Last Updated: 19 November 2024 

SCOPE: If and to the extent that the Company (a) is processing personal data as part of the Services in the capacity of an independent and autonomous controller, and (b) there is sharing of personal data between the Company and Expedia, this global controller to controller agreement (“C2C Agreement”) is supplemental to and applies to the Agreement and any relevant processing undertaken in connection with the Agreement, and sets out additional terms, requirements and conditions on which the third-party service provider (referred to in this C2C Agreement as the “Company”) will process personal data when providing Services under the Agreement. 

1. DEFINITIONS AND INTERPRETATION

1.1 This C2C Agreement is subject to the terms of the Agreement and is incorporated by reference into the Agreement. Interpretations and defined terms set forth in the Agreement apply to the interpretation of this C2C Agreement unless otherwise defined herein.

1.2 The C2C Processing Overview Appendix in the Agreement forms part of Annex one (1) of this Part five (5) and will have effect as if set out in full in the body of this C2C Agreement. Any reference to this C2C Agreement includes that Appendix.

1.3 In the case of conflict or ambiguity between: 

1. any of the provisions of this C2C Agreement and the provisions of the Agreement, the provisions of this C2C Agreement will prevail to the extent of the subject matter of this C2C Agreement, save as expressly agreed otherwise between the Parties in the Agreement; and
2. any of the provisions of this C2C Agreement and the SCCs incorporated by reference herein, the provisions of the executed SCCs will prevail.

2. RELATIONSHIP OF THE PARTIES AND DATA PROTECTION

Each of Expedia and the Company acknowledge that for the purpose of Applicable Data Protection Law, each party is an autonomous and independent controller.

3. OBLIGATIONS

3.1 Each Party will collect and process Controller Personal Data to fulfil its respective rights and obligations under this Agreement, as well as under all applicable laws. As such, each Party will:

1. process such Controller Personal Data as an independent and autonomous controller;
2. comply with all Applicable Data Protection Laws applicable to controllers when processing such Controller Personal Data;
3. ensure that it has an appropriate lawful basis under Applicable Data Protection Laws for its processing of Controller Personal Data, including for the sharing of Controller Personal Data to the other Party for use by that Party as an independent controller in accordance with this Agreement;
4. implement and maintain all appropriate technical and organizational measures and safeguards to protect Controller Personal Data they each process from and against a personal data breach, taking into account the risks represented by the processing and the nature of the Controller Personal Data;
5. take all necessary measures to ensure that Controller Personal Data are transferred in accordance with Applicable Data Protection Laws;
6. not share, distribute, sell or otherwise permit access to Controller Personal Data or otherwise collected for the purposes of this Agreement with any third party save for any data sharing that is necessary to fulfil the purposes of this Agreement or as otherwise agreed between the Parties in the Agreement.

3.2 Company will not name any Expedia Group company in any public or disclosure to an individual or to a Supervisory Authority or other legal body relating to privacy without obtaining prior written approval from Expedia, unless Company is legally prohibited from liaising with Expedia.

3.3 Where Company has received a request from government bodies in relation to surveillance activity, it will inform Expedia of such request where legally permitted to do so. In the event that the Company receives a government demand for access to Expedia Personal Data, Company shall (a) provide a copy of the demand to Expedia unless legally prohibited from doing so; (b) consult with Expedia and agree on the response unless legally prohibited from doing so; (c) challenge such demand to the extent, in the reasonable opinion of Company, that such demand conflicts with Company’s obligations under Applicable Data Protection Law; and (d) shall only disclose or provide access to Expedia Personal Data in response to any demands where compelled to do so.

3.4 Where the Company is processing personal data of Expedia Personnel, Company will notify Expedia without undue delay of a verified personal data breach affecting personal data of Expedia Personnel and provide Expedia with all relevant information as Expedia requires. 

