Data Processing Agreement

Effective and last updated: September 11, 2026

This agreement is part of the BusyTrip Terms of Service. It applies between the organization using BusyTrip through its authorized account or team owner (the "Customer") and GeoTech B.V., Piet Mondriaanstraat 204, 1061 TT Amsterdam, Netherlands; KVK 84238445; VAT NL860500214B01 ("GeoTech"), when GeoTech processes personal data on the Customer's behalf. Each party's contact is its account or contract contact; GeoTech's privacy contact is contact@geotech.one. This agreement takes priority over conflicting service terms for that processing.

1. Roles and scope

The Customer determines the purposes of its business scanning and is the controller. GeoTech is the processor for scan content, extracted fields, shared team records, enrichment and destination delivery performed on the Customer's instructions. If the Customer is itself a processor, it confirms that its controller has authorized this processing and GeoTech's appointment as a sub-processor. GeoTech remains an independent controller for its own account administration, billing, fraud prevention, security and other service-administration activities described in the Privacy Policy.

Processing runs for the service relationship and the applicable return or deletion period. It consists of receiving images or PDFs, extracting structured fields using AI, requested professional-information enrichment, storing temporary scan history and shared team records, and delivering selected fields or files to authorized destinations. Processing occurs when the Customer and its authorized users submit scans or configure these operations.

People concerned include the Customer's users, employees, business contacts, event attendees and people identified on receipts. Data may include names, professional contact details, employer and job title, public professional links, notes, document images, expense details, scanner identity, profile image, timestamps, project labels and destination identifiers. The Service is not intended for special-category data, criminal-conviction data, full payment-card details or credentials in scan content. Do not submit such information without a separately agreed lawful and supported arrangement.

2. Customer instructions

The Terms, this agreement, submitted scans, workspace access settings, field mappings and enabled destinations constitute the Customer's documented instructions. Additional instructions can be sent to our privacy contact. GeoTech processes Customer data only on those instructions, including instructions about international transfers, unless applicable law requires otherwise. In that event we inform the Customer before processing unless that law prohibits disclosure. We inform the Customer promptly if we believe an instruction infringes applicable data protection law and may suspend the affected processing while it is resolved.

The Customer is responsible for a lawful basis, required privacy notices, the accuracy and necessity of submitted data, permitted users and destinations, and handling its controller obligations. A badge scan or CRM entry does not by itself authorize marketing. GeoTech will not sell Customer scan data, use it for advertising, or train its own models on it.

3. Confidentiality and safeguards

GeoTech restricts access to people who need it to provide, support or secure the Service and who are subject to confidentiality duties. We maintain measures appropriate to the processing and risk, including:

• TLS for service connections; server-side encrypted storage of OAuth tokens and CRM keys, with keys excluded from ordinary client responses and logs.
• Authenticated server-side workspace and role checks, separate team Finance permission, and owner-controlled destination configuration.
• Narrow Google Drive authorization; validated CRM endpoints and mappings; delivery tracking and checks intended to prevent duplicate external writes.
• Restricted operational logs, monitored failures, temporary scan retention, and scheduled deletion of expired CRM delivery records.
• Restricted encrypted recovery backups, restoration checks, and incident-response procedures.

Measures may evolve while maintaining an appropriate level of protection. Destination providers control their own storage and permissions. The Customer must revoke access separately granted in those services when appropriate.

4. Sub-processors and transfers

The Customer gives general written authorization for GeoTech to use the service providers described in the Privacy Policy, Section 8 insofar as they process Customer data for GeoTech. Their purposes and locations are listed there. Providers acting as independent controllers for their own purposes are not described by this agreement as GeoTech's processors for those activities.

GeoTech requires binding data protection obligations from its sub-processors that provide the protection required for the processing under this agreement and remains responsible to the Customer for their performance of those obligations. We will give at least 30 days' advance notice of an intended addition or replacement by email or an in-app notice, with information sufficient to assess it. The Customer may object on reasonable data protection grounds during that period. We will discuss an alternative; if none is reasonably available, the Customer may stop the affected processing and terminate the affected service before the change, with a proportional refund of unused prepaid fees for that service.

For restricted international transfers that GeoTech arranges, we use a valid adequacy decision or another applicable safeguard, such as the relevant Standard Contractual Clauses and necessary supplementary measures. This agreement itself is not an international-transfer safeguard. Details are available from our privacy contact.

A CRM or storage service selected and contracted directly by the Customer is a Customer-authorized recipient; it is not automatically our sub-processor. The Customer authorizes delivery to that destination and is responsible for selecting an appropriate provider, location and access scope. This does not remove GeoTech's obligations for transfers it carries out or providers it appoints.

5. Assistance, requests and incidents

Taking account of the nature of processing and information available to us, GeoTech assists the Customer with access, correction, erasure, restriction, portability and objection requests, security obligations, data protection impact assessments and consultations with supervisory authorities. We forward requests relating to Customer-controlled data to the Customer without undue delay and do not respond on its behalf except on instructions or as legally required.

GeoTech notifies the Customer without undue delay after becoming aware of a personal data breach affecting its Customer data. We provide available information about the incident, affected data and people, likely consequences, contact point and measures taken or proposed, and supplement it as facts become available. We assist with investigation and mitigation. The Customer remains responsible for its controller notifications to authorities and individuals.

6. Return, deletion and backups

The Customer can obtain data through configured destinations and available application functions, and can request assistance with return or deletion at our privacy contact. At the Customer's choice, GeoTech returns or deletes Customer personal data when the relevant service ends and deletes remaining copies unless applicable law requires retention. Ordinary individual scan history, shared team history, credentials, delivery records and recovery copies follow the retention details in Privacy Policy, Section 9.

Removing a team member or their personal account does not automatically erase the organization's shared records. Team deletion removes shared BusyTrip history and configuration. Removing a CRM connection deletes its live credential and delivery ledger. Neither action automatically deletes records already delivered to the Customer's Drive or CRM. GeoTech assists with requests concerning those transfers as required; the destination's own deletion, audit and backup behavior also applies.

Recovery copies remain restricted and are used for recovery, not ordinary processing, until their retention period expires. If data is restored, applicable deletion instructions must be reapplied before it returns to ordinary service. Legal retention exceptions are limited to the data and purpose actually required.

7. Information and audits

GeoTech makes available information reasonably necessary to demonstrate its compliance with these processing obligations and allows and contributes to audits, including inspections, by the Customer or its independent auditor. The parties coordinate reasonable notice, scope and confidentiality to protect other customers and service security. These arrangements must not prevent a necessary audit, including following a material incident or a competent authority's request. We promptly inform the Customer if an audit instruction appears to infringe data protection law.

8. Contact and governing terms

Send processing instructions, sub-processor objections, incident questions or assistance requests to contact@geotech.one. The governing law and other service terms are those in the Terms, without limiting mandatory data protection rights or the obligations in this agreement.