data processing addendum
Last Updated: November 6. 2026
This Data Processing Addendum (including its Exhibits) (“Addendum”) forms part of and is subject to the terms and conditions of the olive Master Services Agreement or other agreement for the Services (the “MSA”), together with the applicable Order Form(s), which incorporate this Addendum by reference (the “Agreement”) by and between the olive customer that has executed the Agreement (“Customer”) and olive travel, Inc. (“olive”).
1. Subject Matter and Duration
Subject Matter.
This Addendum reflects the parties’ commitment to abide by Data Protection Laws concerning the Processing of Customer Personal Data in connection with olive’s execution of the Agreement. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement (including any Order Form), this Addendum shall control. This Addendum is the data processing addendum referred to in the Agreement. As between olive and Customer, it replaces any other data processing addendum or terms that olive makes available on its website or by reference, including any later version of them. This Addendum may be amended only by a written instrument signed by both parties; changes that olive makes to the Agreement or to its standard terms by posting them do not amend it.
The subject matter, nature and purposes of processing, types of personal data, categories of data subjects, and duration of processing shall be specified in a completed Processing Description Schedule agreed by the Parties before processing starts, in accordance with Article 28(3) GDPR. The Schedule shall reflect the actual Services and data flows.
Duration and Survival.
olive will Process Customer Personal Data until the relationship terminates as specified in the Agreement.
2. Definitions
For the purposes of this Addendum:
"Customer Personal Data"means Customer Data that is Personal Data Processed by olive on behalf of Customer to provide the Services. This definition includes any personal data processed by olive on behalf of Customer, including personal data within Operational Metrics, regardless of the MSA definition of Customer Data.
"Data Protection Laws"means the applicable data privacy, data protection, and cybersecurity laws, rules, and regulations to which the Customer Personal Data are subject.
"Personal Data"has the meaning assigned under applicable Data Protection Laws.
"Process" or "Processing"means any operation performed on Personal Data (e.g., collection, storage, use, disclosure, deletion).
"Security Incident(s)"means the breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by olive or its Subprocessors. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, denial-of-service attacks and unsuccessful log-in attempts.
"Services"means the olive platform, technology, and related services under the Agreement.
"Subprocessor(s)"means olive’s authorized vendors and third-party service providers that Process Customer Personal Data.
3. Processing Terms for Customer Personal Data
Documented Instructions.olive shall Process Customer Personal Data to provide the Services in accordance with the Agreement, this Addendum, and Customer’s instructions.
olive shall process Customer Personal Data only on documented instructions from Customer, including with regard to transfers of personal data to a third country or an international organisation, unless required by Union or Member State law, or other applicable law, to which olive is subject. In such a case, olive shall inform Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest. olive shall immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection provisions. Nothing in this Section limits Clause 15 of the Clauses. Customer's documented instructions are the Agreement (including applicable Order Forms), this Addendum, and Customer's configuration and use of the Services.
Authorization to Use Sub-processors.Customer authorizes olive to engage Sub-processors.
Subprocessor Compliance.olive shall impose, by written contract, the same data protection obligations as set out in this Addendum, in particular sufficient guarantees to implement appropriate technical and organizational measures, and, subject to Section 13, remain fully liable to Customer for the performance of each Sub-processor’s obligations.
Right to Object. olive will notify Customer of any intended addition or replacement of Sub-processors at least thirty (30) days in advance by updating its Sub-processor list at https://www.tryolive.com/sub-processors, which identifies each Sub-processor and its processing activities. Customer may object on reasonable data protection grounds within the notice period. olive may use the Sub-processor during the notice period. If Customer objects and the parties cannot resolve the objection in good faith, olive shall, at its option, either cease using the Sub-processor for Customer Personal Data within ninety (90) days after the objection or permit Customer to terminate only the affected Services, with a pro-rata refund of prepaid fees for the terminated period.
4. Confidentiality: All olive personnel authorized to Process Customer Personal Data shall have committed themselves to confidentiality or be under an appropriate statutory obligation of confidentiality.
5. Data Subject Rights and Compliance
olive shall provide reasonable assistance with data subject rights requests. Olive shall provide support for Data Protection Impact Assessments and consultations with regulators. Olive shall provide documentation reasonably necessary to demonstrate compliance. olive shall provide the foregoing assistance and support at no charge for up to ten (10) hours of olive personnel time per contract year (each twelve-month period beginning on the effective date of the Order Form), and thereafter at USD 250 per hour. olive will notify Customer when it has used 90% of the included hours. This paragraph does not apply to assistance required as a result of a Security Incident to the extent caused by olive’s or its Subprocessors’ breach of this Addendum.
