Accommodation Supply Contracts

Additional “Controller to Controller” Standard Contractual Clauses

These additional “Controller to Controller” Standard Contractual Clauses apply to and are incorporated into certain contracts (each a “Contract”) between Jet2holidays Limited and its accommodation suppliers who are located outside the European Economic Area. In these additional clauses, Jet2holidays is the “Company” and the accommodation supplier is the “Supplier”.

Version date: 1^st May 2025

“Controller to Controller” Standard Contractual Clauses

A.1     International Transfer of Personal Data

A.1.1  “Controller to Controller SCCs" means the Module 1 of the EU Standard Contractual Clauses;

A.1.2 "EU Restricted Transfer" means a transfer of Personal Data by Company or any  member of its Group to the Supplier or any member of its Group (or any onward transfer), in each case, where such transfer would be prohibited by European Data Protection Laws in the absence of the protection for the transferred Personal Data provided by the EU Standard Contractual Clauses;

A.1.3 "EU Standard Contractual Clauses" means the standard contractual clauses set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council,  as amended or replaced from time to time by a competent authority under the relevant Data Protection Laws;

A.1.4 “Services" means the services supplied by Supplier or any member of its Group to Company or any member of its Group pursuant to the Contracts;

A.1.5 "Supervisory Authority" means (a) an independent public authority which is established by a Member State pursuant to Article 51 GDPR; and (b) any similar regulatory authority responsible for the enforcement of Data Protection Laws;

A.1.6 “UK IDTA” means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) Data Protection Act 2018, as amended or replaced from time to time by a competent Supervisory Authority under the relevant Data Protection Laws; and

A.1.7 "UK Restricted Transfer” means a transfer of Personal Data by Company or any member of its Group, as appropriate, to the Supplier or any member of its Group, as appropriate, (or any onward transfer), in each case, where such transfer would be prohibited by UK Data Protection Laws in the absence of the protection for the transferred Personal Data provided by the UK IDTA.

A.2 Restricted Transfers

A.2.1      In respect of any EU Restricted Transfer, Company or any member of its Group, as appropriate, (each as “data exporter”) and Supplier or any member of its Group, as appropriate (each as “data importer”) with effect from the commencement of the relevant transfer, hereby enter into the Controller to Controller SCCs in respect of any transfer from Company or any member of its Group to the Supplier or any member of its Group (or onward transfer), and:

A.2.1.1 Clause 7 – Docking clause of the Controller to Controller SCCs shall apply;

A.2.1.3 Clause 11(a) – Redress of the Controller to Controller SCCs, the optional language shall not apply;

A.2.1.4 Clause 13(a) – Supervision – The Supervisory Authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established (namely the Spanish AEPD, as defined in Appendix 1), as indicated in Annex I.C, shall act as competent Supervisory Authority;

A.2.1.5 Clause 17 – Governing law of the Controller to Controller SCCs Option 1 shall apply and the “Member State” shall be Spain;

A.2.1.6 Clause 18 – Choice of forum and jurisdiction of the Controller to Controller the Member State shall be Spain;

A.2.1.7 Annex 1 of the Controller to Controller SCCs shall be deemed to be pre-populated with the relevant sections of Appendix 1 to this Schedule and the processing operations are deemed to be those described in the Contracts. The frequency of the transfer shall be continuous, as necessary to deliver the Services, and retention shall be determined by the Company in accordance with its standard retention schedules and policies; and

A.2.1.7 Annex 2 of the Controller to Controller SCCs shall be deemed to be pre-populated with the relevant sections of Appendix 2 to this Schedule.

A.2.2      In respect of any UK Restricted Transfer, the Company and each Company Affiliate, as appropriate (as “data exporter”) and the Supplier and each Supplier Affiliate, as appropriate (as “data importer”) with effect from the commencement of the relevant transfer hereby enter into the UK IDTA in respect of any transfer from the Company or any Company Affiliate to the Supplier or any Supplier Affiliate (or onward transfer). The Parties confirm that the information required for the purposes of  Part 1 (Tables) of the UK IDTA is as follows:.

A 2.2.1 Table 1 (Parties): The Parties’ details are as described in Annex IA to Appendix 1 to this Addendum;

A 2.2.2 Table 2 (Selected SCCs, Modules and Selected Clauses):

A.2.2.3 Addendum EU SCCs: the second option is selected (the approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum);

A.2.2.4 Module In Operation: Module 1 of the EU SCCs;

A.2.2.5 Clause 7 (Docking Clause): applied;

A.2.2.6 Clause 11 (Option): not applied;

A.2.2.7 Table 3 (Appendix Information)

(a) the description of the transfer is set out in Annex II to Appendix 1; and

(b) the technical and organisational security measures are as set out in Appendix 2.

A.2.2.8 Table 4 (Ending this Addendum when the Approved Addendum Changes): the third option is selected (neither party).

A.2.3     In relation to EU Restricted Transfers, to the extent that there is any conflict or inconsistency between the terms of the EU Standard Contractual Clauses and the terms of this Addendum the terms of the EU Standard Contractual Clauses shall take precedence.

A.2.4     In relation to UK Restricted Transfers, to the extent that there is any conflict or inconsistency between the terms of the UK IDTA and the terms of this Addendum the terms of the UK IDTA shall take precedence.

