This Data Processing Addendum (this “Addendum”) forms part of the Tern Terms of Service at tern.travel/terms-of-service (the “Terms”) between Tern Software, Inc. (“Tern”) and the Travel Agency or Travel Advisor that uses the Services (the “Customer”). It applies whenever Tern processes Customer Data on the Customer’s behalf. The version in force when the Customer accepts or re-accepts the Terms applies, and Tern records which version was accepted and when (Section 4.5 of the Terms). Capitalized terms not defined here have the meanings in the Terms.
1. Scope and precedence
1.1 What this Addendum covers. This Addendum governs Tern’s processing of personal information contained in Customer Data (“Customer Personal Data”) as the Customer’s processor or service provider under Section 11 of the Terms. It does not apply to information Tern processes for its own purposes as an independent controller, being information about the Customer as Tern’s own customer; account, billing and subscription records; the records Tern keeps to secure its own systems, prevent fraud against Tern and meet its own audit and legal obligations; and information Tern receives to make, pay for, confirm, service and support a hotel accommodation Tern sells (Section 11.5 of the Terms). Tern’s Privacy Policy governs that information. Where the same record is used both for the Customer and for one of those purposes of Tern’s own, this Addendum applies to the processing for the Customer. Personal information in Customer Data remains Customer Personal Data when Tern processes it to secure the Services or detect fraud or abuse for the Customer.
1.2 Precedence. If this Addendum conflicts with the Terms, this Addendum governs as to Customer Personal Data. If the Standard Contractual Clauses apply under Section 12 and conflict with this Addendum or the Terms, the Standard Contractual Clauses govern. If the Customer has signed a separate agreement with Tern containing data protection terms, whether a data processing agreement, a master agreement, an order form or a schedule, and it states that it prevails over the Terms, those terms govern in place of this Addendum to the extent they address the same matter, but this Addendum continues to apply to any matter they do not address, and neither displaces a safeguard the law requires. This Addendum prevails over any statement in the Privacy Policy about Customer Personal Data.
1.3 The Customer’s other controllers. Where the Customer processes Customer Personal Data on behalf of another controller, such as a Host Agency, an affiliated Advisor or an enterprise customer, the Customer confirms that it has that controller’s authority to appoint Tern as a sub-processor on the terms of this Addendum, and the Customer is Tern’s point of contact for the administration of this Addendum on that controller’s behalf, without limiting any right that controller, a supervisory authority or an individual has by law.
2. Roles
2.1 As between the parties, the Customer is the controller (or business) of Customer Personal Data and Tern is its processor (or service provider). Where Section 1.3 applies, the Customer is a processor for its controller and Tern is its sub-processor.
2.2 The Customer is responsible for the lawfulness of the Customer Personal Data it puts into the Platform, including having a lawful basis, giving any notice and obtaining any consent the law requires, and the accuracy of its instructions (Section 11.6 of the Terms).
3. Instructions
3.1 Documented instructions. Tern will process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers, unless the law applicable to Tern requires otherwise (and, for data subject to the EU GDPR, only Union or Member State law, and for data subject to the UK GDPR, only UK law), in which case Tern will tell the Customer of that requirement before processing unless that law prohibits it (for data subject to the EU or UK GDPR, on important grounds of public interest). The Customer’s instructions are the Terms, this Addendum, the Customer’s configuration and use of the Services, and any other written instruction the Customer gives that is consistent with the Terms. Annex I describes the processing.
3.2 Instructions that infringe the law. Tern will tell the Customer promptly if, in its opinion, an instruction infringes applicable data protection law. Tern is not required to follow an instruction that infringes the law. It may suspend the processing concerned until the Customer changes the instruction or the parties agree that it is lawful, and may decline an instruction that remains unlawful.
3.3 De-identified and aggregated data. The Customer instructs Tern to create de-identified and aggregated data from Customer Personal Data and to use it as Section 11.4 of the Terms describes, subject to any restriction in a separate written agreement with the Customer. Data is no longer Customer Personal Data only once it meets the standard for de-identified or anonymized data under the law that applies to it, and until then it remains Customer Personal Data. Tern will not attempt to re-identify it, and the restrictions in Section 3.4 and in any separate written agreement continue to apply to it.
3.4 AI features and connected accounts. Tern processes Customer Personal Data with AI model providers only as needed to provide the features the Customer uses. Annex II describes the safeguards for Tern’s AI model providers. Annex III states, for each sub-processor, any use it may make of Customer Personal Data for its own purposes. Data described as anonymous or de-identified must first meet the applicable legal standard. Information the Customer connects from Google APIs is processed only as the Google API Services User Data Policy, including its Limited Use requirements, allows, notwithstanding Section 3.3.
4. Tern’s personnel
Tern will ensure that each person it authorizes to process Customer Personal Data is subject to a duty of confidentiality, whether contractual or statutory, and processes it only as needed for the Customer’s instructions.
5. Security
5.1 Tern will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing and the risks to individuals. The measures in effect are described in Annex II.