6. California Specific Terms (CCPA/CPRA)To the extent olive’s Processing is subject to CCPA/CPRA, olive shall:Not “sell” or “share” Customer Personal Data. Only retain, use, or disclose such data to provide the Services or as permitted by law. Provide equivalent or higher protections required by the CCPA.
7. Permitted Use
Provision of the Services. olive shall process Customer Personal Data only on Customer’s documented instructions as set out in the Agreement and this Addendum, to provide, secure, and support the Services, including security and fraud prevention, and as required by applicable law, subject to Section 3 (Documented Instructions). olive shall not process Customer Personal Data for its own purposes except as permitted in this Section 7.
Analytics and Form-Field Masking. olive may use analytics and similar technologies in connection with the Services only (a) where Data Protection Laws require consent, to the extent Customer has obtained that consent; and (b) with masking of form fields in session recordings so that the content of fields in which individuals enter data is not captured by those recordings. Analytics events may include contact details that the individual submits in the booking flow, which olive processes as Customer's processor in accordance with this Addendum and the Processing Description Schedule.
Anonymized and Aggregated Data. Customer instructs olive to anonymize and aggregate Customer Personal Data. “Anonymized Data” means data that does not identify, and cannot reasonably be used to identify, Customer, any individual, or any other third party, whether alone or in combination with other reasonably available information. olive may use Anonymized Data or disclose it in a form that does not identify Customer or any individual. Anonymized Data is not Customer Personal Data.
No Training on Identifiable Data. olive shall not use Customer Personal Data (including in pseudonymized form) to train or fine-tune any machine learning model or artificial intelligence system that olive makes available to, or uses for the benefit of, any person other than Customer. For clarity, this Section 7 does not restrict: (a) olive's use of Customer Personal Data as input to such a system in order to provide, secure, and support the Services to Customer, provided that olive contractually requires any third-party provider of that system not to use the input to train its models; (b) olive's evaluation of the quality, security, and performance of the Services as provided to Customer; or (c) use of Anonymized Data.
No Sale or Advertising. (a) olive shall not sell Customer Personal Data or use it for advertising or marketing on olive’s own behalf or on behalf of any third party other than Customer. “Sell” and “share” have the meanings given in the CCPA.(b) The following are Processing on Customer’s documented instructions and on Customer’s behalf, and are not a sale or sharing by olive or advertising or marketing on olive’s behalf: (i) transmitting event data (such as purchase and add-to-cart events) from the Services to analytics, advertising-measurement, or tag-management accounts or tools owned or controlled by Customer (“Customer Tags”); and (ii) recording advertising click identifiers and similar campaign identifiers and using them solely to attribute bookings to Customer’s own advertising campaigns and to report the results to Customer. Measuring the performance of Customer’s own advertising is not advertising on olive’s behalf.(c) Customer is responsible for Customer Tags, including its agreements with their providers, any consent they require under Data Protection Laws, and its own use of the data they receive. Providers of Customer Tags are not Subprocessors of olive. olive shall not use data described in paragraph (b) for any other purpose.
8. Security and Incidents
olive shall implement appropriate technical and organizational measures to safeguard Customer Personal Data.
Upon becoming aware of a Security Incident, olive will notify Customer without undue delay and will provide the information reasonably necessary for Customer to meet its obligations under Articles 33 and 34 GDPR. The fees in Sections 5 and 10 do not apply to, and olive shall not condition or delay, any assistance, information, or audit that Data Protection Laws or the Standard Contractual Clauses require olive to provide without charge or within a specified period. olive may charge for time that exceeds what is required in this way.
9. Cross-Border Transfers
Customer authorizes olive and its Sub-processors to transfer data internationally, including to the U.S., in compliance with Chapter V GDPR. Where required, transfers shall be governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two), as supplemented in Exhibit A.
10. Audits and Assessments
Customer may exercise audit rights as provided under Data Protection Laws, subject to reasonable conditions (no more than once per year, with at least thirty (30) days’ advance notice), save where an additional audit is required following a Security Incident or by a supervisory authority. Customer shall reimburse olive for olive’s time spent in connection with any audit, including reviewing and responding to audit requests and questionnaires and participating in inspections, at USD 250 per hour, together with olive’s reasonable out-of-pocket expenses, save where an additional audit is required following a Security Incident or by a supervisory authority. Before the audit begins, olive will provide a good-faith estimate of the hours required, and the parties will agree the scope, timing, and duration in advance. Customer shall bear the fees and expenses of any third-party auditor it engages. Costs, additional audit rights, and liability relating to a Security Incident apply to the extent it results from olive's or its Sub-processors' breach of this Addendum, and not to the extent it results from Customer's own acts or omissions, including compromised Customer credentials or systems.
