Data processing agreement
Last updated 12 October 2026
This agreement forms part of Sightlane’s Terms of service. It applies whenever Sightlane processes personal data on behalf of a company that uses it, and meets the requirements of Article 28 of the GDPR and the UK GDPR. The company is the controller; Sightlane is the processor.
What is processed
| Subject matter | Providing Sightlane, the trip operations service, to the company |
| Duration | For as long as the company uses Sightlane, plus up to 30 days afterwards for export, then deletion |
| Nature and purpose | Storing, organising, displaying and sending trip information so the company can plan and run trips |
| People concerned | Passengers and travelling groups, lead contacts, emergency contacts, booking agency staff, drivers, supplier contacts, and the company’s own staff |
| Types of data | Names, phone numbers, email addresses, travel dates, flights, pickup and accommodation details, notes, and documents the company uploads |
| Special category data | Dietary and accessibility notes can reveal health information. The company should record only what the trip needs. |
Sightlane’s commitments
- Process personal data only on the company’s documented instructions, which are these terms and the company’s use of the app, unless the law requires otherwise, in which case we tell the company first where the law allows.
- Make sure anyone who can access the data is bound to confidentiality.
- Keep the data secure, using the measures listed below.
- Use other processors only as described below.
- Help the company respond to requests from the people concerned, such as access or deletion, mostly through the app’s own export and delete tools.
- Help the company with security, breach notification and data protection impact assessments, as far as Sightlane’s role allows.
- At the end, delete or return the data as the company chooses, unless the law requires it to be kept.
- Give the company the information it needs to show these commitments are met, and allow reasonable audits, normally by written questions and the documents we hold.
Other processors
The company authorises Sightlane to use the subprocessors listed on the Subprocessors page. Sightlane puts data protection terms in place with each that are no weaker than this agreement, and stays responsible for them. We will give at least 14 days’ notice before adding or replacing one, so the company can object; if we cannot address a reasonable objection, the company can end the agreement.
Transfers outside the UK and EU
The database is hosted in Ireland. Where a subprocessor or Sightlane’s own support access involves a country without an adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), or by the EU-US Data Privacy Framework where the recipient is certified.
Personal data breaches
Sightlane will tell the company without undue delay, and in any case within 48 hours of becoming aware of a breach affecting its data, with what is known about what happened, the data and people affected, and what is being done.
Security measures
- Each company’s data separated at the database level by row level security, with every permission enforced by the database.
- Encryption in transit (HTTPS) and at rest (by the hosting provider).
- Passwords hashed by the authentication provider; leaked passwords refused; two-factor login available and enforceable per company.
- Prices and costs readable only by roles allowed to see them, including in history and AI answers.
- A history of changes the company can review.
- Driver and agency links that reveal only a whitelist of fields, can be replaced at any time, and expire.
- Rate limits on sign in, AI use and invitation emails.
- A strict content security policy and security headers on every page.