5.2 Tern may update the measures from time to time, provided the update does not materially reduce the overall protection of Customer Personal Data and does not remove a measure described in Annex II for a category of sensitive data without putting in place equivalent protection.
6. Personal data breaches
6.1 Tern will notify the Customer’s account administrator by email without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data (a “Personal Data Breach”). This Section applies in addition to Section 11.2(i) of the Terms and does not reduce any incident notice agreed in a signed agreement.
6.2 The notice will describe, to the extent then known, the nature of the Personal Data Breach, the categories and approximate number of individuals and records concerned, the likely consequences and the measures taken or proposed. Tern will supplement it as more information becomes available, take reasonable steps to contain and remediate the Personal Data Breach, and give the Customer reasonable assistance with any notice the Customer must give to regulators or individuals.
6.3 Notice under this Section is not an admission of fault or liability.
7. Sub-processors
7.1 General authorization. The Customer authorizes Tern to engage sub-processors to process Customer Personal Data. Tern’s current sub-processors are listed at tern.travel/subprocessors and in Annex III.
7.2 Changes to sub-processors. Tern will give the Customer at least ten (10) days’ notice before a new or replacement sub-processor processes Customer Personal Data, or before a material change in what an existing sub-processor does with it, by email to the Customer’s account administrator and by updating the list. Notice of a sub-processor Tern engages only to test or evaluate a feature using data that is not Customer Personal Data is not required until Tern intends to use actual Customer Personal Data with that sub-processor, including in a test environment. The notice will identify the sub-processor, its function and where it processes. Where Section 1.3 applies, the Customer will pass the notice to its controller and pass on any objection.
7.3 Objections. The Customer may object to a change notified under Section 7.2 on reasonable data protection grounds within the notice period, by email to privacy@tern.travel, and the parties will discuss the objection in good faith. If Tern cannot reasonably accommodate it, the Customer may, as its sole remedy for an otherwise lawful change, stop using the affected Services or close its account before the change takes effect, and Tern will refund any prepaid subscription fees for the unused part of the period for those Services.
7.4 Flow-down and responsibility. Tern will impose on each sub-processor, by written contract, the same data protection obligations as those in this Addendum, except for the uses of Customer Personal Data that Annex III discloses, and remains fully liable to the Customer for each sub-processor’s performance of those obligations.
8. Requests from individuals
8.1 If Tern receives a request from an individual to exercise a data protection right in respect of Customer Personal Data, Tern will pass it to the Customer promptly and will tell the individual that it has done so. Tern will not otherwise respond to the request unless the Customer instructs it to or the law requires it. Where a request also concerns information Tern holds as controller, Tern will handle that part itself under its Privacy Policy.
8.2 Taking into account the nature of the processing, Tern will give the Customer reasonable assistance, including through the functions of the Services, with its obligations to respond to those requests.
9. Assistance with the Customer’s compliance
Taking into account the nature of the processing and the information available to Tern, Tern will give the Customer reasonable assistance with its obligations relating to security of processing, Personal Data Breaches, data protection impact assessments and prior consultation with a supervisory authority. Tern may charge a reasonable fee, at its then-current professional services rates, for assistance beyond what the Services and Tern’s standard documentation provide, except where the assistance is needed because of a breach of this Addendum by Tern or a sub-processor. A dispute about a fee will not delay assistance the law requires Tern to give. This Section includes assessments required by US state privacy laws.
10. Information and audits
10.1 Tern will make available to the Customer the information in its possession reasonably necessary to demonstrate compliance with this Addendum and with the processor obligations of applicable data protection law, including its current security documentation and responses to reasonable security questionnaires, on an ongoing basis.
10.2 The Customer may conduct, or mandate an independent auditor bound by confidentiality to conduct, an assessment of Tern’s compliance with this Addendum, including an inspection, where the information under 10.1 does not reasonably address the matter. The Customer will give at least thirty (30) days’ notice and conduct no more than one such assessment in any twelve (12) month period, except that neither limit applies where a supervisory authority requires the assessment, following a Personal Data Breach, or where the Customer has credible indications that Tern is not complying with this Addendum. An assessment will be conducted during business hours, in a way that does not unreasonably interfere with Tern’s operations or compromise the confidentiality of other customers’ data, and at the Customer’s cost.
10.3 Where Tern holds a current independent audit report or certification covering the Services, Tern may provide it in response to a request under 10.1 or 10.2, and it satisfies the request to the extent it covers the systems, period and matters in question. It does not limit the Customer’s rights under 10.2, the Standard Contractual Clauses or applicable law where it does not.
11. Return and deletion
11.1 During the subscription. The Customer may export and delete Customer Personal Data using the Services, and may ask Tern to delete or return any Customer Personal Data it cannot export or delete itself. Tern will act on a valid deletion request during the subscription within the period applicable law allows, without waiting for the subscription to end.
