Data processing addendum

This summary describes how Aviagrid processes personal data inside the Aviagrid product on behalf of its customers. The signed data processing addendum (DPA) in each customer agreement is the binding version; ask privacy@aviagrid.com for a copy.

Roles

The customer is the controller of data it puts into Aviagrid, such as client contacts, crew and passenger details and supplier records. Aviagrid is the processor and acts only on the customer's documented instructions.

What we process

Contact details of the customer's staff, clients and suppliers; crew and passenger names, nationalities and travel document details; trip, schedule and billing records; messages received through connected mailboxes and WhatsApp Business.

Security measures

Tenant isolation per customer, role-based access, single sign-on, audit logging, encryption in transit (TLS 1.2+) and at rest (AES-256), backups in a separate region, and staff access limited to named support cases. See security.

AI processing

AI features read messages to draft trips for a person to approve. Customer data is not used to train models shared with other customers.

Sub-processors

| Sub-processor | Purpose | Location | | --- | --- | --- | | Google Cloud | Hosting, storage, AI inference | Region agreed with the customer | | Email delivery provider | Transactional email | United States / EU | | Zoho (when enabled by the customer) | Accounting sync | Customer's Zoho data centre | | Meta (when enabled by the customer) | WhatsApp Business messaging | Per Meta's terms |

We give 30 days' notice before adding a sub-processor.

Transfers, deletion and audits

Transfers outside the EU, UK or UAE rely on standard contractual clauses or adequacy decisions. At the end of the contract we return and delete customer data within 30 days, except where the law requires us to keep it. Customers may audit our compliance as set out in the DPA.