Data Processing Addendum

This standard Data Processing Addendum ("DPA") applies only when Trunnion AI, LLC processes personal information for a business customer through the public Vortiek prelaunch website under a written agreement. Vortiek is not currently offering a production travel product or enterprise data-processing service. Product-specific terms must be executed before any future product receives customer personal information.

1. Roles and instructions

The customer is the business or controller; Trunnion AI, LLC acts as service provider, processor, or contractor and processes personal information only to deliver, secure, and support the expressly contracted website service on documented instructions. We do not sell or share customer personal information or use it for cross-context behavioral advertising.

2. Scope

The written agreement identifies the approved data, purpose, duration, users, providers, processing location, retention, and deletion. Travel records, government identifiers, payment credentials, health data, precise location, passport information, loyalty credentials, and other sensitive or regulated data are outside the current public-site scope.

3. Security and confidentiality

Authorized personnel are subject to confidentiality duties. The website uses HTTPS, restricted public forms, consent-gated analytics, provider security controls, and documented incident handling. Exact controls and provider attestations remain subject to current evidence and the shared-responsibility boundary.

4. Providers

The current public register is at Service providers. We update it before a newly engaged provider receives in-scope personal information and provide any notice required by the written agreement.

5. Rights, incidents, and deletion

We reasonably assist with verified rights requests concerning in-scope data, notify an affected customer without undue delay after confirming a personal-data breach, and delete or return data on verified instruction or termination subject to legal holds and required records. Backup deletion follows the approved hosting schedule.

6. Contact

To execute this DPA or request future product-specific terms, email legal@trunnion.ai.