11.2 When the subscription or a Service ends. When the Customer’s subscription ends or the Customer closes its account, for any reason, this Section applies to all Customer Personal Data. When only a particular Service ends while the subscription continues, it applies only to Customer Personal Data held solely for that Service, and data the Customer still uses in other Services continues to be processed under this Addendum. Not using a Service, without ending it, is not termination, and Tern does not delete Customer Personal Data solely because a subscription is paused, as Section 11.3 describes; the Customer may resume without loss of data. In either case (“termination”), there are three stages, and an exception for data the law requires Tern to keep:
- export: the Customer may, for thirty (30) days, export Customer Personal Data or ask Tern to return it in a commonly used format, and Tern will give secure access for that purpose to an authenticated and authorized representative of the Customer, whether or not the subscription remains payable, unless the law prevents it;
- active-system deletion: after the export period Tern will delete Customer Personal Data from its active systems no later than ninety (90) days after termination, subject to any shorter period required by law. If the Customer requests earlier deletion, Tern will act within the period applicable law requires. If the Customer and Tern expressly agree, as a separate continuing service, that Tern will keep some Customer Personal Data available after termination, that agreement will state its duration or the event that ends it, and Tern will delete that data within ninety (90) days after it ends, the same as on any other termination;
- backup expiry: once Customer Personal Data is deleted from active systems, copies in backups are deleted as backups expire, within thirty (30) days after that deletion, are not used or accessed except to restore systems, and if a backup is restored Tern will re-apply the deletion; and
- Tern may keep Customer Personal Data only to the extent the law requires, and only for as long as it requires, and will protect and use it only for that purpose.
Tern will confirm deletion on request, describing any copies kept under (c) or (d).
11.3 Suspension or pausing is not termination. Suspension or restriction of an account, for example during a security or fraud review, and the Customer electing to pause its subscription without closing its account, do not start the periods in Section 11.2. A paused subscription remains open until the Customer closes its account or the subscription otherwise ends under Section 11.2; it is not treated as ended merely because it is paused. Tern keeps Customer Personal Data under this Addendum while the account remains suspended, restricted or paused, subject to the Customer’s valid deletion instructions and applicable retention limits. A pause or suspension does not prevent the Customer from requesting deletion or ending its account, except to the extent a legal restriction applies.
11.4 Customer Data that is not personal information. This Section 11 also applies to Customer Data that is not personal information.
11.5 An Advisor leaving an Agency. Where an Advisor leaves an Agency, Section 8.4 of the Terms applies. Continuing access, transfer or export of client information follows the instructions of the controller of that information, the agreement between the Advisor and the Agency and the law; where they are in dispute, Tern may temporarily restrict the disputed information until it receives joint instructions, a court or arbitral order or another binding resolution, and is not required to decide the dispute, but will act on any requirement of the law or a regulator in the meantime.
12. International transfers
12.1 Where Tern processes. Tern processes Customer Personal Data in the United States and in the other countries where Tern and its sub-processors operate, as Annex III shows.
12.2 EEA transfers. To the extent Customer Personal Data subject to the EU General Data Protection Regulation is transferred to Tern and the transfer is not covered by an applicable adequacy decision, and Tern’s processing of it is not itself directly subject to that Regulation under its Article 3, the parties agree to the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (the “Standard Contractual Clauses”), which are incorporated by reference. The elections are:
| Element | Election |
|---|---|
| Module | Module Two where the Customer is a controller; Module Three where the Customer is a processor (Section 1.3) |
| Parties | The Customer is the data exporter and Tern the data importer, as Annex I identifies them |
| Clause 7 (docking) | Applies |
| Clause 9(a) (sub-processors) | Option 2, general written authorization, with the notice period in Section 7.2 |
| Clause 11(a) (redress) | The optional language does not apply |
| Clause 13(a) (supervisory authority) | Where the Customer is established in an EU Member State, the supervisory authority responsible for ensuring the Customer’s compliance with the GDPR as regards the transfer; where the Customer is not established in an EU Member State but is subject to the GDPR under its Article 3(2) and has appointed a representative under Article 27(1), the supervisory authority of the Member State in which that representative is established; and where the Customer is not established in an EU Member State and is not required to appoint a representative, the supervisory authority of one of the Member States in which the data subjects whose Customer Personal Data is transferred under the Standard Contractual Clauses in relation to the offering of goods or services to them, or whose behavior is monitored, are located, as the Customer records it in its account before any transfer begins |
| Clause 17 (governing law) | Option 1, the law of Ireland |
| Clause 18(b) (courts) | The courts of Ireland |
| Annexes | Annexes I, II and III to this Addendum complete Annexes I, II and III to the Standard Contractual Clauses |
Where Tern’s processing of Customer Personal Data is, or is found to be, directly subject to the GDPR under Article 3, Section 12.2 does not apply to it, and Tern will transfer that data only under a transfer mechanism that Chapter V of the GDPR makes available for the transfer at the time it occurs; if no such mechanism is available, Tern will not make the transfer and will tell the Customer. This Addendum’s processor terms continue to apply alongside any such mechanism.