11. Data Deletion
Within ninety (90) days after termination of the Agreement, olive shall, at Customer's choice, return or delete all Customer Personal Data from its systems, except as required by Union or Member State law or other applicable law to which olive is subject. olive will instruct its Sub-processors to delete such data and will flow this obligation down to them by written contract. Retained backup copies shall be securely isolated, deleted in accordance with the documented retention schedule, and not restored to active processing except where necessary. olive will certify deletion in writing on request. Deletion requested by Customer during the Term applies to the specific records or requests identified and shall be completed within ninety (90) days of the request.
12. Customer’s Obligations
Customer represents and warrants that: It complies with Data Protection Laws. It provides adequate privacy notices and lawful bases for Processing. Its documented instructions to olive comply with Data Protection Laws.
13. Limitation of Liability
(a) Each party’s liability arising out of or related to this Addendum (including the Standard Contractual Clauses), whether in contract, tort, or otherwise, is subject to the limitations, exclusions, and exceptions of liability in the Agreement, as if set out in full in this Addendum.
(b) Liability under this Addendum and the Agreement is aggregated. Amounts paid or payable under one count toward the limits in the other, and this Addendum does not create separate or additional limits.
(c) Subject to paragraph (e), the limitation of liability provisions of the Agreement prevail over any conflicting provision of this Addendum as between the parties, notwithstanding Section 1.
(d) A Security Incident is not a breach of the Agreement’s confidentiality provisions for purposes of any exception to those limitations.
(e) Nothing in this Section limits (i) either party’s liability to data subjects under Clause 12 of the Standard Contractual Clauses, or (ii) any liability that cannot be limited under applicable law.
EXHIBIT A TO THE DATA PROCESSING ADDENDUM
olive shall implement and document technical and organizational measures appropriate to the risks under Article 32 GDPR, as described in Annex II.
This Exhibit A forms part of the Addendum and supplements the Standard Contractual Clauses. Capitalized terms not defined in this Exhibit A have the meaning set forth in the Addendum. The parties agree that the following terms shall supplement the Standard Contractual Clauses:
Supplemental Terms. The parties agree that: (i) a new Clause 1(e) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 is deleted; (iv) Option 1 in Clause 9 is struck and Option 2 is kept, and data importer must notify data exporter of any new subprocessors in accordance with Section 3 of the Addendum; (v) the optional text in Clause 11 is deleted; and (vi) in Clauses 17 and 18, the governing law and the competent courts are those of the EU state identified in the applicable Order Form (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers). Annex I. Annex I to the Standard Contractual Clauses shall read as follows:
A. List of Parties
Data Exporter: Customer. (Controller).
Customer.Address: As set forth in the Notices section of the Agreement.Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.Activities relevant to the data transferred under these Clauses: The Services. Role: Controller.
Data Importer: olive. (Processor).
Address: As set forth in the Notices section of the Agreement.Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.Activities relevant to the data transferred under these Clauses: The Services. Role: Processor.
B. Description of the Transfer:
Categories of data subjects whose personal data is transferred: The categories of data subjects whose personal data is transferred under the Clauses.Categories of personal data transferred: The categories of personal data transferred under the Clauses. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: To the parties knowledge, no sensitive data is transferred. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Personal data is transferred in accordance with the standard functionality of the Services, or as otherwise agreed upon by the parties.Nature of the processing: The Services.Purpose(s) of the data transfer and further processing: The Services.The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data importer will retain personal data in accordance with the Addendum. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: For the subject matter, nature, and duration as identified above.
C. Competent Supervisory Authority:
The supervisory authority shall be specified in the applicable Order Form. If no supervisory authority is mandated by the applicable Order Form, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties.
D. Additional Data Transfer Impact Assessment Questions:
- Will data importer process any personal data under the Clauses about a non-United States person that is “foreign intelligence information” as defined by 50 U.S.C. § 1801(e)?
Data importer does not process Customer Personal Data for the purpose of collecting or analyzing foreign intelligence information. As of the effective date of the Addendum, data importer has no actual knowledge that the Customer Personal Data it processes under the Clauses constitutes “foreign intelligence information.”
