6.1 Confidentiality. Agency will keep confidential and not disclose to any third party the following confidential information of Riyadh Air: (a) any fare programs and commission arrangements that may be agreed between Riyadh Air and Agency; (b) any and all post-booking data, including all PNRs and orders, that cover Riyadh Air’s products and services and Third Party Products; and (c) any other RX Data that Riyadh Air designates as confidential or is otherwise reasonably identifiable as confidential or proprietary information (“Confidential Information”). However, Riyadh Air consents to Agency disclosing commission arrangements and payments to customers when this information is requested by the customer. Agency may also disclose Confidential Information to Agency’s directors, officers, employees or agents if such persons are bound by equivalent confidentiality commitments and have a legitimate need to know such information in order for the Agency to perform its obligations to Riyadh Air. In addition, this Section will not prohibit Agency from making disclosures required by law or judicial process after making reasonable efforts to resist disclosure and notify Riyadh Air. This provision will survive the suspension, limitation or termination or expiration of Agency’s Appointment.

6.2 Privacy. For purposes of this addendum, “personal data” means information that identifies or could be used to identify a particular individual, such as name, mailing address, telephone number, email address, frequent flier number, credit card or other payment data, date of birth, driver’s license number, account number or user ID, PIN, or password. Agency will cause all of the Agency’s privacy policies to inform customers that their personal data will be disclosed to Riyadh Air (and third parties in accordance with Riyadh Air’s privacy policy). Agency shall give its customers notice, and if required under applicable laws and regulations, obtain the customer’s consent, to such disclosure, transfer and processing of personal data. Riyadh Air is an independent controller within the meaning of the E.U. General Data Protection Regulation and the Saudi Personal Data Protection Law (Royal Decree No. M/19 dated 9/2/1443 (H) (corresponding to 16 September 2021 (G)) together with its Implementing Regulations (the “PDPL”). To the extent RX Data includes personal data, including as disclosed by the Agency, Riyadh Air will handle such personal data in accordance with Riyadh Air’s Privacy Policy and in accordance with applicable local laws and regulations. Agency shall at all times (a) use reasonable efforts to protect and (b) comply with all applicable laws and regulations, including but not limited to data privacy laws, in its use of any personal data. Each party shall provide the other party with such assistance as the other party may reasonably request to fulfill its responsibilities under applicable data privacy laws.

6.3 Data Security. Agency will establish, implement, maintain, and use reasonable physical, technical and administrative safeguards for RX Data in Agency’s possession or under Agency’s control in order to protect the same from unauthorized disclosure, access, use, destruction, loss, damage or alteration. Such safeguards will be in compliance with all applicable laws and regulations, including the PDPL and the Kingdom of Saudi Arabia’s other cybersecurity laws and regulations including National Cybersecurity Authority (NCA) and National Data Management Office (NDMO), and will be no less rigorous than (a) industry standard practices in the transportation and related services industry, and (b) reasonable security procedures and practices appropriate to the nature of such RX Data (the “Security Requirements”). In addition, Agency shall require any of Agency’s employees, agents or contractors with access to RX Data to adhere to the Security Requirements. Agency agrees that the controls used to safeguard RX Data in Agency’s possession will take into account the sensitivity of such information.

6.4 Data Retention. Agency shall retain RX Data only for the duration of Agency’s Appointment. Upon termination of Agency’s Appointment, Agency shall securely delete RX Data in accordance with industry best practices and Riyadh Air’s instructions or return RX Data in accordance with Riyadh Air’s instructions, unless otherwise required by law or regulatory obligations.

6.5 Data Encryption and Vulnerability Management. All RX Data must be encrypted at rest and in transit using encryption keys. All encryption protocols and algorithms used shall be well-known, industry-standard, and commonly used; no proprietary encryption shall be used. Agency shall identify and document any cybersecurity vulnerabilities. Agency undertakes that, based on the criticality of vulnerability identified in systems accessing RX Data, Agency will take all steps to patch and/or mitigate the vulnerabilities (a) immediately for any critical vulnerability; (b) within three (3) days for high vulnerability; (c) within two (2) weeks for medium vulnerability; and (d) within four (4) weeks for low vulnerability.

6.6 Business Continuity and Disaster Recovery. Agency shall maintain business continuity plans and disaster recovery plans and shall conduct and document testing of such plans at least annually and upon significant changes to infrastructure, services, or business operations.

6.7 PCI-DSS Compliance. Agency will comply with the current Payment Card Industry Data Security Standard, and VISA, MasterCard and any other applicable payment card network bylaws, rules and operating regulations and federal and state laws or regulations regarding the collection, storage, use and sharing of RX Data, including without limitation (a) creation and maintenance of a secure network to protect cardholder data; (b) use of all technical and procedural measures reasonably necessary to protect cardholder data it maintains or controls; (c) creation and implementation of secure measures to limit access to cardholder data; (d) monitoring access to cardholder data it maintains or controls; and (e) creation and implementation of an information security policy that ensures Agency personnel compliance with the foregoing. Agency accepts responsibility for the security of payment card data, cardholder data, or sensitive authentication data processed on behalf of Riyadh Air. Agency represents and warrants ongoing compliance with the most current Payment Card Industry Data Security Standard and shall provide certification of compliance with this requirement upon request from Riyadh Air.