3.5 All types of data shared between Parties are to be considered Confidential Information. Therefore, those data can’t be shared without specific written authorization from the Party to which those data belong other than in accordance with this Agreement. Both Parties agree to use those data exclusively in accordance with the Agreement and not for any further purpose without express written consent of the Company. Parties are also held fully responsible for the conduct of their own employee/external contractors.

4. INTERNATIONAL TRANSFERS

4.1 The Parties agree and acknowledge that in this clause 4, wherever the word ‘transfer’ is used, it includes access being provided by one controller/processor to another controller/processor and:

1. the Company will not transfer (nor permit any other party to transfer) the Controller    Personal Data outside of its territory of origination other than as necessary     for a Permitted Purpose and only where the Company takes any required compliance measures to enable such transfer legally in accordance with Applicable Data Protection Law.
2. Asia-Pacific Region and CBPR System: 
   1. The Parties agree and acknowledge that:
      1. a CBPR Party is bound by a legally enforceable set of obligations to provide comparable protection to Applicable Data Protections Laws; and

      2. Expedia is a CBPR Party.

         Where the Company is a CBPR Party, the provisions of this paragraph (b) will be construed to apply two-way.

   2. Subject to paragraph (iii) below, the Parties agree that where:

      1. Controller Personal Data is being transferred from one CBPR/PRP Country to another CBPR/PRP Country; and 
      2. the data importer is a CBPR Party, 

      then, to the extent that and for so long as the CBPR System is a recognized method of transfer by a relevant supervisory authority, the CBPR System shall be the agreed mechanism for cross-border transfers of Controller Personal Data to such CBPR Party. 

   3. The CBPR System will only apply for transfers that involve at least one of the Parties being located in an Asia-Pacific Region country that is also a CBPR/PRP Country.

   4. Expedia confirms that it will provide at least the same level of protection for the Controller Personal Data as is required under the CBPR System; and it will promptly notify the other Party if it makes a determination that it can no longer provide this level of protection. In such event, or if the other Party otherwise reasonably believes that Expedia is not protecting the Controller Personal Data to the standard required under the CBPR System, the other Party may either:

      1. instruct Expedia to take reasonable and appropriate steps to stop and remediate any unauthorized processing, in which event the Parties will promptly cooperate in good faith to identify, agree and implement such steps;
      2. agree an alternate safeguard that may apply to the processing under Applicable Data Protection Law; or
      3. if (A) and (B) fail to resolve the issue, terminate any affected portion of this C2C Agreement and the Agreement without penalty by giving notice to Expedia.

      If the Company holds a current CBPR System certification, then the above provisions will be deemed to apply as if the obligations are two-way.