- Is data importer subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom where personal data is stored or accessed from that would interfere with data importer fulfilling its obligations under the Clauses? For example, FISA Section 702. If yes, please list these laws:
Data importer is a U.S. company and is subject to U.S. laws under which public authorities may request or compel disclosure of data held by service providers, including 18 U.S.C. § 2703 and, to the extent data importer or any of its Subprocessors is or is deemed an “electronic communication service provider” within the meaning of 50 U.S.C. § 1881(b)(4), FISA Section 702. To data importer’s knowledge, and to the extent permitted by law, as of the effective date of the Addendum, no court has determined that data importer is subject to process issued under FISA Section 702 and no such proceeding is pending. Based on the nature of the Customer Personal Data, the safeguards in the Addendum and the Clauses (including data importer’s obligations under Clause 15), and the safeguards applicable under U.S. law, data importer has no reason to believe that these laws prevent it from fulfilling its obligations under the Clauses.
- Has data importer ever received a request from public authorities for information pursuant to the laws contemplated by the question above? If yes, please explain:
As of the effective date of the Addendum, and to data importer’s knowledge after reasonable inquiry of the personnel responsible for responding to legal process, data importer has not received any request or order from a public authority under the laws identified in response to the question above seeking Customer Personal Data.
- Has data importer ever received a request from public authorities for personal data of individuals located in European Economic Area, Switzerland, and/or the United Kingdom?
If yes, please explain: As of the effective date of the Addendum, and to data importer’s knowledge after reasonable inquiry of the personnel responsible for responding to legal process, data importer has not received any request or order from a public authority seeking Customer Personal Data relating to individuals located in the European Economic Area, Switzerland, or the United Kingdom.
E. Data Transfer Impact Assessment Outcome:
Data importer will provide to data exporter, before Processing begins and together with the Processing Description Schedule, a documented, transfer-specific assessment of the laws and practices of the countries to which personal data is transferred, including relevant supplementary measures (the "Assessment"). The parties' conclusion under Clause 14 of the Clauses is set out in the Assessment, and this Annex I.E refers to it. The parties will keep the Assessment under review, and data importer will update it on a material change in the relevant laws or practices or in the transfers.
F. Clarifying Terms:
The parties agree that: (i) the certification of deletion required by Clause 8.5 and Clause 16(d) of the Clauses will be provided upon data exporter’s written request; (ii) the measures data importer is required to take under Clause 8.6(c) of the Clauses will only cover data importer’s impacted systems; (iii) the audit described in Clause 8.9 of the Clauses shall be carried out in accordance with Section 10 of the Addendum; (iv) the termination rights in Clauses 14(f) and 16(c) of the Clauses apply as written in the Clauses; where data exporter terminates under those Clauses, termination is limited to the affected Services or transfers, with a pro-rata refund of prepaid fees for the terminated period, and is available only after the parties have worked in good faith for thirty (30) days to put an alternative transfer mechanism or supplementary measures in place; (v) unless otherwise stated by data importer, data exporter will be responsible for communicating with data subjects pursuant to Clause 15.1(a) of the Clauses; (vi) the information required under Clause 15.1(c) of the Clauses will be provided upon data exporter’s written request; and (vii) data importer shall bear all reasonable costs and expenses incurred by data importer in connection with the performance of data importer’s obligations under Clause 15.1(b) and Clause 15.2 of the Clauses.
Annex II. Annex II of the Standard Contractual Clauses shall read as follows: Data importer shall implement and maintain technical and organizational measures designed to protect personal data in accordance with the Addendum. Data importer may update the technical and organizational measures from time to time, provided that the overall level of protection is not reduced.
Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the Addendum.
Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows: The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.
Table 1: The start date in Table 1 is the effective date of the Addendum. All other information required by Table 1 is set forth in Annex I, Section A of the Clauses.
Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the Appendix Information, effective as of the effective date of the Addendum.
Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.
Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.
This Data Processing Addendum (including its Exhibits) (“Addendum”) forms part of and is subject to the terms and conditions of the olive Master Services Agreement or other agreement for the Services (the “MSA”), together with the applicable Order Form(s), which incorporate this Addendum by reference (the “Agreement”) by and between the olive customer that has executed the Agreement (“Customer”) and olive travel, Inc. (“olive”).
1. Subject Matter and Duration
Subject Matter.
This Addendum reflects the parties’ commitment to abide by Data Protection Laws concerning the Processing of Customer Personal Data in connection with olive’s execution of the Agreement. All capitalized terms that are not expressly defined in this Addendum will have the meanings given to them in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement (including any Order Form), this Addendum shall control. This Addendum is the data processing addendum referred to in the Agreement. As between olive and Customer, it replaces any other data processing addendum or terms that olive makes available on its website or by reference, including any later version of them. This Addendum may be amended only by a written instrument signed by both parties; changes that olive makes to the Agreement or to its standard terms by posting them do not amend it.