12.3 UK transfers. To the extent Customer Personal Data subject to the UK General Data Protection Regulation is transferred to Tern, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force from 21 March 2022 (the “UK Addendum”), applies whether or not Section 12.2 applies. It incorporates “Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.” Table 1 is completed with the parties identified in Annex I; Table 2 with the Approved EU SCCs, including the Appendix Information and with only the modules, clauses and optional provisions elected in Section 12.2 brought into effect for the purposes of the UK Addendum; Table 3 with Annexes I, II and III to this Addendum; and in Table 4 neither party may end the UK Addendum under its Section 19. The UK Addendum’s own provisions on hierarchy, governing law and courts apply to it, including any right of an individual to bring proceedings in the UK courts it provides for, and the Irish elections in Section 12.2 do not.
12.4 Swiss transfers. To the extent Customer Personal Data subject to the Swiss Federal Act on Data Protection is transferred to Tern, whether or not Section 12.2 applies, the Standard Contractual Clauses apply with these adaptations: references to the GDPR are to be understood as references to the Swiss Act insofar as the transfer is subject to the Swiss Act; the term “Member State” is not to be interpreted so as to exclude data subjects in Switzerland from bringing proceedings for their rights in their place of habitual residence (Switzerland) under Clause 18(c); and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by the Swiss Act. Where a transfer is governed by both the GDPR and the Swiss Act, the EU supervisory authority under Section 12.2 remains competent for the GDPR, alongside the Commissioner for the Swiss Act.
12.5 References. In Sections 1.2 and 15, the Standard Contractual Clauses include them as adapted under Section 12.4, and the UK Addendum.
12.6 Onward transfers. Tern will disclose Customer Personal Data to a sub-processor or any other recipient, including one in the same country as Tern and including by remote access, only as the Standard Contractual Clauses and applicable law permit, and under an appropriate safeguard where one is required. Before relying on the Standard Contractual Clauses, Tern will assess the laws and practices of the destination as they apply to the transfer, as Clause 14 requires, and will make that assessment available to the Customer on request.
13. United States state privacy laws
13.1 Section 11.2 of the Terms is Tern’s service provider agreement with the Customer under the California Consumer Privacy Act. The Customer discloses Customer Personal Data to Tern only for the limited and specified Business Purposes set out in Section 11.2(a) of the Terms. The Customer’s right to take reasonable and appropriate steps to ensure that Tern uses Customer Personal Data consistently with the Customer’s obligations, and to stop and remediate unauthorized use, includes ongoing steps such as reviews and questionnaires under Section 10.1, in addition to the assessments in Section 10.2.
13.2 For other US state laws that impose obligations on processors, Tern will process Customer Personal Data as this Addendum and those laws require, including by processing only on the Customer’s instructions, keeping it confidential, deleting or returning it as Section 11 provides, making available the information in Section 10, cooperating with reasonable assessments, and engaging sub-processors only under Section 7. The nature and purpose of the processing, the types of data and the duration are set out in Annex I.
14. Canada
Where Canadian privacy law applies to Customer Personal Data, Tern will protect it to a level comparable to that required of the Customer, will use it only for the purposes of providing the Services to the Customer and as Section 3.3 permits, and will give the Customer the assistance it reasonably needs to meet its obligations, including on access and correction requests and breaches of security safeguards. Customer Personal Data may be stored and processed in the United States, where it may be accessed by the courts, law enforcement and national security authorities.
15. Liability
Liability under this Addendum, other than under the Standard Contractual Clauses, is subject to the limitations and exclusions in Section 16 of the Terms. Nothing in this Addendum or the Terms limits or excludes either party’s liability under the Standard Contractual Clauses, whether to the other party or to individuals, or any liability that cannot be limited by law, and nothing in Section 20 or 23 of the Terms limits a right of an individual under the Standard Contractual Clauses.
16. Term
This Addendum applies for as long as Tern processes Customer Personal Data, and survives the end of the Terms to that extent.
Annex I. Description of the processing
Parties. Data exporter and controller (or processor under Section 1.3): the Customer, identified by the legal name, address and account administrator recorded in its account, which it confirms on acceptance; the Customer’s acceptance of the Terms is its signature, and the date of acceptance is the date of this Annex. Data importer and processor: Tern Software, Inc., 1111B S Governors Ave #6194, Dover, Delaware 19904, privacy@tern.travel, which executes this Addendum by making it available for acceptance, with effect from the Customer’s acceptance, and which keeps a record of the version, modules and elections accepted. Contact: David Shull, privacy officer.
Competent supervisory authority. As determined under the Clause 13(a) election in Section 12.2.
Customer’s Article 27 representative, where required or appointed. Where the Customer is not established in the EEA but is subject to the GDPR under its Article 3(2), the representative recorded in the Customer’s account. This is a role the Customer designates for itself under Article 27, separate from the competent supervisory authority above, and is not itself a regulator.
Categories of individuals. The Customer’s clients and prospective clients, travelers and their companions, including children where an Advisor plans family travel; the Customer’s Advisors, employees, contractors and other users; marketing contacts; and supplier and business contacts.
Categories of personal data, to the extent the Customer uses the features concerned. Identity and contact details; travel identity documents (passport number, name as shown, date of birth, sex, nationality, place of birth, issuing authority and expiry, driver’s license, Known Traveler and redress numbers, loyalty program numbers); trip, itinerary, booking and preference information, including travel insurance details; communications, including email and calendar content from connected accounts; documents and images, including location stored in photograph metadata; payment card information, collected and held by Tern’s tokenization provider, with Tern holding a token in its place; invoicing, payment and ledger records; and marketing contact and subscription status, including the contact lists and subscription status used for email campaigns that Advisors send to their own clients through the Platform.
