WanderBuddy Data Processing Terms for Agencies

1. What these Data Terms cover

These Data Processing Terms ("Data Terms") are between WanderBuddy Inc ("WanderBuddy", "we", "us") and the agency that uses our services for agencies ("you"). They cover the personal data of your travellers, enquirers, guests and other contacts that you or your team put into the services, or that reaches the services through a connection you set up, such as your WhatsApp number or Instagram account ("Traveller Data").

When a traveller makes their own WanderBuddy app account, what they give us under that account (their profile, and their own messages and photos in the app) is covered by our Privacy Policy, not these Data Terms.

2. Your role and ours

• You decide why and how Traveller Data is used. Under data protection law you are its controller (some laws say "data fiduciary" or "organisation"). We handle it for you as your processor (some laws say "data processor" or "data intermediary").
• You are responsible for having a lawful basis to collect Traveller Data and put it into the services, and for telling your travellers how you use it, including that you use service providers and AI tools. Section 12 has a short notice you can use.
• These Data Terms are written to meet the processor rules of the data protection laws that apply to agencies we serve, such as the Personal Data Protection Acts of Singapore, Malaysia and Thailand and the Data Privacy Act of the Philippines.

3. What we do with Traveller Data

• We handle Traveller Data only to provide, secure and support the services for you, on your instructions. Your instructions are these Data Terms, the Terms for Agencies, your order, and what you and your team do in the services, such as saving a booking, sending a message or asking the assistant a question.
• We don't sell Traveller Data, don't use it for advertising and don't use it to train AI models.
• We may use counts and measures that identify no one, such as how many enquiries a screen handles, to run and improve the services.
• If we think an instruction of yours breaks data protection law, we will tell you.
• If the law makes us hand Traveller Data to an authority, we will tell you first unless the law forbids it.

4. Our people

Only WanderBuddy staff and contractors who need Traveller Data to run or support the services can reach it, and they are bound to keep it confidential. We open your records only to give support you ask for, to fix a fault, to keep the services secure, or where the law requires it.

5. AI features

• Some features send part of your records to an AI model to produce an answer: Ask WanderBuddy, drafted replies, itinerary, cost and invoice tools, reading a booking or voucher, search, and the trip assistant. Only the parts needed for that request are sent.
• Before anything is sent, passport numbers, national ID numbers and payment card numbers are removed automatically.
• Our AI providers do not use your data to train their models. Requests that go through OpenRouter only go to providers that keep no copy once they have answered.
• AI can be wrong, so check its work before you send or rely on it (section 7 of the Terms for Agencies).

6. The providers we use (sub-processors)

You agree that we may use the providers below to run the services. Each one is bound by written terms that protect Traveller Data at least as well as these Data Terms, and we stay responsible to you for their work.

• When you connect your own WhatsApp number, Instagram account or Google Drive, that provider works for you under your own account with them, not as our sub-processor. Files you keep in your own Google Drive stay in your Drive; we keep only their names, types and links.
• We will tell you by email or in the CRM at least 30 days before we add or replace a sub-processor, and update this page. If you object for a reasonable data protection reason, we will work with you on it. If we can't solve it, you can stop using the feature concerned or end the services.

7. Security

We protect Traveller Data with measures that fit the risk, including:

• HTTPS for everything that travels, and encryption at rest by our database host;
• row-level security in the database, so each agency can only reach its own records, and roles inside your agency, so each teammate only reaches what their role allows;
• passwords handled by our sign-in provider and never stored in plain text, and the access tokens for your connected accounts kept in an encrypted vault;
• passport, ID and card numbers removed before any AI request (section 5).

More detail is on our security page.

8. If something goes wrong (breaches)

If we become aware of a security breach that leads to Traveller Data being lost, changed, disclosed or accessed without permission, we will tell you without undue delay and in any case within 48 hours. We will tell you what we know, what we are doing about it, and keep you updated, and we will help you meet any duty you have to tell a regulator or your travellers.

9. Requests from your travellers

• When a traveller asks you to see, correct or delete their data, you can do most of it yourself in the CRM: open, edit or delete their contact, enquiry or trip.
• We help with anything you can't do yourself. If a traveller sends us a request about Traveller Data, we pass it to you and do not answer it ourselves unless the law requires us to.

10. Where Traveller Data is kept and sent

Traveller Data is stored with Supabase in Japan. The providers in section 6 handle some of it in other countries, including the United States. Where the law asks for safeguards for these transfers, we rely on the ones it allows, such as contracts that require the receiver to protect the data to a comparable standard.

11. Keeping and deleting

• We keep Traveller Data while you use the services. You can delete records at any time in the CRM.
• When the services end, you can ask us for a copy of your records within 30 days. We then delete Traveller Data within 90 days, unless the law requires us to keep it longer. Copies in our backups are overwritten as the backups roll over.

12. Telling your travellers

You are the one your travellers deal with, so the notice comes from you. If you don't already have one, this short notice is a starting point. Change it to fit how you work and the law where you operate, and put it where travellers see it, such as your booking form, your website or your first WhatsApp message.

We use trusted service providers, including WanderBuddy, to manage your booking, documents and messages with us. Some of these tools use AI to help us reply to you and plan your trip. Your details are used only for your trips with us and are never sold. Passport, ID and card numbers are never sent to AI tools. To see, change or delete your details, just message us.

The same notice is in your CRM under Settings, with a button to copy it.

13. Information and audits

We will answer reasonable written questions about how we protect Traveller Data and give you the information you need to show that you meet your own duties. Write to [email protected]. We can also take part in a reasonable review once a year, or after a breach or when a regulator asks for one, at a time we agree.

14. How these Data Terms fit with the rest

• Where these Data Terms and the Terms for Agencies say different things about Traveller Data, these Data Terms win.
• We may update these Data Terms. Each version has a date. We will tell you by email or in the CRM at least 30 days before a change that gives Traveller Data less protection takes effect.

15. Accepting these Data Terms

Someone who can change your agency's CRM Settings accepts these Data Terms for your agency in the CRM. By accepting, they confirm they are allowed to do so for the agency. The CRM keeps a record of who accepted, when, from which network address, and which version.

Contact

WanderBuddy Inc · [email protected]