6.8 Remediation. Agency shall ensure a recovery plan is developed and executed during or after a cybersecurity incident and ensure that the impact of the incident is assessed, contained and mitigated and resolved. Following any Security Incident, Agency must notify Riyadh Air within 24 hours. Agency and Riyadh Air will work in good faith regarding remediation efforts that may be necessary and reasonable. At Riyadh Air’s sole discretion, Agency shall (a) either undertake remediation efforts for a Security Incident at its sole expense and in line with security best practices or reimburse Riyadh Air for Riyadh Air’s reasonable costs and expenses in connection with taking remediation efforts for a Security Incident and (b) provide assurances satisfactory to Riyadh Air that such Security Incidents will not recur. Agency shall indemnify and hold harmless Riyadh Air and its officers and employees from and against any and all allegations, claims, demands, costs, expenses (including attorneys’ fees and disbursements), losses, liabilities, penalties, fines, settlements or damages arising out of or relating to any Security Incident that occurs in relation to RX Data that was in the possession or control of Agency or Agency’s employees or contractors at the time of the Security Incident. “Security Incident” means (i) the loss, misappropriation or misuse (by any means) of RX Data; (ii) the inadvertent, unauthorized, and / or unlawful processing, distribution, alteration, corruption, sale, rental, or destruction of RX Data; or (iii) any other act or omission that compromises or threatens to compromise the security, confidentiality, or integrity of RX Data.

6.9 Agency shall have well established and effectively communicated cybersecurity policies.

6.10 Agency authorizes Riyadh Air’s internal and external auditors to conduct reviews of the Agency’s process and security controls periodically from a cybersecurity perspective, if relevant to the subject matter of the Agreement and in respect of any RX Data that may be held or stored by Agency as and when needed to ensure compliance with applicable laws.

6.11 Agency shall ensure that its governance and risk management processes address cybersecurity risks effectively and in line with best industry practices.

6.12 Third-Party Risk Management:

(a) Agency shall identify, prioritize and assess its suppliers and third-party partners of information systems, components, and services using a cyber supply chain risk assessment process, and through effective contracts with third-party partners.

(b) Agency shall ensure its third parties and sub-contractors are maintaining the same level of cybersecurity posture as required under the Agreement.

6.13 Security in Human Resources:

(a) Agency shall include cybersecurity in human resources practices (e.g., deprovisioning, personnel screening).

(b)Agency shall maintain comprehensive hiring/recruitment policies/procedures for its employees, contractors, or consultants, including a background check for criminal convictions to the extent permitted by applicable law. Agency shall use all reasonable endeavors to employ the best-qualified people of appropriate character and honesty.

6.14 Agency shall inventory, classify and label all physical devices and systems within its organization.

6.15 Agency shall ensure that the physical environment is monitored to detect potential cybersecurity events.

6.16 Access Management:

(a) Agency shall issue, manage, verify, revoke as required, and audit identities and credentials for authorized devices, users, and processes.

(b) Agency shall manage the access permissions and authorizations, incorporating the principles of least privilege and separation of duties.

(c) Agency shall ensure that users, devices, and other assets are authenticated.

(d)User access rights shall be provided on the principles of a need-to-know basis.

(e)All agency staff providing service must have unique credentials.

6.17 Communications and Control Networks. Agency shall ensure that communications and control networks are protected against:

(a) unauthorized access;
(b) tampering;
(c) eavesdropping;
(d) disruptions; and
(e) denial of service.

6.18 Agency shall ensure that the principle of least functionality is incorporated by configuring systems to provide only essential capabilities mapped to job responsibilities.

6.19 Agency shall implement Web Application Firewall (Internal or Public-Facing).

6.20 Agency shall ensure that monitoring for unauthorized personnel, connections, devices, and software is performed.

6.21 Agency shall monitor the network to detect potential cybersecurity events.

6.22 Agency shall ensure that network integrity is protected to ensure customer data is isolated from other customers through network segregation and network segmentation of critical services using:

(a) Layered security controls;
(b) Stateful Inspection;
(c) Firewalls;
(d) Intrusion prevention and detection systems; and
(e) File integrity monitoring.

6.23 Additional Privacy Terms.

(a) Agency shall ensure data subject rights procedure is implemented.

(b) Agency shall have in place a record of processing activities (RoPA) or a method to identify personal data flows within the organization.

(c) Agency shall have in place procedures to assess sub contractors/third parties from data privacy/protection perspective.

6.24 Agency must ensure continuous security of information assets during changes in technology, people and processes, which may include but are not limited to:

(a) Enhancements to the current services offered;

(b) Development of any new applications and systems;

(c) New or changed controls to resolve information security incidents or new risks identified during re-assessments;

(d)Adoption of new products or newer versions/releases;

(e)Changes to the physical location of service facilities;

(f)Changes and enhancement to networks; and

(g)Sub-contracting to another supplier.

Addendum to Governing Travel Agency Agreements (GTAA)

For IATA and ARC Accredited Agencies and Their Affiliates

1. AGENCY APPOINTMENT

2. COMPLIANCE WITH RIYADH AIR’S RULES, TERMS AND CONDITIONS

3. NDC

4. AGENCY DEBIT MEMOS

5. UNAUTHORIZED ACTIVITIES; INTELLECTUAL PROPERTY

6. CONFIDENTIALITY, PRIVACY AND DATA SECURITY

7. DATA OWNERSHIP AND USE

8. RIGHT TO RECOUP AND OFFSET

9. REGULATORY COMPLIANCE

10. MISCELLANEOUS