Sensitive data. Government identification numbers; financial account and payment information; precise location stored in uploaded photographs; and dietary and accessibility notes, which can reveal health or religious belief. Restrictions and safeguards: the measures in Annex II, including a separately encrypted field for passport details, and access limited to personnel who need it.
Frequency. Continuous, for as long as the Customer uses the Services.
Nature and purpose. Hosting, storing and displaying Customer Personal Data and performing the features the Customer uses, being the Business Purposes in Section 11.2(a) of the Terms, on the Customer’s instructions under Section 3.
Duration and retention. For the term of the Customer’s use of the Services and the export and deletion periods in Section 11, and as the Customer’s own retention settings and requests provide.
Sub-processors. As Annex III lists, for the functions shown there.
Annex II. Technical and organizational measures
- Encryption. Encryption of data in transit. Passport details held in a separately encrypted field and encrypted at rest. Encryption at rest of other Customer Personal Data in Tern’s primary database.
- Payment data. Card data collected and held by a PCI DSS compliant tokenization provider, with Tern holding a token; card security codes used only for the payment for which collected, never retained after authorization, and before authorization retained only as payment-network rules and PCI DSS permit, never longer than thirty (30) days.
- Access control. Role-based access to the Platform, with Agency and Advisor permissions that separate one customer’s data from another’s; access by Tern personnel limited to those who need it to provide, support and secure the Services.
- Logging and monitoring. Logging of access and activity, and error and security monitoring.
- Session recording. Session recording in the web application captures what appears on the screen, including traveler and booking details an advisor views and text typed into form fields, and is linked to the advisor’s user ID, name and email. It excludes password fields, hidden form fields, payment card fields and passport images; masks passport details, travel document fields and bank details; removes query strings and fragments from page addresses; and discards IP addresses after processing. Administrator accounts and payment pages are not recorded, and travelers are recorded only where Tern has enabled recording for them. Sentry’s session replay in the mobile apps is described in Annex III.
- AI providers. AI features using Anthropic PBC, OpenAI or the paid tier of Google’s Gemini Developer API operate under commercial terms and settings that prevent those providers from training on Customer Personal Data. For OpenAI, sharing of inputs and outputs and of evaluation and fine-tuning data is disabled at the organization level. Gemini calls use the paid tier. OpenAI retains abuse-monitoring logs for up to thirty (30) days, subject to any longer retention legally required. The separate Intercom support-assistant use is described in Annex III and remains subject to Section 3.4.
- Incident response. A process for detecting, investigating, containing and notifying Personal Data Breaches under Section 6.
- Personnel. Confidentiality obligations for personnel under Section 4.
- Further measures. Multi-factor authentication on administrator accounts and on access to payment card data; documented data protection policies and security awareness training for personnel, including phishing training; and regular backups, with a documented process to restore availability of and access to data after an incident.
Annex III. Sub-processors
Tern uses the following sub-processors for Customer Personal Data, as of October 22, 2026. Where a vendor does not publish a location or a support-access country, the table says so. The country lists referred to as the Schedule follow the table, and the own-purpose statement follows the Schedule.
| Sub-processor (contracting entity) | Function | Where Customer Personal Data is stored or processed | Countries from which personnel may remotely access it | Transfer mechanism for transfers outside the United States |
|---|---|---|---|---|
| Salesforce, Inc. (Heroku) | Application hosting, primary database, cache and background workers | United States (AWS; Tern’s region confirmed in the Heroku console). | United States, Argentina, Australia, Austria, Brazil, Canada, France, Germany, India, Ireland, Israel, Italy, Japan, Netherlands, Singapore, South Korea, Spain, Sweden, Switzerland, Thailand, United Kingdom; and screen-sharing tools provided by Google, in the countries in Part C of the Schedule. | Salesforce processor binding corporate rules; standard contractual clauses (Modules 2 and 3) with UK and Swiss terms; EU-US, UK and Swiss Data Privacy Framework. |
| Google LLC (Google Cloud, Gemini API, Firebase Cloud Messaging) | Cloud infrastructure (object storage, messaging, data warehouse, maps); push notifications to the traveler mobile app; AI features (tagging of uploaded photos and writing of hotel descriptions) | Primary storage and data warehouse: United States (us-east4 and US multi-region). Messaging topics: United States, except one Gmail notification topic published by Google’s Gmail service, whose location Google does not publish, carrying only an advisor’s email address and a mailbox history ID. Maps, Firebase Cloud Messaging and the Gemini API: Google makes no location commitment; the Google data center countries in Part C of the Schedule. | Google Cloud support affiliates: United States, Argentina, Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Chile, Colombia, Czech Republic, Denmark, El Salvador, Finland, France, Germany, India, Indonesia, Ireland, Israel, Italy, Japan, Luxembourg, Malaysia, Mexico, Netherlands, New Zealand, Philippines, Poland, Portugal, Romania, Singapore, Slovakia, South Korea, Spain, Sri Lanka, Sweden, Switzerland, Taiwan, United Kingdom. Gemini API: not published by Google, whose terms allow processing in any country where Google or its sub-processors have facilities. Firebase: third-party support vendor countries not published. | EU-US, UK and Swiss Data Privacy Framework (Google LLC); Google Cloud standard contractual clauses (Modules 2 to 4) with UK and Swiss terms; Google’s processor data processing terms for the paid Gemini API and the Firebase data processing terms. |
