This Data Processing Addendum ("DPA") describes privacy, security, and data processing terms that may apply when Global Legal Benefits, LLC ("GLB," "we," "our," or "us") processes personal information in connection with TravelCounsel, the TravelCounsel portal, travel legal readiness tools, emergency alert features, crisis intake, attorney-resource information, reimbursement-support workflows, and related services.
This DPA applies only to the extent it is incorporated into, referenced by, or otherwise made applicable under a written agreement between GLB and a customer, Program Sponsor, carrier, MGA, TPA, broker, affinity group, employer, university, administrator, vendor, or other contracting party.
1. Scope
This DPA applies to personal information processed by GLB or applicable service providers in connection with eligibility validation, member activation, portal administration, trip setup, travel alerts, emergency contact workflows, Emergency Alert, Crisis Checkpoint, legal crisis intake, attorney-resource information, consular-resource information, secure messaging, reimbursement documentation, reporting, analytics, sponsor administration, carrier or TPA coordination, billing support, communications, and related services.
This DPA does not replace any separate program agreement, membership terms, certificate, privacy policy, website terms of use, vendor agreement, broker agreement, data sharing agreement, carrier agreement, TPA agreement, or other written agreement.
2. Definitions
| Term | Meaning |
|---|
| Applicable Privacy Laws | U.S. federal, state, local, and, where applicable, international privacy, data protection, breach notification, consumer protection, electronic communications, and related laws that apply to processing under the applicable agreement. |
| Customer | The organization or party that has entered into an agreement with GLB or its authorized representatives. A Customer may include a Program Sponsor, university, employer, credit card program, affinity group, association, carrier, MGA, TPA, broker, administrator, vendor, or other contracting party. |
| Customer Personal Data | Personal information processed by GLB on behalf of, or in connection with services provided to, a Customer. |
| Member Personal Data | Personal information relating to an Eligible Member, Member, traveler, or designated emergency contact. |
| Sensitive Crisis Data | Information submitted or generated in connection with legal crisis intake, emergency alerts, location-sharing, legal authority interactions, reimbursement documentation, or related communications. |
| Security Incident | Unauthorized access to, acquisition of, disclosure of, or use of Customer Personal Data or Member Personal Data that triggers notice obligations under applicable law or an applicable agreement. |
| Service Provider or Subprocessor | A vendor, contractor, technology provider, hosting provider, communications provider, AI provider, carrier, TPA, administrator, analytics provider, security provider, consultant, or other third party engaged to process personal information in connection with the services. |
3. Roles of the Parties
Depending on the services and applicable law, GLB may process Customer Personal Data or Member Personal Data as a service provider, processor, contractor, independent business, controller, administrator, vendor, or other role recognized by applicable law. The parties’ roles may be further defined in the applicable written agreement.
GLB will process Customer Personal Data and Member Personal Data for permitted business purposes, as described in the applicable agreement, this DPA, the Privacy Policy, the Member Terms and Conditions, a Program Summary, a Certificate, or as otherwise permitted by law. GLB may act as an independent controller or business for account administration, security, fraud prevention, legal compliance, dispute resolution, corporate records, service improvement, and other purposes permitted by law.
4. Processing Purposes
Providing and administering TravelCounsel.
Receiving, importing, validating, and managing eligibility files and member rosters.
Supporting member activation, account access, authentication, and member portals.
Supporting trip setup, active trip logic, travel alert display, CDC health notices, and consular-resource display.
Operating designated emergency contact workflows, Emergency Alert, Crisis Checkpoint, location-sharing, alert delivery, and related logs.
Receiving and processing legal crisis intake and limited member-submitted information necessary for the active workflow or reimbursement documentation support.
Providing attorney-resource information, directory links, embassy or consular resources, and member-facing resource tools.
Supporting reimbursement documentation, certificate administration, carrier or TPA review, claims-administration support, and related communications.
Coordinating with Program Sponsors, carriers, MGAs, TPAs, brokers, administrators, service providers, technology providers, and authorized users.
Managing communications by email, SMS, portal message, phone, mail, push notification, or other permitted channels.
Providing reporting, analytics, utilization data, operational insights, billing support, partner reporting, and program administration.
Maintaining security, preventing fraud, detecting misuse, protecting systems, and enforcing program terms.
Maintaining audit logs, consent records, legal records, business records, and compliance records.
Complying with legal, regulatory, contractual, tax, accounting, audit, dispute resolution, and recordkeeping obligations.
5. Types of Personal Information Processed
Name, email address, phone number, mailing address, ZIP code, member ID, sponsor identifier, benefit tier, eligibility status, and activation status.
Account login, authentication, session, and security information.
Trip destination, city or region, travel dates, lodging information, itinerary details, and active trip status.