The subject matter, nature and purposes of processing, types of personal data, categories of data subjects, and duration of processing shall be specified in a completed Processing Description Schedule agreed by the Parties before processing starts, in accordance with Article 28(3) GDPR. The Schedule shall reflect the actual Services and data flows.
Duration and Survival.
olive will Process Customer Personal Data until the relationship terminates as specified in the Agreement.
2. Definitions
For the purposes of this Addendum:
"Customer Personal Data"means Customer Data that is Personal Data Processed by olive on behalf of Customer to provide the Services. This definition includes any personal data processed by olive on behalf of Customer, including personal data within Operational Metrics, regardless of the MSA definition of Customer Data.
"Data Protection Laws"means the applicable data privacy, data protection, and cybersecurity laws, rules, and regulations to which the Customer Personal Data are subject.
"Personal Data"has the meaning assigned under applicable Data Protection Laws.
"Process" or "Processing"means any operation performed on Personal Data (e.g., collection, storage, use, disclosure, deletion).
"Security Incident(s)"means the breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by olive or its Subprocessors. Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, denial-of-service attacks and unsuccessful log-in attempts.
"Services"means the olive platform, technology, and related services under the Agreement.
"Subprocessor(s)"means olive’s authorized vendors and third-party service providers that Process Customer Personal Data.
3. Processing Terms for Customer Personal Data
Documented Instructions.olive shall Process Customer Personal Data to provide the Services in accordance with the Agreement, this Addendum, and Customer’s instructions.
olive shall process Customer Personal Data only on documented instructions from Customer, including with regard to transfers of personal data to a third country or an international organisation, unless required by Union or Member State law, or other applicable law, to which olive is subject. In such a case, olive shall inform Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest. olive shall immediately inform Customer if, in its opinion, an instruction infringes the GDPR or other applicable Union or Member State data protection provisions. Nothing in this Section limits Clause 15 of the Clauses. Customer's documented instructions are the Agreement (including applicable Order Forms), this Addendum, and Customer's configuration and use of the Services.
Authorization to Use Sub-processors.Customer authorizes olive to engage Sub-processors.
Subprocessor Compliance.olive shall impose, by written contract, the same data protection obligations as set out in this Addendum, in particular sufficient guarantees to implement appropriate technical and organizational measures, and, subject to Section 13, remain fully liable to Customer for the performance of each Sub-processor’s obligations.
Right to Object. olive will notify Customer of any intended addition or replacement of Sub-processors at least thirty (30) days in advance by updating its Sub-processor list at https://www.tryolive.com/sub-processors, which identifies each Sub-processor and its processing activities. Customer may object on reasonable data protection grounds within the notice period. olive may use the Sub-processor during the notice period. If Customer objects and the parties cannot resolve the objection in good faith, olive shall, at its option, either cease using the Sub-processor for Customer Personal Data within ninety (90) days after the objection or permit Customer to terminate only the affected Services, with a pro-rata refund of prepaid fees for the terminated period.
4. Confidentiality: All olive personnel authorized to Process Customer Personal Data shall have committed themselves to confidentiality or be under an appropriate statutory obligation of confidentiality.
5. Data Subject Rights and Compliance
olive shall provide reasonable assistance with data subject rights requests. Olive shall provide support for Data Protection Impact Assessments and consultations with regulators. Olive shall provide documentation reasonably necessary to demonstrate compliance. olive shall provide the foregoing assistance and support at no charge for up to ten (10) hours of olive personnel time per contract year (each twelve-month period beginning on the effective date of the Order Form), and thereafter at USD 250 per hour. olive will notify Customer when it has used 90% of the included hours. This paragraph does not apply to assistance required as a result of a Security Incident to the extent caused by olive’s or its Subprocessors’ breach of this Addendum.
6. California Specific Terms (CCPA/CPRA)To the extent olive’s Processing is subject to CCPA/CPRA, olive shall:Not “sell” or “share” Customer Personal Data. Only retain, use, or disclose such data to provide the Services or as permitted by law. Provide equivalent or higher protections required by the CCPA.
7. Permitted Use
Provision of the Services. olive shall process Customer Personal Data only on Customer’s documented instructions as set out in the Agreement and this Addendum, to provide, secure, and support the Services, including security and fraud prevention, and as required by applicable law, subject to Section 3 (Documented Instructions). olive shall not process Customer Personal Data for its own purposes except as permitted in this Section 7.
