DATA PROCESSING AGREEMENT (DPA)

Effective Date: June 7, 2025
Last Updated: June 7, 2025

This Data Processing Agreement (“Agreement” or “DPA”) is entered into by and between:

Mazala Travel, a travel service operated by Digital Consulting Service LLC, a company registered under the laws of Mongolia (the “Processor”), with financial transactions managed by Mazala Limited, a private limited company incorporated in Hong Kong;

and

you, the customer, client, traveler, or business partner (the “Controller”), who engages Mazala Travel’s services either on an individual or organizational basis.

This Agreement governs the processing of personal data by Mazala Travel in the course of providing travel and tourism services.

1. DEFINITIONS

  • “Personal Data” means any information relating to an identified or identifiable natural person (e.g., name, passport number, contact details).
  • “Processing” means any operation performed on personal data, whether automated or manual (e.g., collection, storage, transmission).
  • “Controller” means the party that determines the purposes and means of data processing (you).
  • “Processor” means the party that processes personal data on behalf of the controller (Mazala Travel).

2. PURPOSE OF PROCESSING

Mazala Travel processes Personal Data to:

  • Arrange and manage travel itineraries
  • Facilitate hotel, transport, and activity bookings
  • Process payments and issue invoices
  • Comply with immigration, tax, and local tourism regulations
  • Provide customer support and marketing communications (with consent)

3. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on the services used, the following categories may be processed:

  • Full name, gender, date of birth
  • Passport and visa information
  • Contact details (email, phone, LINE ID)
  • Travel preferences and dietary needs
  • Medical information (if disclosed for trip safety)
  • Payment and billing information

4. DATA SUBJECTS

Data subjects may include:

  • Individual travelers (adults and minors)
  • Group members in business or school tours
  • Authorized representatives for corporate bookings
  • Emergency contacts or guardians (if submitted)

5. OBLIGATIONS OF THE PROCESSOR (MAZALA TRAVEL)

Mazala Travel agrees to:

  • Process personal data only on documented instructions from the Controller
  • Maintain the confidentiality of personal data
  • Implement appropriate technical and organizational measures to ensure data security (e.g., SSL encryption, access controls)
  • Assist the Controller in responding to data subject requests (e.g., access, rectification, deletion)
  • Inform the Controller of any data breach without undue delay
  • Ensure all employees and sub-processors adhere to this DPA

6. DATA TRANSFERS

Mazala Travel may transfer personal data to:

  • Hong Kong, for invoicing and tax compliance (Mazala Limited)
  • Mongolia, where travel logistics are coordinated
  • Cloud service providers and third-party partners operating in countries that may not have equivalent data protection laws

Where applicable, such transfers are secured via:

  • Standard Contractual Clauses (SCCs)
  • Adequacy decisions (if available)
  • Explicit consent from the data subject

7. USE OF SUB-PROCESSORS

Mazala Travel may use sub-processors to deliver its services, such as:

  • Cloud hosting platforms (e.g., AWS, Google Cloud)
  • CRM and customer communication tools (e.g., Mailchimp, LINE, WhatsApp)
  • Travel service partners (e.g., hotels, guides, transport providers)

Mazala Travel remains fully responsible for the actions of its sub-processors and ensures contractual safeguards are in place.

8. RETENTION OF DATA

Personal data is retained:

  • For as long as necessary to fulfill the purpose of the booking
  • For a minimum of 7 years to comply with tax and accounting laws in Hong Kong and Mongolia
  • Until a data subject requests erasure (subject to legal exceptions)

9. RIGHTS OF THE DATA SUBJECT

You, or any data subject whose data we process, may request:

  • Access to your personal data
  • Correction or updating of inaccurate information
  • Deletion of your data (“right to be forgotten”)
  • Restriction or objection to processing
  • Data portability (if applicable)

To make a request, contact privacy@mazala-travel.com. We respond within 30 calendar days, unless local laws permit a longer timeframe.

10. TERMINATION OF PROCESSING

Upon completion or termination of your relationship with Mazala Travel:

  • We will either delete or return all personal data, unless we are required to retain it by law
  • Backups and archives will be securely purged following data retention schedules

11. LIMITATION OF LIABILITY

Mazala Travel shall not be liable for any indirect or consequential damages arising from this Agreement, except in cases of gross negligence or willful misconduct. Liability shall not exceed the total amount paid for the associated booking.

12. GOVERNING LAW & JURISDICTION

  • Operational matters are governed by the laws of Mongolia
  • Invoicing and financial processing fall under Hong Kong law

Disputes under this DPA shall be resolved under the jurisdiction appropriate to the nature of the dispute (e.g., privacy, billing).

13. CONTACT INFORMATION

For questions about this DPA, or to submit a data request:

Mazala Travel
Operated by Digital Consulting Service LLC
📍 Ulaanbaatar, Mongolia
📧 Email: privacy@mazala-travel.com

Scroll to Top