This Data Processing Agreement (“DPA”) forms part of the iTravel ERP Terms of Service between Innaun Private Limited (“Processor”, “Innaun”) and the subscribing business (“Controller”, “Customer”). It applies whenever Innaun processes personal data within Customer Data on the Customer’s behalf. Terms not defined here have the meaning given in the Terms of Service or the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, as amended (“PDPA”).
1. Roles and scope
1.1 The Customer is the controller and Innaun is the processor of personal data in Customer Data.
1.2 The subject matter, nature, purpose, categories of data and data subjects, and duration of processing are set out in Annex 1.
1.3 Each party will comply with the data protection law that applies to it.
2. Customer responsibilities
The Customer:
- determines the purposes and means of processing and is responsible for having a lawful basis for it, including for passport, visa, identity and any sensitive documents it uploads;
- gives data subjects (its customers, passengers, staff and others) the privacy notices the law requires, including notice that their data is processed using a third-party platform and that messages may be sent through it;
- ensures that the data it enters is accurate and limited to what it needs;
- manages its Users’ access, roles and passwords, and keeps two-factor authentication enabled for administrators; and
- handles requests from its own data subjects.
3. Innaun’s obligations
Innaun will:
- process personal data only on the Customer’s documented instructions. The Terms of Service, this DPA and the Customer’s use and configuration of the Service are the Customer’s complete instructions. Innaun will tell the Customer if it believes an instruction breaks the law;
- ensure that its personnel authorised to process the data are bound by confidentiality;
- implement the security measures in Annex 2;
- use sub-processors only as described in Section 4;
- taking into account the nature of the processing, assist the Customer, by appropriate technical and organisational measures and through the Service’s features, in responding to data subject requests, and with security, breach notification and impact assessments, as reasonably required. Assistance beyond the Service’s standard features may be charged at our standard rates;
- notify the Customer of a personal data breach affecting Customer Data without undue delay and in any case within 72 hours of becoming aware of it, with the information reasonably available, and keep the Customer updated;
- make available information reasonably necessary to demonstrate compliance with this DPA (Section 6); and
- at the end of the Service, return or delete personal data as set out in Section 7.
4. Sub-processors
4.1 The Customer authorises Innaun to use the sub-processors listed at itravelerp.com/legal/sub-processors.
4.2 Innaun will give at least 14 days’ notice of a new or replacement sub-processor by updating that page and emailing the account owner. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may cancel the affected Service and receive a pro-rata refund of prepaid fees for the remaining period.
4.3 Innaun will impose data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.
5. International transfers
The Service is hosted in AWS Asia Pacific (Mumbai), India, and some sub-processors process data in other countries as listed on the Sub-processors page. The Customer authorises these transfers. Innaun will ensure that transfers outside Sri Lanka are made in accordance with the PDPA, including through contractual safeguards, and will cooperate with the Customer on any additional measures required by the Data Protection Authority of Sri Lanka.
6. Audits
6.1 On written request no more than once a year, Innaun will answer a reasonable security questionnaire and provide relevant summaries of its security measures.
6.2 Where required by law or by a regulator, or following a personal data breach caused by Innaun, the Customer may carry out an audit, at its own cost, on at least 30 days’ notice, during business hours, without access to other customers’ data, and subject to confidentiality. Innaun may charge for time spent beyond one business day.
7. Return and deletion
7.1 During the subscription, the Customer can export its data using the Service’s features.
7.2 After the subscription ends, the account is deactivated and the data is retained. The Customer may request a full export within 90 days, and may request deletion at any time. On a deletion request, Innaun will delete the Customer Data from the live system within 30 days, and it will be removed from backups as they expire (within 14 months at most), unless the law requires it to be kept.
7.3 If the account remains deactivated, Innaun may delete the Customer Data after giving the account owner at least 30 days’ written notice. Exports are prepared by Innaun on request and supplied in a commonly used electronic format together with uploaded documents. Platform invoices, payment records and audit logs relating to the subscription are kept as the law requires.
8. Liability and precedence
Each party’s liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.
9. Term
This DPA applies for as long as Innaun processes personal data on the Customer’s behalf.
Annex 1 — Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the iTravel ERP travel agency management service |
| Nature of processing | Hosting, storage, retrieval, organisation, display, generation of documents (invoices, receipts, quotations), sending of email and SMS notifications on the Customer’s instructions, backup, support and deletion |
| Purpose | To enable the Customer to manage its travel sales, visa cases, bookings, payments, vendors, staff and reporting |
| Data subjects | The Customer’s customers and passengers; sub-agents and their contacts; vendors and suppliers and their contacts; the Customer’s employees and Users |
| Categories of personal data | Names, contact details (phone, email, address), date of birth, nationality, passport and other identity document details and copies, visa application details and documents, travel itineraries, ticket and booking references, payment and transaction records, employee records (if HR modules are used), user account and audit log data |
| Sensitive data | The Customer may upload documents that contain sensitive information (for example health or financial information required for visa applications). The Customer is responsible for ensuring it has a lawful basis for this |
| Duration | The term of the subscription plus the retention period in Section 7 |
Annex 2 — Security measures
- Data separation: each customer’s data is separated at database level with row-level security; tested automatically.
- Encryption: HTTPS/TLS for all traffic; encryption at rest for databases, files and backups; TLS-verified database connections.
- Access control: role-based permissions; two-factor authentication; sign-in rate limiting and temporary account lockout after repeated failed sign-ins; host-only secure session cookies.
- Innaun staff access: limited to authorised personnel with two-factor authentication; support access to customer accounts is read-only, limited to 30-minute sessions, can be switched off by the Customer, and is recorded in a support access log visible to the Customer.
- Infrastructure: private database network; firewall limited to required traffic through Cloudflare; no direct public server access; automatic security updates.
- Monitoring: centralised logging and alerting; uptime monitoring; personal contact data excluded from application logs.
- Backups and recovery: daily encrypted backups with an off-site copy; restore procedure tested.
- Files: uploaded documents stored privately and served only to authorised Users of the owning Customer.
- Incident response: documented procedure for investigating and notifying personal data breaches.
- Personnel: confidentiality obligations for all staff and contractors with access.