Analytics and Form-Field Masking. olive may use analytics and similar technologies in connection with the Services only (a) where Data Protection Laws require consent, to the extent Customer has obtained that consent; and (b) with masking of form fields in session recordings so that the content of fields in which individuals enter data is not captured by those recordings. Analytics events may include contact details that the individual submits in the booking flow, which olive processes as Customer's processor in accordance with this Addendum and the Processing Description Schedule.
Anonymized and Aggregated Data. Customer instructs olive to anonymize and aggregate Customer Personal Data. “Anonymized Data” means data that does not identify, and cannot reasonably be used to identify, Customer, any individual, or any other third party, whether alone or in combination with other reasonably available information. olive may use Anonymized Data or disclose it in a form that does not identify Customer or any individual. Anonymized Data is not Customer Personal Data.
No Training on Identifiable Data. olive shall not use Customer Personal Data (including in pseudonymized form) to train or fine-tune any machine learning model or artificial intelligence system that olive makes available to, or uses for the benefit of, any person other than Customer. For clarity, this Section 7 does not restrict: (a) olive's use of Customer Personal Data as input to such a system in order to provide, secure, and support the Services to Customer, provided that olive contractually requires any third-party provider of that system not to use the input to train its models; (b) olive's evaluation of the quality, security, and performance of the Services as provided to Customer; or (c) use of Anonymized Data.
No Sale or Advertising. (a) olive shall not sell Customer Personal Data or use it for advertising or marketing on olive’s own behalf or on behalf of any third party other than Customer. “Sell” and “share” have the meanings given in the CCPA.(b) The following are Processing on Customer’s documented instructions and on Customer’s behalf, and are not a sale or sharing by olive or advertising or marketing on olive’s behalf: (i) transmitting event data (such as purchase and add-to-cart events) from the Services to analytics, advertising-measurement, or tag-management accounts or tools owned or controlled by Customer (“Customer Tags”); and (ii) recording advertising click identifiers and similar campaign identifiers and using them solely to attribute bookings to Customer’s own advertising campaigns and to report the results to Customer. Measuring the performance of Customer’s own advertising is not advertising on olive’s behalf.(c) Customer is responsible for Customer Tags, including its agreements with their providers, any consent they require under Data Protection Laws, and its own use of the data they receive. Providers of Customer Tags are not Subprocessors of olive. olive shall not use data described in paragraph (b) for any other purpose.
8. Security and Incidents
olive shall implement appropriate technical and organizational measures to safeguard Customer Personal Data.
Upon becoming aware of a Security Incident, olive will notify Customer without undue delay and will provide the information reasonably necessary for Customer to meet its obligations under Articles 33 and 34 GDPR. The fees in Sections 5 and 10 do not apply to, and olive shall not condition or delay, any assistance, information, or audit that Data Protection Laws or the Standard Contractual Clauses require olive to provide without charge or within a specified period. olive may charge for time that exceeds what is required in this way.
9. Cross-Border Transfers
Customer authorizes olive and its Sub-processors to transfer data internationally, including to the U.S., in compliance with Chapter V GDPR. Where required, transfers shall be governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two), as supplemented in Exhibit A.
10. Audits and Assessments
Customer may exercise audit rights as provided under Data Protection Laws, subject to reasonable conditions (no more than once per year, with at least thirty (30) days’ advance notice), save where an additional audit is required following a Security Incident or by a supervisory authority. Customer shall reimburse olive for olive’s time spent in connection with any audit, including reviewing and responding to audit requests and questionnaires and participating in inspections, at USD 250 per hour, together with olive’s reasonable out-of-pocket expenses, save where an additional audit is required following a Security Incident or by a supervisory authority. Before the audit begins, olive will provide a good-faith estimate of the hours required, and the parties will agree the scope, timing, and duration in advance. Customer shall bear the fees and expenses of any third-party auditor it engages. Costs, additional audit rights, and liability relating to a Security Incident apply to the extent it results from olive's or its Sub-processors' breach of this Addendum, and not to the extent it results from Customer's own acts or omissions, including compromised Customer credentials or systems.
11. Data Deletion
Within ninety (90) days after termination of the Agreement, olive shall, at Customer's choice, return or delete all Customer Personal Data from its systems, except as required by Union or Member State law or other applicable law to which olive is subject. olive will instruct its Sub-processors to delete such data and will flow this obligation down to them by written contract. Retained backup copies shall be securely isolated, deleted in accordance with the documented retention schedule, and not restored to active processing except where necessary. olive will certify deletion in writing on request. Deletion requested by Customer during the Term applies to the specific records or requests identified and shall be completed within ninety (90) days of the request.