| Anthropic, PBC | AI features (parsing of travel confirmations and assistance features) | Storage: United States. Inference: any Google Cloud, AWS or Azure location Anthropic uses (countries not published by Anthropic). Other Anthropic sub-processors: United States, South Africa and Canada. | United States, United Kingdom, Canada, Ireland, Switzerland, France, Japan, Germany, South Korea, Australia, South Africa. | Standard contractual clauses (Modules 2 and 3), UK Addendum and Swiss Addendum; no Data Privacy Framework certification. |
| OpenAI OpCo, LLC | AI features (parsing of travel confirmations and assistance features) | Tern uses OpenAI’s standard API host, without a data residency commitment. OpenAI lists processing in: United States, Australia, Brazil, Canada, Finland, France, Germany, India, Indonesia, Ireland, Italy, Japan, Malaysia, Mexico, Netherlands, Norway, Poland, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, United Arab Emirates, United Kingdom. | United States, Australia, Brazil, Canada, France, Germany, India, Indonesia, Ireland, Italy, Japan, Netherlands, Philippines, Singapore, South Africa, South Korea, Sweden, Switzerland, United Arab Emirates, United Kingdom. | Standard contractual clauses (Modules 2 and 3), UK Addendum and Swiss terms, in OpenAI’s data processing addendum; no Data Privacy Framework certification. |
| Nylas, Inc. | Advisor email and calendar sync, scheduling pages, and meeting recording and notes | United States (Tern’s integration uses Nylas’s US region). Nylas sub-processors are also in Luxembourg, Ireland, the United Kingdom and Canada and, as Nylas describes them, in the “EU” and “APAC” (countries not published). | Not stated in Nylas’s standard terms. Nylas support tools: United States, Germany, Ireland, Singapore, Australia; and an EU-hosted support tool (country not published). | EU-US, UK and Swiss Data Privacy Framework. Nylas’s standard data processing addendum is not public. |
| IXOPAY, Inc. (formerly TokenEx, Inc.) | Tokenization of payment card and bank account details | United States (Microsoft Azure, Central US). Backup region not published by the vendor. | United States, Austria. | Standard contractual clauses (Modules 1 to 3 under the current data processing addendum; Module 2 under the legacy terms) and UK Addendum; no Swiss terms; no Data Privacy Framework certification. |
| Fullstory, Inc. | Session recording in the web application | United States (NA1 region); Germany (EU region) reserved under Fullstory’s data processing addendum, which also permits processing in other countries it does not name. Optional AI features use OpenAI in the United States. | Fullstory has offices in the United States, United Kingdom, Australia and Singapore; the countries from which personnel may access Customer Personal Data are not contractually specified in the vendor disclosures reflected in this list. | EU-US, UK and Swiss Data Privacy Framework; standard contractual clauses (Modules 2 and 3), UK Addendum and Swiss terms. |
| Functional Software, Inc. d/b/a Sentry | Crash reporting for the traveler mobile app (including session replay) and the advisor iOS and Android apps | United States (Sentry organization storage region set to the US; Tern’s apps send to the US ingest region). Sentry sub-processors: AWS, Google Cloud, Cloudflare (EU and US) and Mailgun (EU; countries not published). | United States, Austria, Canada, Netherlands (Sentry affiliates). | EU-US, UK and Swiss Data Privacy Framework; fallback standard contractual clauses (Module 2 or 3, Irish law), UK Addendum and Swiss modifications. |
| SmartBear Software, Inc. (Bugsnag) | Error and crash reporting | United States (Google Cloud). SmartBear group sub-processors that do not store Bugsnag error data: Ireland (AWS) and Australia (Atlassian). | United States, Ireland, United Kingdom, Poland, India, France. | Standard contractual clauses (Module 2, general authorization of sub-processors), UK Addendum and Swiss modifications; no current Data Privacy Framework certification. |
| AppSignal B.V. | Application performance monitoring | Netherlands; backups on AWS in the EU (region not published); alert emails through Mailgun in the United States. | Netherlands, Greece, Latvia, Pakistan, Portugal, Spain, United Kingdom, United States (countries where AppSignal staff work; which staff can access customer data is not published). | Data is stored in the Netherlands. For data centers outside the EEA, AppSignal states that appropriate safeguards are in place without naming them. Mailgun (alert email): Data Privacy Framework. |
| SolarWinds Worldwide, LLC (Papertrail) | Application log aggregation and search (logs include platform user identifiers) | United States (SolarWinds gives its headquarters country only). Support tool: Australia (Atlassian). | United States, Australia, Canada, Czech Republic, France, Germany, India, Ireland, Israel, Japan, Philippines, Poland, Saudi Arabia, Singapore, South Korea, Sweden, Turkey, United Arab Emirates, United Kingdom (SolarWinds affiliates; support role not stated). Support tools: Australia (Atlassian), United States (PagerDuty, Slack). | Standard contractual clauses (Module 2), UK Addendum and Swiss Addendum; no Data Privacy Framework certification. |