3. DPF: The Parties agree that in respect of transfers of Restricted Transfer Data between the Parties to the United States or to a country which has not been deemed "adequate" ("Adequate Country") under the Applicable Data Protection Laws of the originating Restricted Transfer Country:
   1. To the extent that and for so long as (A) the DPF is a recognized and valid method of transfer by a relevant authority; and (B) Expedia continues to hold a then current DPF certification, the DPF shall be the agreed mechanism for cross-border transfers of Restricted Transfer Data from the Company to Expedia in the United States; and
   2. to the extent that and for so long as (A) the DPF is not a valid method of transfer or (B) Expedia does not hold a then current DPF certification, the SCCs shall apply to such transfers and Expedia will enter into them on the basis set out in paragraph (h) below. Where Company also holds a then current DPF certification, relevant transfers of Restricted Transfer Data to Company can similarly be made under the DPF with SCCs as a fallback mechanism as set out above and where this is the case, the provisions of paragraphs (d) and (e) below shall be construed as applying two-way. 
4. With regards to the DPF, Expedia agrees that it will provide the same level of protection as required by the DPF. If Company reasonably believes we are not protecting the Restricted Transfer Data to the standard required by the DPF, Expedia may either: 
   1. rely on the SCCs as set out in paragraph (h) below; 
   2. If SCCs are not a viable or appropriate solution, propose to Company reasonable and appropriate steps to stop and remediate any unauthorized processing, which Expedia will in good faith implement using commercially reasonable efforts; or
   3. If the fallbacks in paragraphs (i) or (ii) above are not viable, terminate any affected portion of this C2C Agreement and the Agreement without penalty by giving notice in accordance with the Agreement.
5. If Company is certified under the DPF, Company will comply with the Notice and Choice Principles of the DPF (as defined in the EU-U.S. DPF). For the avoidance of doubt, if Company is not DPF-certified or accessing or receiving the Restricted Transfer Data in a country deemed ‘adequate’ by the European Commission, then the SCCs will be relied on for transfers of Restricted Transfer Data from Expedia to Company.
6. The Parties agree that they may each disclose this C2C Agreement and any relevant privacy provisions in the Agreement to the US Department of Commerce, the Federal Trade Commission, any European data protection authority, or any other US or EU judicial or regulatory body upon their request and that any such disclosure shall not be deemed a breach of confidentiality.
7. Extention of SCCs to Non-Restricted Transfer Countries: In relation to transfers of Controller Personal Data between the Parties  originating from a country that is not a Restricted Transfer Country but is otherwise subject to safeguards that, according to Applicable Data Protection Law, must be applied before a transfer can be made of that Controller Personal Data outside of the country of origin (each a "Non-Restricted Transfer Country"), then the Parties agree that:  
   1. the SCCs set out in paragraph (h) below shall be deemed to extend to such additional transfers to the extent that such deemed extension would satisfy the safeguards of that particular country; and/or
   2. where the measures set out in paragraph (h) below are insufficient or require supplementary measures, the parties agree to take such further measures, including, for example, execution of relevant documents, collection of consent, making of required filings, as may be required from to time in order to satisfy Applicable Data Protection Law.
8. SCCs: Subject to the foregoing paragraphs of this Clause 4, where the Parties have determined that any transfer of Controller Personal Data between Expedia and the Company requires execution of SCCs in order to comply with Applicable Data Protection Law, the Parties hereby enter into the SCCs which are incorporated by reference into the Agreement on an unchanged basis save for the following selections:
   1. Where Company is located inside the European Economic Area or otherwise in an Adequate Country, Module one (1) (Controller to Controller) only of the SCCs applies one-way from Company to Expedia. Otherwise, Module one(1) (Controller to Controller) applies two-way.
   2. For the purposes of clause 11(a) of the SCCs, the optional language is deleted.
   3. For the purposes of clause 13 of the SCCs, the relevant paragraph is “The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority”.
   4. For the purposes of clause 17 of the SCCs, the governing law is Ireland.
   5. For the purposes of clause 18(b) of the SCCs, the selection is Ireland.
   6. A new clause 19 is added to the SCCs to cover transfers of personal data from the United Kingdom to outside of the United Kingdom as follows:

“Clause 19    
UK GDPR and DPA 2018

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover extra-territorial transfers that fall under the scope of UK GDPR and Data Protection Act 2018 (a "UK transfer"). For the purposes of such UK transfer, the provisions of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses shall apply as set out in the form attached as the Addendum.

7. A new clause 20 is added to cover transfers of personal data from Switzerland to outside of Switzerland as follows:     

    

   “Clause 20

Swiss – FADP

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover extra-territorial transfers that fall under the scope of Federal Act of Data Protection ("FADP") (referred to in this Clause as a "Swiss transfer"). For the purposes of such Swiss transfers, the governing law shall be deemed to be the selected Member State, the choice of forum shall be the selected Member State and the Federal Data Protection and Information Commissioner ("FDPIC") shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Swiss transfer as are deemed necessary by the FCPIC to comply with the UK GDPR and FADP, and the Clauses shall be interpreted in accordance with the requirements for Swiss transfers arising under those laws or as otherwise set out in guidance issued by the FDPIC, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Swiss transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the FADP when engaging in Swiss transfers.”    
 

