Privacy Notice

Cytric Mobile

First Layer

Basic information about the processing of Personal Data * This Notice explains how Amadeus processes Personal Data as a data processor. It does not replace the privacy notice that the Cytric Customer, as data controller, is required to provide.
Data Controller	Your corporation, employer or other organisation that provides you with access to Cytric Mobile (“the Cytric Customer” or “corporation”)
Data Processor	Amadeus IT Group, S.A (“Amadeus”)
Purpose of Personal Data Processing	To provide Cytric mobile services (the “Cytric Mobile”) to Cytric Customers in accordance with a contract entered into between Amadeus and a Cytric Customer. Cytric Mobile is a solution that enables Amadeus Customers to provide their Authorized Users (“Travelers”) access to Cytric Easy and Expense through their mobile devices in order to perform business travel bookings.
Legal Grounds for Processing	The Cytric Customer, as data controller, is responsible for determining the applicable legal basis or legal bases for processing your Personal Data and for providing you with the relevant information. Amadeus processes Personal Data on behalf of the Cytric Customer in accordance with its documented instructions and the applicable agreement.
Recipients of the Personal Data	The Cytric Customer and other recipients involved in providing the selected Cytric services, as well as authorised Amadeus affiliates and third-party service providers acting as subprocessors. Further information is provided below.
Data subject's rights	The Cytric Customer is responsible for handling requests concerning your Personal Data. Please contact the corporation, employer or other organisation that provides you with access to Cytric Mobile if you wish to exercise your data protection rights. The Cytric Customer will contact Amadeus if our assistance is required. If you submit a request directly to Amadeus, we may redirect you to the relevant Cytric Customer or, where applicable, its reseller. Amadeus will not normally respond directly to requests concerning Personal Data that it processes on behalf of a Cytric Customer.

Second Layer

Your corporation, employer or other organisation that provides you with access to Cytric Mobile (“Cytric Customer”) is the data controller responsible for determining how and why your Personal Data is processed through the Cytric Mobile App (“Cytric Mobile” or “the App”). Amadeus IT Group, S.A. (“Amadeus”) provides the App to the Cytric Customer and processes Personal Data on its behalf and in accordance with its documented instructions and the applicable agreement.

This Privacy Notice explains how Amadeus processes Personal Data as a data processor when providing the App. It does not replace the privacy notice or other information provided by the Cytric Customer. The use of the App is also subject to the Cytric Customer’s applicable policies and the App Terms of Use.

Personal Data processed through the App and the available functionalities may vary depending on the services selected and configured by the Cytric Customer. Amadeus processes such Personal Data only to provide, operate, support and secure the App in accordance with the Cytric Customer’s instructions. This may include providing travel booking and expense-management functionalities, displaying and managing travel information, sending service or travel-related communications, and providing other functionalities enabled by the Cytric Customer.

This Privacy Notice applies to Personal Data processed by Amadeus through or in connection with the App on behalf of the Cytric Customer. It does not apply where Amadeus processes Personal Data for other purposes or in a different capacity. Where Amadeus acts as a data controller for a separate processing activity, the relevant privacy notice will apply.

If you have questions about how your Personal Data is processed, wish to update your information or exercise your data protection rights, please contact the Cytric Customer first. The Cytric Customer is responsible for handling your request and will contact Amadeus if our assistance is required. If you access the App through a reseller, the Cytric Customer may coordinate your request with that reseller.

Who processes your Personal Data through Cytric Mobile?

Amadeus processes Personal Data through Cytric Mobile on behalf of the Cytric Customer and in accordance with Cytric Customer’s documented instructions and the applicable agreement.

What Personal Data is processed?

The Personal Data processed through Cytric Mobile depends on the services and features activated by the Cytric Customer and on how the Customer has configured the App. It may include:

· Identification data;

· Device and network data;

· Usage data;

· IP address;

· Location data;

· Travel data; and

· Any other information you provide to Amadeus in contact forms.

For which purposes is your Personal Data processed?

Amadeus processes the Personal Data collected from you via the Cytric Mobile App for the purposes of:

· Providing Cytric Mobile Services to the Cytric Customer, these are booking and travel related services as well and communicating with travelers in accordance with the App Terms of Use and in accordance with the contract that has been entered into between Amadeus and an Amadeus Customer;

· Sending you necessary information regarding your use of the App, changes to our terms, conditions, and policies and/or other administrative information;

· Operating, maintaining, supporting and securing Cytric Mobile on behalf of the Cytric Customer, including authentication, troubleshooting, service monitoring, fraud and security prevention, and technical audits necessary to provide and protect the service.