12. Customer’s Obligations
Customer represents and warrants that: It complies with Data Protection Laws. It provides adequate privacy notices and lawful bases for Processing. Its documented instructions to olive comply with Data Protection Laws.
13. Limitation of Liability
(a) Each party’s liability arising out of or related to this Addendum (including the Standard Contractual Clauses), whether in contract, tort, or otherwise, is subject to the limitations, exclusions, and exceptions of liability in the Agreement, as if set out in full in this Addendum.
(b) Liability under this Addendum and the Agreement is aggregated. Amounts paid or payable under one count toward the limits in the other, and this Addendum does not create separate or additional limits.
(c) Subject to paragraph (e), the limitation of liability provisions of the Agreement prevail over any conflicting provision of this Addendum as between the parties, notwithstanding Section 1.
(d) A Security Incident is not a breach of the Agreement’s confidentiality provisions for purposes of any exception to those limitations.
(e) Nothing in this Section limits (i) either party’s liability to data subjects under Clause 12 of the Standard Contractual Clauses, or (ii) any liability that cannot be limited under applicable law.
EXHIBIT A TO THE DATA PROCESSING ADDENDUM
olive shall implement and document technical and organizational measures appropriate to the risks under Article 32 GDPR, as described in Annex II.
This Exhibit A forms part of the Addendum and supplements the Standard Contractual Clauses. Capitalized terms not defined in this Exhibit A have the meaning set forth in the Addendum. The parties agree that the following terms shall supplement the Standard Contractual Clauses:
Supplemental Terms. The parties agree that: (i) a new Clause 1(e) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses also apply mutatis mutandis to the Parties’ processing of personal data that is subject to the Swiss Federal Act on Data Protection. Where applicable, references to EU Member State law or EU supervisory authorities shall be modified to include the appropriate reference under Swiss law as it relates to transfers of personal data that are subject to the Swiss Federal Act on Data Protection.”; (ii) a new Clause 1(f) is added to the Standard Contractual Clauses which shall read: “To the extent applicable hereunder, these Clauses, as supplemented by Annex III, also apply mutatis mutandis to the Parties’ processing of personal data that is subject to UK Data Protection Laws (as defined in Annex III).”; (iii) the optional text in Clause 7 is deleted; (iv) Option 1 in Clause 9 is struck and Option 2 is kept, and data importer must notify data exporter of any new subprocessors in accordance with Section 3 of the Addendum; (v) the optional text in Clause 11 is deleted; and (vi) in Clauses 17 and 18, the governing law and the competent courts are those of the EU state identified in the applicable Order Form (for EEA transfers), Switzerland (for Swiss transfers), or England and Wales (for UK transfers). Annex I. Annex I to the Standard Contractual Clauses shall read as follows:
A. List of Parties
Data Exporter: Customer. (Controller).
Customer.Address: As set forth in the Notices section of the Agreement.Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.Activities relevant to the data transferred under these Clauses: The Services. Role: Controller.
Data Importer: olive. (Processor).
Address: As set forth in the Notices section of the Agreement.Contact person’s name, position, and contact details: As set forth in the Notices section of the Agreement.Activities relevant to the data transferred under these Clauses: The Services. Role: Processor.
B. Description of the Transfer:
Categories of data subjects whose personal data is transferred: The categories of data subjects whose personal data is transferred under the Clauses.Categories of personal data transferred: The categories of personal data transferred under the Clauses. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: To the parties knowledge, no sensitive data is transferred. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Personal data is transferred in accordance with the standard functionality of the Services, or as otherwise agreed upon by the parties.Nature of the processing: The Services.Purpose(s) of the data transfer and further processing: The Services.The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Data importer will retain personal data in accordance with the Addendum. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: For the subject matter, nature, and duration as identified above.
C. Competent Supervisory Authority:
The supervisory authority shall be specified in the applicable Order Form. If no supervisory authority is mandated by the applicable Order Form, then the Irish Data Protection Commission (DPC), and if this is not possible, then as otherwise agreed by the parties.
D. Additional Data Transfer Impact Assessment Questions:
- Will data importer process any personal data under the Clauses about a non-United States person that is “foreign intelligence information” as defined by 50 U.S.C. § 1801(e)?
Data importer does not process Customer Personal Data for the purpose of collecting or analyzing foreign intelligence information. As of the effective date of the Addendum, data importer has no actual knowledge that the Customer Personal Data it processes under the Clauses constitutes “foreign intelligence information.”
