Data-processing agreement

Application and parties

This data-processing agreement (DPA) forms part of a service agreement when Maestranza B.V. and the customer incorporate it into that agreement. It is not concluded merely by visiting this page or accepting a Microsoft sign-in prompt. Maestranza’s details are in the terms of service; the customer is identified in the service agreement.

This DPA applies to personal data processed by Maestranza on the customer’s behalf to provide AWM. The customer is the controller, or a processor authorised by its controller to appoint Maestranza as a subprocessor. References to the customer’s instructions and authorisations include those it must obtain from its controller. Maestranza’s separate processing as controller is described in the privacy notice.

“Personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meanings in the EU General Data Protection Regulation (GDPR). Mandatory law and applicable international transfer clauses take priority. This DPA prevails over conflicting general service terms for the processing it governs. A separately signed DPA may replace it.

Processing description and customer schedule

Processing is limited to delivering, supporting, securing and recovering the contracted AWM service. It may include collection, storage, organisation, retrieval, display, authorised sharing, export, correction, restriction and erasure. It continues for the service period and the agreed return, deletion and legally required retention periods.

Retention periods for customer personal data are to be agreed with the customer for its deployment. This draft does not set a standard period for every customer. The parties may revise agreed periods through documented instructions or an agreed schedule update, subject to applicable law.

Before personal data is placed in a deployment, the order or its processing schedule must identify the customer and contact, deployment model and locations, approved providers, enabled integrations, authorised data categories, retention and backup periods, deletion timetable and support responsibilities. The following description supplies the standard scope; the customer schedule records any permitted variation.

Instructions and customer duties

Maestranza will process customer personal data only on documented instructions, including the agreement, authorised configuration and user actions within the agreed service. We will not use it for our own advertising, sell it, or train general-purpose AI models on it. Instructions to transfer data internationally are subject to the transfer provisions below.

If law requires other processing, we will inform the customer before doing so unless that law prohibits notification on important public-interest grounds. We will inform the customer promptly if we consider an instruction to infringe applicable data-protection law and pause the affected processing where necessary while the issue is resolved.

The customer establishes a lawful basis, gives required notices, obtains any necessary consents, selects appropriate access and retention settings, and gives lawful and proportionate instructions. It must not use the service to collect unnecessary sensitive information. Neither party may treat a contractual instruction as permission to disregard an individual’s statutory rights.

Confidentiality and security measures

People authorised by Maestranza to process customer personal data must be bound by confidentiality obligations or an appropriate statutory duty. Access is limited to authorised work and removed when no longer needed.

Maestranza will implement and maintain measures appropriate to the risks under Article 32 GDPR. For components it operates, these include authenticated and role-restricted access, customer and airport permission checks, secure transport, protected secrets, controlled changes, appropriate logging and incident handling, and backup and recovery arrangements specified in the customer schedule. Provider-managed protection and encryption at rest must be documented for the chosen storage services.

The parties will record the allocation of controls for customer-hosted or mixed deployments. Maestranza will provide relevant security information needed to assess the measures and will not materially reduce the agreed level of protection without an appropriate replacement. A general description of controls is not a claim of certification or a substitute for a completed deployment security schedule.

Subprocessors

The customer gives general written authorisation for the subprocessors identified for its deployment in the agreed schedule. The service-provider register supports that schedule; it is not blanket authorisation to send customer data to every service listed. A provider engaged independently by the customer must be distinguished from a subprocessor engaged by Maestranza.

Maestranza will notify the designated customer contact at least 30 days before an intended addition or replacement of a subprocessor, with its identity, processing function and relevant location information. Merely changing a web page is not sufficient notice. The customer may object within that period on reasonable data-protection grounds. The parties will seek a reasonable alternative; if none is available, the customer may end the affected service before the change takes effect, with a proportionate refund of prepaid unused affected service fees.

Maestranza will impose written data-protection obligations on each subprocessor that are no less protective in substance for the work concerned, and remains responsible to the customer for performance of those obligations. Details of the applicable chain of processing and updates will be supplied on request.

International transfers and government requests

Maestranza will not transfer customer personal data outside the EEA unless the customer’s documented instructions permit it and applicable Chapter V GDPR requirements are met. The applicable adequacy decision or transfer clauses, parties, relevant locations and any necessary supplementary measures must be identified for the transfer. This DPA does not itself execute standard contractual clauses merely by referring to them.

We will assess legally binding disclosure requests, challenge them where there are reasonable grounds to do so, disclose only information lawfully required and notify the customer unless prohibited. The same due care applies to requests for customer non-personal data that would conflict with applicable EU or national law. Hosting in Europe does not by itself remove foreign-access risks.

Requests, assessments and assistance

We will promptly forward requests from individuals relating to customer-controlled data and will not respond substantively except on the customer’s instructions or where law requires it. We will assist with access, correction, erasure, restriction, objection and portability using the information and capabilities reasonably available to us. Requests can be sent to support@airsideworksmanager.com with the affected customer and scope.

Taking account of the processing and information available, we will assist the customer with security duties, breach notifications, data-protection impact assessments and prior consultation with a supervisory authority. This includes relevant data-flow and provider information and reasonable help locating or extracting affected records. Any agreed fees for additional assistance must not obstruct legally required assistance or rights.

Personal data breaches

Maestranza will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data. We will use the designated incident contact, with reasonable alternative contact methods if needed. Notification will not be delayed until every detail is known.

As information becomes available, we will describe the nature of the breach, affected categories and approximate numbers of people and records where known, likely consequences, measures taken or proposed and a contact for follow-up. We will investigate, contain and remedy the breach and cooperate with the customer’s assessment and reporting duties. The customer decides on notifications to authorities and affected people where it is the controller, subject to obligations directly imposed on Maestranza.

Records and audit

Maestranza will make available information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the customer or a qualified auditor it appoints. Relevant records, provider documentation and reports can be used first where they adequately address the question, without removing the right to a necessary further audit.

Audits should use reasonable notice, confidentiality and security arrangements and avoid unnecessary disruption or disclosure of another customer’s data. Those arrangements must not prevent an urgent audit justified by a breach, a material compliance concern or a supervisory authority’s requirement. We will address substantiated findings and cooperate with competent supervisory authorities as required by law.

Return, deletion and retained copies

At the end of the service, the customer chooses return or deletion of personal data, subject to applicable law and agreed switching and retrieval rights. The customer schedule must specify the secure return method, retrieval period, deletion deadline and maximum lifetime of recovery copies. Maestranza will confirm completion on request.

Erasure includes relevant content and personal identifiers, not merely disabling an account or marking a record deleted. Where preserving necessary operational history is lawful and instructed, the parties will consider restriction or appropriate removal of identifying information. Maestranza will not independently impose permanent retention of all personal data because a record is aeronautical.

Data retained solely because law requires it must be isolated as appropriate and used only for that purpose. Backup copies awaiting scheduled expiry must remain protected and excluded from ordinary processing; if restored for recovery, applicable erasure instructions must be reapplied. These protections continue until the retained personal data is deleted.

Contacts and related documents

Privacy, processing-instruction and DPA questions can be sent to support@airsideworksmanager.com. The service agreement must identify a customer contact able to issue instructions and receive incident and subprocessor notices. Keep this version and the completed customer schedule with the signed agreement.

• Terms of service
• Privacy notice
• Service providers and export information
• Contact Maestranza