8. A new clause 21 is added to the SCCs to cover transfers of personal data from Brazil to outside of Brazil as follows:

“Clause 21

Brazil – LGPD

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover cross-border transfers that fall under the scope of the Brazilian General Data Protection Law No. 13,709/18 (Lei Geral de Proteção de Dados) (“LGPD”) (referred to in this Clause as a “Brazilian transfer”). For the purposes of such Brazilian transfers, the governing law shall be deemed to be the selected Member State, the choice of forum shall be the selected Member State and Brazil’s National Data Protection Authority (“ANPD”) shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Brazilian transfer as are deemed necessary by the ANPD to comply with the LGPD, and the Clauses shall be interpreted in accordance with the requirements for Brazilian transfers arising under those laws or as otherwise set out in guidance issued by the ANPD or other relevant Brazilian authority, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Brazilian transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the LGPD when engaging in Brazilian transfers.”     
 

9. A new clause 22 is added to the SCCs to cover transfers of personal data from any other country not hitherto specified where the SCCs may be extended to ensure appropriate safeguards for transfers of personal data originating from that country to a party located outside of that country as follows:

“Clause 22     
Other third country transfers     
 

The Parties agree that these Clauses will extend and apply, to the extent relevant to the transfer in question, to cover cross-border transfers that fall under the scope of the any other applicable laws and regulations in any relevant jurisdiction, relating to the use or processing of personal data (“Applicable Data Protection Laws”) requiring terms and protections broadly equivalent to these Clauses in order to transfer personal data from that country to another (referred to in this Clause as a “Third Country transfer”). For the purposes of such Third Country transfers, the governing law shall be deemed to be the selected Member State, the choice of forum shall be the selected Member State and the data protection authority or regulatory body of that country shall be the competent supervisory authority. The Parties further agree that such further changes shall be construed to be made to the Clauses in respect of a Third Country transfer as are deemed necessary by such supervisory authority to comply with the Applicable Data Protection Law of that country, and the Clauses shall be interpreted in accordance with the requirements for Third Country transfers arising under those laws or as otherwise set out in guidance issued by the relevant supervisory authority, without the Parties having to enter into separate standard contractual clauses prepared specifically for their Third Country transfers. The Parties shall further do all such acts and things as may be necessary to ensure compliance with the Applicable Data Protection Law(s) when engaging in Third Country transfers.”     
 

4.2 For the purposes of the SCCs:

1. Annex one (1) (SCCs Processing Overview) of this Part five (5) (C2C Processing Overview) will constitute Annex one (1) of the SCCs;
2. Where the Company is the data importer under the SCCs, Part two (2) (Security Measures) and Part three (3) (Business Continuity) of the Requirements will constitute Annex two (2) (Technical and Organizational Measures) of the SCCs in relation to Company; and
3. Where Expedia is the data importer under the SCCs, Annex two (2) (Technical and Organizational Measures) to this Part five (5) will constitute Annex two (2) (Technical and Organizational Measures) of the SCCs in relation to Expedia. 

5. TERM AND TERMINATION

5.1 This C2C Agreement will remain in full force and effect so long as the Agreement remains in effect.

5.2 Any provision of this C2C Agreement that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect Controller Personal Data will remain in full force and effect.

ANNEX 1

SCCs - Processing Overview

This is Annex one (1) for the purposes of the Module one (1) Standard Contractual Clauses/SCCs to the extent the Parties agree that they apply to the Agreement. This Processing Overview should be read in conjunction with C2C Processing Overview Appendix in the Agreement.

MODULE ONE (1) – Controller to Controller (Expedia to Company)

A. LIST OF PARTIES

Data exporter(s): 

Data importer(s): 

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Irish Data Protection Authority

MODULE ONE (1) – Controller to Controller (Company to Expedia)

A. LIST OF PARTIES

Data exporter(s): 

Data importer(s): 

B. DESCRIPTION OF TRANSFER

C. COMPETENT SUPERVISORY AUTHORITY

Irish Data Protection Authority

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

EXPEDIA MEASURES

Expedia Group importers will comply with the below measures for the purposes of Annex II of the SCCs.

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Addendum)

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.