Data Processing Agreement

Updated: 2026-10-21 · Version 8f12acd7b826

Parties and scope

This agreement forms part of the Rewallo business service agreement. The subscribing business is the controller of its customer loyalty programme. AviaTravel OÜ, registration number 17586406, operating Rewallo, acts as processor for customer-programme information processed on the business’s behalf. Rewallo remains controller for its own account, billing, support and service-security activities described in the Privacy Policy.

Processing instructions

The processor processes personal data only on the controller’s documented lawful instructions, including instructions concerning international transfers, unless required by applicable law. The subscription, programme settings and authorised support requests constitute instructions. Where law requires different processing, the processor informs the controller before processing unless that law prohibits disclosure. The processor informs the controller if an instruction appears to infringe applicable data-protection law.

Subject, duration and data

Processing provides and maintains the customer loyalty programme for the service relationship and the subsequent return, deletion and legally required retention process. Operations include collection, organisation, storage, retrieval, display, updating, transmission and deletion. Data subjects are programme members and authorised business contacts. Data may include names, email addresses, phone numbers, membership and card identifiers, stamps, rewards, activity timestamps and optional wallet-pass/device identifiers. The standard service does not request special-category personal data. The controller must not submit such data without a separate lawful arrangement.

Confidentiality and security

The processor restricts access to authorised personnel subject to confidentiality obligations and uses appropriate technical and organisational measures considering the risk, nature and context of processing. The Data Security page describes application controls, including authentication, tenant checks, password hashing, input validation, CSRF protection and transactional loyalty actions. Neither that description nor this agreement represents a security certification or a guarantee that incidents cannot occur.

Subprocessors

The controller provides general written authorisation to engage infrastructure and delivery subprocessors needed to provide the service. The Service Providers page describes the recipient categories and supported services. The controller may request the current identities and relevant processing information at support@rewallo.com. Before adding or replacing a subprocessor handling customer-programme information, the processor gives the controller notice and an opportunity to object on reasonable data-protection grounds. The parties work to address an objection; if no suitable arrangement is available, the affected processing must cease and the parties arrange service closure and data return or deletion. The processor imposes materially equivalent data-protection obligations on subprocessors and remains responsible for their performance of those obligations.

International transfers

Where required, processing outside the EEA must rely on an applicable adequacy decision or appropriate safeguards, such as valid standard contractual clauses and supplementary measures. This agreement does not itself represent that standard contractual clauses have been signed with every supported integration. The processor provides information about the mechanism applicable to the controller’s data on request. Optional wallet features operate under the relevant platform arrangements described in Service Providers.

Requests and assistance

Considering the nature of processing and information available, the processor assists the controller with data-subject requests and its duties concerning security, breach assessment and notification, impact assessments and consultation with supervisory authorities. Requests received directly from members are referred to the controller where appropriate. The controller remains responsible for deciding the legal basis, programme notices and responses concerning its programme.

Personal-data breaches

The processor notifies the controller without undue delay after becoming aware of a personal-data breach affecting the controller’s information. Information is supplied as available, including the nature of the incident, affected categories and approximate scope where known, likely consequences, mitigation steps and a contact point. The processor cooperates with the controller’s investigation and required notifications.

Return and deletion

At the end of processing, the controller may choose return or deletion of its customer-programme information, except where applicable law requires retention. Contact support to arrange a suitable electronic export and confirm the scope and timing of closure. Residual backup copies expire through backup rotation and remain protected from ordinary use. If a backup is restored, previously agreed deletion instructions must be reapplied. Information retained for a legal obligation is restricted to that purpose. Cancellation of renewal alone is not an instruction to erase all customer records immediately.

Evidence and audit

The processor makes information necessary to demonstrate compliance with this agreement available to the controller and permits audits and inspections by the controller or its mandated auditor. The parties coordinate scope, timing, confidentiality and security so an audit does not expose another business’s data or unnecessarily disrupt the service. These arrangements do not remove statutory audit or supervisory-authority rights.

Contact and precedence

Send privacy instructions and incident questions to support@rewallo.com. This agreement prevails over conflicting general service terms for processing carried out on the controller’s behalf. Mandatory applicable data-protection law remains unaffected.