M Maytabi
Log in

Maytabi — Data Processing Agreement (DPA)

Maytabi acts as processor for the personal data a team enters about its crew; the team is the controller. This DPA forms part of the Terms. Effective date: 28 June 2026.

1. Roles & scope

The Customer (team) is the controller; Maytabi, operated by its founder, is the processor (contact hello@travelcoordination.com). Maytabi processes personal data only to provide the service and only on the Customer's documented instructions (the Terms, the product configuration, and any written instruction). Maytabi is controller for account/ billing data (covered by the Privacy Policy).

2. Subject-matter, duration, nature & purpose

3. Maytabi's obligations

  1. Process only on documented instructions; notify the Customer if an instruction appears unlawful.
  2. Ensure persons authorised to process are bound by confidentiality.
  3. Implement appropriate technical & organisational measures (Annex A), including AES-256 encryption at rest for passport/ID/licence numbers, DOB and booking references; EU-jurisdiction storage for confirmation files; role-based access; audited admin actions; and no AI/LLM processing of personal data (travel plans are produced by deterministic software; no personal data is sent to any AI).
  4. Engage sub-processors only under written terms no less protective than this DPA, and maintain a current sub-processor list (Annex B); give the Customer notice of changes and a right to object.
  5. Assist the Customer, taking into account the nature of processing, with data-subject requests and with security, breach-notification and DPIA obligations.
  6. Notify the Customer without undue delay after becoming aware of a personal-data breach.
  7. At the Customer's choice, delete or return all personal data at the end of the service, and delete existing copies (save where legally required to retain). The product provides one-click export and erasure to effect this.
  8. Make available information necessary to demonstrate compliance and allow for audits. On reasonable written request (no more than once per year, with at least 30 days' notice), Maytabi will provide the Customer with the information reasonably necessary to demonstrate compliance with this DPA. Where the Customer reasonably requires further audit, this may be satisfied by Maytabi providing existing documentation or a written response to a security questionnaire; any on-site audit is by prior written agreement, at the Customer's cost, during business hours, and without disrupting the service.

4. International transfers

Where processing occurs outside the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses. No personal data is sent to any AI service.

5. Honest statement on storage location

The application database (Cloudflare KV) is globally replicated and not region-restricted; Maytabi mitigates this by encrypting sensitive personal data at rest so that replicated bytes are unreadable without the key. Confirmation files use EU-jurisdiction storage. Customers whose own obligations require strict data residency should contact us to discuss options.

Annex A — Technical & organisational measures

Encryption at rest (AES-256-GCM) for sensitive identifiers, DOB and PNRs · EU-jurisdiction file storage · per-team data isolation · role-based access control · audited admin/"view-as" actions · no AI/LLM in the processing path (no personal data sent to any AI) · secret-managed keys, never stored with the data · least-data collection · export & erasure tooling.

Annex B — Sub-processors

Cloudflare (hosting/KV/R2-EU — sensitive fields encrypted) · LetsFG (flight search — route+date only) · AeroDataBox (schedule — route+date+flight numbers) · Resend (email — address only). Current list on request. No AI/LLM provider is used — flight matching is deterministic software.