| Fivetran Inc. | Data replication to the data warehouse | United States (processing follows the destination, which is Tern’s US multi-region BigQuery warehouse). | United States, Australia, Canada, Germany, Greece, India, Ireland, Japan, Netherlands, New Zealand, Serbia, United Kingdom; and support and professional-services vendors in India, Southeast Asia and Latin America and AI vendors worldwide, in countries Fivetran does not publish. | EU-US, UK and Swiss Data Privacy Framework; fallback standard contractual clauses (Module 2 or 3, Irish law), UK Addendum and Swiss amendments. |
| Hex Technologies Inc. | Analytics notebooks over replicated platform records | United States (Hex’s US stack; the specific AWS region is not contractually specified in the vendor disclosures reflected in this list). | Not published by Hex. Its support tool is in the United States, and Hex says its staff are in the United States, Canada and a few other countries. | EU-US, UK and Swiss Data Privacy Framework; fallback standard contractual clauses (Modules 2 and 3), UK and Swiss terms. |
| ThoughtSpot, Inc. | Advisor-facing reporting and analytics | Google Cloud; the region holding Tern’s cluster is not specified in the vendor disclosures reflected in this list. | United States, United Kingdom, India, Australia. | EU-US, UK and Swiss Data Privacy Framework; standard contractual clauses (Modules 2 and 3) and UK addendum; Swiss transfers through the Data Privacy Framework only. |
| Intercom, Inc. | Customer support messaging and AI support assistant (including its memory of earlier conversations) | United States (AWS). Email in transit: countries not published by Intercom. | United States, Ireland, United Kingdom, Australia; Intercom does not exclude remote access from other countries. | EU-US, UK and Swiss Data Privacy Framework; fallback standard contractual clauses (Modules 1 to 3), UK Addendum and Swiss terms. |
| Twilio Inc. (SendGrid, Twilio messaging) | Email delivery to advisors and travelers, and email campaigns that advisors send to their own clients through the Platform (SendGrid; the campaigns feature is in beta and is sent from a separate domain under Tern’s SendGrid account); SMS for two-factor authentication and security alerts (Twilio) | United States. SendGrid: Tern sends from US IP addresses only, in SendGrid’s Global region; EU routing countries not published. Twilio: reporting database (ClickHouse) in the EU, country not published; carriers in the recipient’s country. | SendGrid and Twilio: United States, Australia, Brazil, Canada, Colombia, Estonia, France, Germany, Hong Kong, India, Ireland, Japan, Singapore, Spain, Sweden, United Kingdom (members of Twilio’s binding corporate rules group; which of them provide support is not stated). Twilio’s sub-processor list covers SendGrid. | EU-US, UK and Swiss Data Privacy Framework; standard contractual clauses (Modules 1 to 3) and UK IDTA; Twilio’s binding corporate rules, which do not cover SendGrid. |
| Cloudflare, Inc. | Content delivery, web application firewall and bot protection (carries platform traffic, so it sees users’ IP addresses and request metadata) | Edge data centers nearest each end user, in the countries in Part A of the Schedule. Core data center locations for logs and metadata are not published. | United States, Australia, Canada, France, Germany, India, Japan, Malaysia, Mexico, Netherlands, Portugal, Singapore, South Korea, Sweden, Switzerland, United Arab Emirates, United Kingdom. | EU-US, UK and Swiss Data Privacy Framework; standard contractual clauses (Modules 2 and 3) with UK and Swiss terms; Global CBPR certification. |
| Fastly, Inc. | Content delivery for the platform’s stylesheets, scripts and images (receives users’ IP addresses) | Edge locations nearest each end user, in the countries in Part B of the Schedule; logs and backend as stated there. | Fastly affiliates in Australia, Canada, France, Germany, India, Japan, Netherlands, Singapore, Spain, Sweden, United Kingdom (Fastly does not say which provide support). | EU-US, UK and Swiss Data Privacy Framework; standard contractual clauses (Module 2 or 3, Dutch law), UK Addendum or IDTA and Swiss terms. |
| WeTransfer B.V. | Large file exchange during agency onboarding and data migration | United States for US uploads; the EU for EU uploads (countries not published). | EU and United States: Bending Spoons and its affiliates provide customer and technical support (individual countries not published). Support vendors: Zendesk and Support Your App (EU), OpenAI (United States). | Standard contractual clauses (Modules 2 and 3, for EEA customers); no UK or Swiss terms; no current Data Privacy Framework certification. |
| Modal Labs, Inc. | Hosting for Tern’s internal AI support agent, which investigates customer accounts | Requests are routed through Virginia, United States. Execution runs in any Modal region unless pinned, and Tern pins none: United States, European Economic Area, United Kingdom, Canada, Mexico, Japan, Australia, Asia-Pacific, Middle East, South America and Africa (countries within the broader regions not published). | Not published by Modal. Its data processing addendum mentions affiliates in countries without adequacy decisions without naming them; Modal has offices in the United States, Sweden and the United Kingdom. | Standard contractual clauses (Modules 1 to 3, Swedish law), UK IDTA and Swiss terms, in Modal’s data processing addendum, which also permits reliance on GDPR Article 49 derogations; no Data Privacy Framework certification. |
Own-purpose use by sub-processors. Tern states that the following sub-processors’ standard terms permit them to use some Customer Personal Data for their own purposes, in the ways described. Tern does not permit any other use.