A.2.5     In respect of any EU Restricted Transfer or UK Restricted Transfer, on request from the Company or a Company Affiliate, the Supplier shall promptly execute full‑form version(s) of the EU Standard Contractual Clauses and/or the UK IDTA which shall be amended and populated in accordance with clause 2.1 and 2.2 above as applicable, in respect of the relevant EU Restricted Transfer and/or UK Restricted Transfer.

A.2.6     If, and to the extent that, the European Commission or the United Kingdom Government issues any amendment to, or replacement of, the EU Standard Contractual Clauses or UK IDTA pursuant to Article 46(5) of the GDPR or Article 46 of the UK GDPR, the Parties agree in good faith to take such additional steps as necessary to ensure that such replacement terms are implemented across all transfers.

A.2.7     If, at any time, a Supervisory Authority or a court with competent jurisdiction over a Party mandates that transfers from Controllers in the EEA or the United Kingdom to Processors established outside the EEA or the United Kingdom must be subject to specific additional safeguards (including but not limited to specific technical and organisational measures), the Parties shall work together in good faith to implement such safeguards and ensure that any transfer of Personal Data is conducted with the benefit of such additional safeguards.

A.2.8     To the extent that the Supplier engages in an arrangement that involves an EU Restricted Transfer and / or a UK Restricted Transfer, the Supplier shall ensure that an adequate safeguard is in place between the Supplier or any Supplier Affiliate and the third party to protect the transferred Personal Data in compliance with Data Protection Laws. The Supplier shall make available evidence of such safeguard to the Company on reasonable request.

A.3 Technical Safeguards

A.3.1      The Supplier undertakes that neither it nor any Supplier Affiliate has taken any steps to facilitate access to Personal Data (including systems on which Personal Data is Processed) by any Public Body, including (without limitation) by:

A.3.1.1 creating back-doors or similar programming that provide a mechanism for a Public Body to access Personal Data;

A.3.1.2 changing its business processes with the express intention of facilitating access to Personal Data.

A.3.2      The Supplier further undertakes that neither it nor any Supplier Affiliate is subject to applicable laws that would require the Supplier or any Supplier Affiliate to take any of the steps referred to in clauses A.3.1.1 or A.3.1.2.

APPENDIX 1 – DESCRIPTION OF THE PROCESSING

EXPLANATORY NOTE:

It must be possible to clearly distinguish the information applicable to each transfer or category of transfers and, in this regard, to determine the respective role(s) of the Parties as data exporter(s) and/or data importer(s). This does not necessarily require completing and signing separate appendices for each transfer/category of transfers and/or contractual relationship, where this transparency can achieved through one appendix. However, where necessary to ensure sufficient clarity, separate appendices should be used.

ANNEX I

A. LIST OF PARTIES

Data exporter(s)

1. Name: Jet2holidays Limited

Address:  Low Fare Finder House, Leeds Bradford Airport, Leeds, LS19 7TU

Contact person’s name, position and contact details: privacy@jet2.com

Activities relevant to the data transferred under these Clauses: To provide accommodation and associated services to Jet2holidays’ customers.

Signature and date:  As per the Contract (unless signed separately).

Role (controller/processor): Controller

Data importer(s):

1. Name: ...The Supplier’s details are outlined in the Contract.

Address:  The Supplier’s details are outlined in the Contract.

Contact person’s name, position and contact details: As outlined in the Contract.

Activities relevant to the data transferred under these Clauses: To provide accommodation and associated services to Jet2holidays’ customers.

Signature and date: As per the Contract (unless signed separately).

Role (controller/processor): Controller

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

• Jet2holidays’ customers

Categories of personal data transferred

• Jet2holidays’ Customer Names
• Age
• Travel details included holiday reference number
• Complaint/ Claim related correspondence or/and communications
• Complaint/ Claim related correspondence or/and communications
• Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
• Incidental, if any assisted travel was requested, or any information included in any customer/claim related information.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

• Data is transferred on a continuous basis, as needed, for reservations and customer service updates.

Nature of the processing

• Processing involves sharing personal data for the purposes of booking hotels as part of Jet2holiday package. The data processed includes customers' names, ages, complaint or claim-related correspondence or communications, and special category data related to travel assistance information where applicable. Purpose(s) of the data transfer and further processing
• The purpose of processing the data is to manage the reservations made by Jet2holidays, and/or to answer to the questions relating to Jet2holidays customers claims or complaints.
• The period for which the personal data will be retained by the hotel in line with their retention period as a data controller.
• Data will be processed by sub-processors only for as long as necessary to fulfil their obligations to the hotel.

C. COMPETENT SUPERVISORY AUTHORITY

Spanish Data Protection Agency – Agencia Espanda Proteccion Datos (AEPD)

APPENDIX 2- TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

EXPLANATORY NOTE:

The technical and organisational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers.

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Measures of pseudonymisation and encryption of personal data 

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services 

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident 

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing 

Measures for user identification and authorisation  

Measures for the protection of data during transmission  

Measures for the protection of data during storage 

Measures for ensuring physical security of locations at which personal data are processed 

Measures for ensuring events logging 

Measures for ensuring system configuration, including default configuration Measures for internal IT and IT security governance and management Measures for certification/assurance of processes and products 

Measures for ensuring data minimisation 

Measures for ensuring data quality 

Measures for ensuring limited data retention 

Measures for ensuring accountability