Location information submitted or enabled through Emergency Alert, Crisis Checkpoint, crisis intake, or related features.
Emergency contact names, relationships, phone numbers, email addresses, notification preferences, and authorization records.
Alert activation records, message delivery status, escalation events, and audit logs.
Legal crisis descriptions, legal authority interaction details, incident dates, incident locations, and member submissions.
Attorney-resource search criteria, displayed resources, links clicked, and member-provided provider information.
Reimbursement documentation, receipts, invoices, proof of payment, legal provider details, benefit status, and review communications.
Uploaded documents, photos, files, forms, and other attachments.
Communication preferences, SMS and email consent records, support communications, and legal notices.
IP address, device information, browser information, user agent, operating system, usage logs, and security logs.
Other information submitted by the Customer, Member, emergency contact, administrator, carrier, TPA, vendor, service provider, or authorized user in connection with the services.
6. Customer Responsibilities
Provide lawful instructions for processing Customer Personal Data and Member Personal Data.
Obtain any required consents, notices, authorizations, permissions, or legal bases before providing personal information to GLB.
Ensure that Customer has the right to provide eligibility files, member rosters, contact information, and related data to GLB.
Limit data submissions to information reasonably necessary for the services.
Provide accurate and current eligibility information and promptly notify GLB of eligibility changes.
Maintain appropriate access controls for Customer’s authorized users.
Avoid submitting sensitive information that is not necessary for the program or not approved for the applicable channel.
Comply with applicable privacy, consumer protection, employment, student privacy, communications, insurance, marketing, data protection, and other laws.
Ensure that Customer-initiated activation, marketing, or program communications accurately describe the program and include required notices or consents.
7. Member and Emergency Contact Responsibilities
Members are responsible for providing accurate account, trip, emergency contact, intake, and reimbursement information; using the Portal only for authorized purposes; keeping credentials secure; and avoiding unnecessary sensitive submissions. Members are responsible for obtaining permission before submitting emergency contact information or third-party personal information.
Emergency contacts should use information received through the program only for the purpose of responding to the applicable alert or member request and should not disclose information except as necessary to assist the member or comply with law.
8. Confidentiality
GLB will take reasonable steps to ensure that personnel who access Customer Personal Data, Member Personal Data, or Sensitive Crisis Data are subject to confidentiality obligations or professional duties of confidentiality. Information will be accessed only by personnel, service providers, vendors, contractors, administrators, or authorized parties with a business need to know in connection with the services.
9. Security Measures
Access controls, authentication controls, and role-based permissions.
Administrative user restrictions and separation of member-facing and administrative tools.
Secure data storage and secure transmission methods where appropriate.
Private handling of uploaded documents, attachments, and reimbursement documentation.
Vendor management and workforce confidentiality controls.
Incident response procedures and security monitoring.
Logging and audit logs for administrative activity.
Data minimization and retention controls.
Reasonable safeguards for Sensitive Crisis Data, emergency contact information, and location information.
Security measures may vary depending on the nature of the services, the type of information processed, applicable law, available technology, business needs, and applicable agreements.
10. Member Portal, Admin Portal, and Access Controls
GLB may maintain member portals, admin portals, dashboards, reimbursement tools, reporting tools, and other technology. GLB will use reasonable efforts to restrict admin portal access to authorized users and to prevent members from accessing internal administrative tools, internal notes, carrier or TPA information not intended for members, partner economics, broker compensation information, or other non-member-facing information.
11. AI-Assisted and Automated Tools
GLB may use AI-assisted, automated, or rules-based tools to support intake, routing, summarization, resource display, document handling, fraud detection, quality review, analytics, and administrative workflows. Such tools are intended to support program administration and do not provide legal advice, make legal determinations, approve reimbursement, or replace required human review where applicable. GLB may use AI service providers, hosting providers, analytics providers, and other technology providers, subject to appropriate confidentiality and data protection obligations.
12. Subprocessors and Service Providers
Customer authorizes GLB to use service providers, vendors, contractors, technology providers, and other subprocessors to provide the services. Subprocessors may include hosting and cloud providers, portal and database providers, AI and automation providers, email and SMS providers, analytics providers, security providers, payment providers, carriers, MGAs, TPAs, claims or reimbursement administrators, consultants, legal resource providers, and other vendors reasonably necessary to operate the program.
GLB will use reasonable efforts to ensure subprocessors are subject to appropriate confidentiality and data protection obligations. GLB may share Member Personal Data with vendors or service providers where reasonably necessary to fulfill a member request, operate emergency tools, provide resources, send communications, process reimbursement documentation, maintain security, or administer the program.
