Home › Data processing (DPA)
Data processing (DPA)
Last updated 12 November 2026
When we run your enquiry desk, widget or website, your customers’ personal data belongs to you. You are the controller; we are your processor. We sign a data processing agreement (DPA) with every client before go-live, based on Article 28 of the UK GDPR.
Main terms of our DPA
- Instructions: we process your customers’ data only to provide the services in your agreement and on your documented instructions.
- Confidentiality: everyone who can access the data is bound by confidentiality.
- Security: encrypted connections (HTTPS) throughout, access limited to named people, and separate configuration and payment credentials for each client.
- Sub-processors: we use only the providers listed below, and tell you before adding or replacing one so you can object.
- International transfers: where a provider is outside the UK, transfers rely on UK adequacy regulations or the International Data Transfer Addendum.
- Your customers’ rights: we help you answer access, correction and deletion requests.
- Breaches: we tell you without undue delay if we become aware of a personal data breach affecting your data.
- End of contract: we return or delete your data, as you choose, unless the law requires us to keep it.
- Audits: we give you the information you need to show compliance.
What data is involved
- Enquiries: customer name, contact details, travel dates, group details and messages they send through your forms.
- Widget requests: the text a visitor types, with no name or contact details; a daily, one-way hashed counter for rate limits.
- Payments: handled by Stripe under your own Stripe account; we see payment status and amounts, not card details.
AI and your data
Enquiry messages and widget requests are sent to an AI model to draft suggestions and replies. We send only what is needed for the draft, and we do not use your customers’ data to train our own models. The AI providers are listed below.
Sub-processors
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Website hosting, CDN and the trip engine (Workers) | Global edge network; US company |
| Contabo GmbH | Virtual server hosting the enquiry database and inbox (form.highland-travel.com) | United Kingdom (server location) |
| DeepSeek | AI model used to draft itineraries and replies | China |
| Agnes AI | Back-up AI model used if the primary model is unavailable | Outside the UK |
| Resend | Sending notification emails | US |
| Telegram | Internal notification of new enquiries to the operator | Outside the UK |
| Stripe | Deposit and balance payments, contracted directly by each operator under their own Stripe account | Ireland / US |
To receive the full DPA text, ask on your diagnostic call or in your quote.