose this C2C Agreement and any relevant privacy provisions in the Agreement to the US Department of Commerce, the Federal Trade Commission, any European data protection authority, or any other US or EU judicial or regulatory body upon their request and that any such disclosure shall not be deemed a breach of confidentiality.  

g. Extension of SCCs to Non-Restricted Transfer Countries: In relation to transfers of Relevant Personal Data between the Parties originating from a country that is not a Restricted Transfer Country but is otherwise subject to safeguards that, according to Applicable Data Protection Law, must be applied before a transfer can be made of that Relevant Personal Data outside of the country of origin (each a Non-Restricted Transfer Country), then the Parties agree that: 

i. the SCCs set out in paragraph (h) below shall be deemed to extend to such additional transfers to the extent that such deemed extension would satisfy the safeguards of that particular country; and/or  

ii. where the measures set out in paragraph (h) below are insufficient or require supplementary measures, the parties agree to take such further measures, including, for example, execution of relevant documents, collection of consent, making of required filings, as may be required from to time in order to satisfy Applicable Data Protection Law. 

h. SCCs. Subject to the paragraphs of clause 3.5 above, the Parties hereby agree to enter into the SCCs on an unchanged basis save for the following selections: 

i. Where Supplier is located inside the European Economic Area or otherwise in a country deemed “adequate” in accordance with Article 45 of the GDPR, (Adequate Country) Module one (1) of the SCCs will apply one-way only in respect of transfers from Supplier to Expedia. Otherwise, Module one (1) applies two-way to cover transfers from both Supplier to Expedia and Expedia to Supplier. 

ii. For the purposes of clause 11(a) of the SCCs, the optional language is deleted. 

iii. For the purposes of clause 13 of the SCCs, the relevant paragraph is “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority”.  

iv. For the purposes of clause 17 of the SCCs, the governing law is Ireland. 

v. For the purposes of clause 18(b) of the SCCs, the selection is Ireland.

vi. A new clause 19 is added to the SCCs to cover transfers of personal data from the United Kingdom to outside of the United Kingdom as follows:

                                                                          “Clause 19

                                                                UK GDPR and DPA 2018

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover extra-territorial transfers that fall under the scope of UK GDPR and Data Protection Act 2018 (UK transfer). For the purposes of such UK transfer, the provisions of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses shall apply as set out in the form attached as the Addendum."

vii. A new clause 20 is added to cover transfers of personal data from Switzerland to outside of Switzerland as follows:           
 

                                                                                “Clause 20

                                                                               Swiss – FADP

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover extra-territorial transfers that fall under the scope of Federal Act of Data Protection (FADP) (referred to in this Clause as a Swiss transfer). For the purposes of such Swiss transfers, the governing law shall be deemed to be the selected Member State, the choice of forum shall be the selected Member State and the Federal Data Protection and Information Commissioner (FDPIC) shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Swiss transfer as are deemed necessary by the FCPIC to comply with the UK GDPR and FADP, and the Clauses shall be interpreted in accordance with the requirements for Swiss transfers arising under those laws or as otherwise set out in guidance issued by the FDPIC, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Swiss transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the FADP when engaging in Swiss transfers.”

viii. A new clause 21 is added to the SCCs to cover transfers of personal data from Brazil to outside of Brazil as follows:           

 

                                                                             “Clause 21

                                                                           Brazil – LGPD

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover cross-border transfers that fall under the scope of the Brazilian General Data Protection Law No. 13,709/18 (Lei Geral de Proteção de Dados) (LGPD) (referred to in this Clause as a Brazilian transfer). For the purposes of such Brazilian transfers, the governing law shall be deemed to be the selected Member State, the choice of forum shall be the selected Member State and Brazil’s National Data Protection Authority (ANPD) shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Brazilian transfer as are deemed necessary by the ANPD to comply with the LGPD, and the Clauses shall be interpreted in accordance with the requirements for Brazilian transfers arising under those laws or as otherwise set out in guidance issued by the ANPD or other relevant Brazilian authority, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Brazilian transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the LGPD when engaging in Brazilian transfers.”