- Fullstory, Inc. may use Customer Personal Data to improve its own service, and owns de-identified, aggregated usage data derived from it. Fullstory’s terms provide no setting that turns this off. Annex II describes what session recordings capture and the masking applied.
- Intercom, Inc. trains and fine-tunes the models behind its AI support assistant on customer data from Tern’s workspace only after it has been anonymized to the standard required by applicable law, and Tern has not opted out. The assistant can also remember context from a customer’s earlier conversations to personalize its answers.
- Functional Software, Inc. (Sentry) may use non-identifying service data to improve its product. Tern has left Sentry’s setting for aggregated identifying data off.
- Modal Labs, Inc. may use aggregated service metrics.
Anthropic PBC, OpenAI OpCo, LLC and Google LLC do not use Customer Personal Data to train models under the terms Tern uses, as Annex II sets out. None of the uses described in this Annex extends to information received from Google APIs beyond what the Google API Services User Data Policy, including its Limited Use requirements, allows (Section 3.4).
Schedule to Annex III. Country lists
Part A. Cloudflare edge data centers (the data center nearest each end user): Afghanistan, Algeria, Andorra, Angola, Argentina, Azerbaijan, Bahrain, Bangladesh, Barbados, Belgium, Belize, Benin, Bhutan, Bolivia, Bosnia and Herzegovina, Botswana, Brazil, Brunei, Bulgaria, Burkina Faso, Canada, Chile, China, Colombia, Comoros, Costa Rica, Croatia, Cyprus, Czech Republic, Democratic Republic of the Congo, Denmark, Djibouti, Dominican Republic, Ecuador, Egypt, El Salvador, Equatorial Guinea, Estonia, Ethiopia, Fiji, Finland, France, Georgia, Germany, Ghana, Grenada, Guadeloupe, Guam, Guatemala, Guyana, Haiti, Honduras, Hong Kong, Hungary, Iceland, India, Indonesia, Iraq, Ireland, Israel, Italy, Jamaica, Japan, Jordan, Kazakhstan, Kenya, Kyrgyzstan, Laos, Latvia, Lebanon, Lesotho, Lithuania, Luxembourg, Macau, Madagascar, Malaysia, Maldives, Mali, Malta, Mauritius, Mexico, Moldova, Monaco, Mongolia, Morocco, Mozambique, Myanmar, Namibia, Nepal, Netherlands, New Zealand, Nicaragua, Nigeria, North Macedonia, Norway, Oman, Pakistan, Panama, Paraguay, Peru, Philippines, Poland, Portugal, Puerto Rico, Qatar, Romania, Russia, Rwanda, Réunion, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Samoa, Saudi Arabia, Senegal, Serbia, Singapore, Slovakia, Slovenia, South Africa, South Korea, Spain, Sri Lanka, Sweden, Switzerland, Taiwan, Tajikistan, Tanzania, Thailand, Timor-Leste, Trinidad and Tobago, Tunisia, Turkey, Turkmenistan, Ukraine, United Arab Emirates, United Kingdom, United States, Uruguay, Uzbekistan, Vietnam, Zimbabwe.
Part B. Fastly. Edge locations (the location nearest each end user): Argentina, Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Chile, Colombia, Czech Republic, Denmark, Finland, France, Germany, Ghana, Hong Kong, India, Ireland, Italy, Japan, Malaysia, Mexico, Netherlands, New Zealand, Norway, Peru, Philippines, Poland, Portugal, Saudi Arabia, Singapore, South Africa, South Korea, Spain, Sweden, Thailand, United Arab Emirates, United Kingdom, United States. Logs and backend: Google (Australia, Belgium, Canada, Germany, Japan, Netherlands, United Kingdom, United States) and AWS (Australia, Brazil, Canada, France, Germany, India, Ireland, Japan, Singapore, South Africa, South Korea, Sweden, United Kingdom, United States), per Fastly’s sub-processor list of 14 September 2026.
Part C. Google data center countries for Google services without a location commitment (Google’s published data center locations; this is not a commitment that Customer Personal Data is processed in each listed country or only in those countries): Austria, Belgium, Chile, Denmark, Finland, Germany, India, Ireland, Japan, Malaysia, Netherlands, Norway, Singapore, South Korea, Sweden, Taiwan, Thailand, United Kingdom, Uruguay, United States.