In addition to this Privacy Notice, processing of Personal Data is subject to any applicable agreements with the Cytric Customer.

What is the legal basis for the processing of your Personal Data?

The Cytric Customer, as data controller, is responsible for identifying the applicable legal basis or legal bases for processing your Personal Data and for providing you with the corresponding information. Depending on the circumstances and applicable law, the Cytric Customer may rely on the performance of a contract, compliance with a legal obligation, legitimate interests, consent or another applicable legal basis.

Amadeus processes Personal Data on behalf of the Cytric Customer and in accordance with its documented instructions and the applicable agreement. Please contact your corporation if you have questions about the legal basis applicable to the processing of your Personal Data.

With whom are your Personal Data shared?

Amadeus may make Personal Data available, on behalf of and in accordance with the instructions of the Cytric Customer, to the Customer, its authorised users and administrators, travel management companies, travel providers and other recipients required to provide the selected Cytric services. Amadeus may also engage affiliates and third-party service providers as subprocessors, subject to the applicable contractual requirements. Personal Data may be disclosed where required by law or a binding request from a competent authority.

For further information about the recipients of your Personal Data, please contact your corporation. The corporation may contact Amadeus where additional information is required.

For further information about recipients or subprocessors applicable to your use of Cytric Mobile, please contact your corporation. The corporation may contact Amadeus where additional information is required.

International Transfers of Personal Data

In providing Cytric Mobile on behalf of the Cytric Customer, Amadeus and its authorized subprocessors may process Personal Data in countries outside the country in which you are located. Where required by applicable data protection law, appropriate transfer safeguards are implemented, such as an adequacy decision or approved standard contractual clauses. Please contact your corporation first if you require further information. The corporation may contact Amadeus where necessary.

Security and Integrity of Personal Data

Amadeus implements appropriate technical and organisational measures to protect Personal Data processed on behalf of the Cytric Customer. Access is limited to authorised personnel and service providers who require it for the performance of their duties and who are subject to appropriate confidentiality obligations.

If Amadeus becomes aware of a Personal Data breach affecting Personal Data processed on behalf of a Cytric Customer, Amadeus will notify and assist the relevant Customer in accordance with the applicable agreement and data protection law. The Cytric Customer is responsible for assessing whether notification to affected individuals or a competent authority is required.

Third Party Sites

This Privacy Notice does not address how other organizations process Personal Data. In providing the Cytric Mobile Services links may be provided to other organizations including social media platforms. Processing of Personal Data by third parties will be subject to the relevant third-party terms of use and privacy notices.

Retention of Personal Data

Amadeus retains Personal Data processed through Cytric Mobile in accordance with the instructions of the Cytric Customer, the applicable agreement and the retention settings applicable to the relevant Cytric service. Retention periods may vary depending on the type of data, the enabled functionality and the Customer’s configuration. At the end of the applicable retention period, Personal Data is deleted or returned in accordance with the Cytric Customer’s instructions and the applicable agreement, unless its continued retention is required by law. For information about the retention period applicable to your Personal Data, please contact your corporation.

Your rights

The Cytric Customer—the corporation, employer or other organisation that provides you with access to Cytric Mobile—is responsible for handling requests concerning your Personal Data. Please contact your corporation first if you wish to access, correct, delete or restrict the use of your Personal Data, object to processing, withdraw consent where applicable, or exercise any other data protection right. Your corporation will contact Amadeus where our assistance is required. Amadeus does not normally respond directly to such requests because it processes the data on behalf of the Cytric Customer. If you contact Amadeus directly, we may redirect your request to the relevant corporation or reseller.

You may also lodge a complaint with the competent data protection authority. As the Cytric Customer is responsible for the processing, we encourage you to raise your concern with your corporation first so that it can investigate and respond.

Updates

This Privacy Notice is published by Amadeus IT Group S.A. and may be changed at any time. The date it was updated is shown here: July 2026.

Contacting Us

For questions about how your Personal Data is processed through Cytric Mobile, or to exercise your data protection rights, please contact the corporation, employer or other organisation that provides you with access to the App. That organisation is responsible for responding to you and will contact Amadeus if assistance is required.

If you have any questions specifically about the content of this Privacy Notice, please contact us by e-mail at dataprotection@amadeus.com. Please note that Amadeus may need to redirect your enquiry to the relevant corporation or reseller and will not normally fulfil data-subject requests directly.