- Is data importer subject to any laws in a country outside of the European Economic Area, Switzerland, and/or the United Kingdom where personal data is stored or accessed from that would interfere with data importer fulfilling its obligations under the Clauses? For example, FISA Section 702. If yes, please list these laws:
Data importer is a U.S. company and is subject to U.S. laws under which public authorities may request or compel disclosure of data held by service providers, including 18 U.S.C. § 2703 and, to the extent data importer or any of its Subprocessors is or is deemed an “electronic communication service provider” within the meaning of 50 U.S.C. § 1881(b)(4), FISA Section 702. To data importer’s knowledge, and to the extent permitted by law, as of the effective date of the Addendum, no court has determined that data importer is subject to process issued under FISA Section 702 and no such proceeding is pending. Based on the nature of the Customer Personal Data, the safeguards in the Addendum and the Clauses (including data importer’s obligations under Clause 15), and the safeguards applicable under U.S. law, data importer has no reason to believe that these laws prevent it from fulfilling its obligations under the Clauses.
- Has data importer ever received a request from public authorities for information pursuant to the laws contemplated by the question above? If yes, please explain:
As of the effective date of the Addendum, and to data importer’s knowledge after reasonable inquiry of the personnel responsible for responding to legal process, data importer has not received any request or order from a public authority under the laws identified in response to the question above seeking Customer Personal Data.
- Has data importer ever received a request from public authorities for personal data of individuals located in European Economic Area, Switzerland, and/or the United Kingdom?
If yes, please explain: As of the effective date of the Addendum, and to data importer’s knowledge after reasonable inquiry of the personnel responsible for responding to legal process, data importer has not received any request or order from a public authority seeking Customer Personal Data relating to individuals located in the European Economic Area, Switzerland, or the United Kingdom.
E. Data Transfer Impact Assessment Outcome:
Data importer will provide to data exporter, before Processing begins and together with the Processing Description Schedule, a documented, transfer-specific assessment of the laws and practices of the countries to which personal data is transferred, including relevant supplementary measures (the "Assessment"). The parties' conclusion under Clause 14 of the Clauses is set out in the Assessment, and this Annex I.E refers to it. The parties will keep the Assessment under review, and data importer will update it on a material change in the relevant laws or practices or in the transfers.
F. Clarifying Terms:
The parties agree that: (i) the certification of deletion required by Clause 8.5 and Clause 16(d) of the Clauses will be provided upon data exporter’s written request; (ii) the measures data importer is required to take under Clause 8.6(c) of the Clauses will only cover data importer’s impacted systems; (iii) the audit described in Clause 8.9 of the Clauses shall be carried out in accordance with Section 10 of the Addendum; (iv) the termination rights in Clauses 14(f) and 16(c) of the Clauses apply as written in the Clauses; where data exporter terminates under those Clauses, termination is limited to the affected Services or transfers, with a pro-rata refund of prepaid fees for the terminated period, and is available only after the parties have worked in good faith for thirty (30) days to put an alternative transfer mechanism or supplementary measures in place; (v) unless otherwise stated by data importer, data exporter will be responsible for communicating with data subjects pursuant to Clause 15.1(a) of the Clauses; (vi) the information required under Clause 15.1(c) of the Clauses will be provided upon data exporter’s written request; and (vii) data importer shall bear all reasonable costs and expenses incurred by data importer in connection with the performance of data importer’s obligations under Clause 15.1(b) and Clause 15.2 of the Clauses.
Annex II. Annex II of the Standard Contractual Clauses shall read as follows: Data importer shall implement and maintain technical and organizational measures designed to protect personal data in accordance with the Addendum. Data importer may update the technical and organizational measures from time to time, provided that the overall level of protection is not reduced.
Pursuant to Clause 10(b), data importer will provide data exporter assistance with data subject requests in accordance with the Addendum.
Annex III. A new Annex III shall be added to the Standard Contractual Clauses and shall read as follows: The UK Information Commissioner’s Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) is incorporated herein by reference.
Table 1: The start date in Table 1 is the effective date of the Addendum. All other information required by Table 1 is set forth in Annex I, Section A of the Clauses.
Table 2: The UK Addendum forms part of the version of the Approved EU SCCs which this UK Addendum is appended to including the Appendix Information, effective as of the effective date of the Addendum.
Table 3: The information required by Table 3 is set forth in Annex I and II to the Clauses.
Table 4: The parties agree that Importer may end the UK Addendum as set out in Section 19.