13. Sponsor, Carrier, TPA, and Partner Reporting
GLB may process and disclose limited program information to Customers, Program Sponsors, carriers, MGAs, TPAs, brokers, administrators, or other authorized parties for reporting, billing, reimbursement-support, utilization analysis, eligibility verification, program administration, contractual purposes, legal compliance, and audit purposes. Reports may include aggregate or member-level information where reasonably necessary for the applicable agreement or benefit administration.
GLB will not intentionally display carrier economics, PMPM rates, broker compensation, partner billing details, or similar program economics to members through the member-facing portal unless expressly approved in writing.
14. Communications
GLB may use personal information to send activation, account, eligibility, emergency alert, emergency contact, reimbursement, security, legal, and program-related communications. Communications may be sent by email, SMS, portal message, push notification, phone, mail, or other permitted channels. SMS messages will be sent only where consent exists or where otherwise permitted by applicable law.
15. Assistance with Privacy Requests
To the extent required by applicable law and the applicable agreement, GLB will provide reasonable assistance to Customer in responding to privacy rights requests involving Customer Personal Data or Member Personal Data. GLB may decline or limit requests that are not legally required, not verifiable, outside the scope of the services, inconsistent with law, or in conflict with security, emergency, legal, reimbursement, audit, fraud prevention, or recordkeeping obligations.
16. Security Incidents
If GLB becomes aware of a Security Incident involving Customer Personal Data or Member Personal Data, GLB will notify Customer as required by applicable law or the applicable agreement. Notification may include available information regarding the nature of the incident, affected data, remedial measures, and steps Customer or affected individuals may need to take, to the extent known and legally permissible. Notice of a Security Incident is not an admission of fault or liability.
17. Return, Deletion, and Retention
Upon termination of the applicable agreement, GLB will return, delete, de-identify, or retain Customer Personal Data and Member Personal Data in accordance with the applicable agreement, legal obligations, recordkeeping requirements, audit requirements, tax and accounting requirements, dispute resolution needs, fraud prevention needs, operational requirements, and legitimate business purposes. GLB may retain copies where required or permitted by law, provided such information remains subject to appropriate protections.
18. De-Identified, Aggregated, and Anonymized Data
GLB may create and use de-identified, aggregated, or anonymized data for analytics, benchmarking, reporting, service improvement, utilization analysis, cost analysis, operational insights, risk analysis, program development, and business purposes, provided such data does not identify an individual except as permitted by the applicable agreement and applicable law.
19. Audits and Information Requests
To the extent required by applicable law or the applicable agreement, GLB will provide reasonable information regarding its privacy and security practices. Any audit rights, security reviews, questionnaires, or compliance assessments must be conducted in accordance with the applicable agreement and in a manner that does not compromise security, confidentiality, proprietary information, service provider information, or other customers’ information. GLB may require reasonable limits on audit scope, frequency, timing, access, confidentiality, and method.
20. International Transfers
GLB is based in the United States and primarily processes data in the United States. If Customer Personal Data or Member Personal Data is transferred internationally and applicable law requires a transfer mechanism, the parties will use an appropriate mechanism, which may include Standard Contractual Clauses, a UK addendum, or another lawful transfer mechanism where applicable.
21. No Protected Health Information Intended
The services are not intended to process protected health information (PHI) or to create a business associate relationship under HIPAA. This DPA is not a business associate agreement. Customers, members, emergency contacts, vendors, and authorized users should not submit PHI or medical information through unapproved channels. If such information is submitted inadvertently, GLB may delete, return, restrict, or otherwise handle it in accordance with applicable law, security requirements, and operational needs.
22. Sensitive Information and Data Minimization
The services may involve Sensitive Crisis Data, location information, emergency contact information, legal authority interaction details, and reimbursement documentation. Customers and users should limit submissions to information reasonably necessary for eligibility, activation, account access, trip setup, emergency workflows, crisis intake, reimbursement support, reporting, and program administration. Social Security numbers, financial account numbers, biometric information, children’s information, and unnecessary government identification should not be submitted unless required by the applicable program and approved channel.
23. Order of Precedence
If there is a conflict between this DPA and another applicable written agreement, the more specific agreement will govern for the subject matter at issue. If there is a conflict between this DPA and the Privacy Policy, Member Terms and Conditions, Website Terms of Use, Program Summary, Certificate, partner agreement, vendor agreement, carrier agreement, TPA agreement, or other written agreement, the parties will interpret the documents together to give effect to the applicable privacy, security, operational, and contractual requirements.
24. Changes to this DPA
GLB may update this DPA from time to time. When updated, the Last Updated date will be revised. If this DPA is incorporated into a written agreement, changes will apply as permitted by that agreement and applicable law.
25. Contact
Questions about this DPA may be directed to Global Legal Benefits, LLC, 539 W. Commerce St #7202
Dallas TX 75208. Email: support@travelcounsel.com.