ix. A new clause 22 is added to the SCCs to cover transfers of personal data from any other country not hitherto specified where the SCCs may be extended to ensure appropriate safeguards for transfers of personal data originating from that country to a party located outside of that country as follows:           

 

                                                                          “Clause 22

                                                          Other third country transfers

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover cross-border transfers that fall under the scope of the any other applicable laws and regulations in any relevant jurisdiction, relating to the use or processing of personal data (Applicable Data Protection Laws) requiring terms and protections broadly equivalent to these Clauses in order to transfer personal data from that country to another (referred to in this Clause as a Third Country transfer). For the purposes of such Third Country transfers, the governing law shall be deemed to be the selected Member State, the choice of forum shall be the selected Member State and the data protection authority or regulatory body of that country shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Third Country transfer as are deemed necessary by such supervisory authority to comply with the Applicable Data Protection Law of that country, and the Clauses shall be interpreted in accordance with the requirements for Third Country transfers arising under those laws or as otherwise set out in guidance issued by the relevant supervisory authority, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Third Country transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the Applicable Data Protection Law(s) when engaging in Third Country transfers.”

3.6 Annex 1 (SCCs Processing Overview) to this C2C Agreement constitutes Annex 1 of the SCCs. Annex 2 (Technical and Organizational Measures) to this C2C Agreement constitutes Annex 2 of the SCCs and applies only to Expedia where (a) only one-way SCCs apply for transfers of Restricted Transfer Data from Supplier to Expedia; or (b) Supplier has provided, and Expedia has accepted, adequate technical and organizational measures to satisfy Supplier’s Annex 2 requirements of the SCCs. Where the aforementioned conditions are not met, Annex 2 will be construed to apply to both parties and all references to Expedia and Expedia Group will be construed to reference either party accordingly. The Addendum to this C2C Agreement constitutes the UK Addendum for the purposes of the SCCs.

4. PCI Data

Each Party agrees that it will process, store, transmit and access any Relevant Persona Data that comprises payment information (including, without limitation, credit card, debit card, or financial account information) in compliance with the current Payment Card Information Data Security Standard (“PCI DSS”). In addition, where Supplier is the merchant of record and where Expedia possesses, stores, processes, or transmits Customer’s cardholder data on Supplier’s behalf, or to the extent that Expedia could impact the security of Supplier’s cardholder data environment, Expedia acknowledges that Expedia is responsible for the security of cardholder data that Expedia possesses, stores, processes or transmits and will comply with the PCI DSS as issued by the PCI Security Standard Council, as updated from time to time.

5. Term, termination and notices

5.1 This C2C Agreement will remain in full force and effect so long as the Agreement remains in effect.

5.2 Any provision of this C2C Agreement that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect Relevant Personal Data will remain in full force and effect.             

5.3 Any notices under this DPA will be deemed effective if delivered by email to the contact(s) provided by either Party to the other for these purposes in accordance with the notice provisions in the Agreement. In the case of Expedia, this will require an email being sent to the account/relationship manager from time to time and copied to the Expedia privacy mailbox provided from time to time.           
 

ANNEX I – SCCs PROCESSING OVERVIEW

MODULE ONE: Part 1: Controller to Controller (Supplier to Expedia)

A. LIST OF PARTIES

Data exporter(s):

Data importer(s):

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13 of SCCs

IRISH DATA PROTECTION AUTHORITY

MODULE ONE: Part 2: Controller to Controller (Expedia to Supplier)

A. LIST OF PARTIES

Data exporter(s):

Data importer(s):

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

As per Module 1, Part 1.

ANNEX II - TECHNICAL AND ORGANIZATIONAL MEASURES

The technical and organizational measures that apply to us/Expedia for the purposes of Module (1), Part (1) are set out below.

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Addendum)

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1 Tables

Part 2: Mandatory Clauses

Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.