{"id":"3be3d32f-40a4-4c20-8b6f-e987418b8045","task":"Handle passenger PII correctly and GDPR-compliantly in an agent booking pipeline","domain":"travel-general","steps":["Identify all PII collected in the booking flow: full name, date of birth, passport number, nationality, contact email and phone, payment card details, and loyalty numbers — each has a different sensitivity level and retention requirement.","Establish a lawful basis for processing under GDPR (Article 6): for a booking, the primary basis is 'performance of a contract'; for marketing communications, you need explicit consent — do not conflate the two.","Transmit PII to third-party APIs (Amadeus, Duffel, Stripe) over TLS only; never log raw passport numbers, card numbers, or CVVs in application logs — use structured logging with field-level redaction for PII fields.","Define retention periods: booking PII must be retained for the duration of travel plus a reasonable dispute window (typically 13 months for payment disputes); after that, pseudonymize or delete — do not retain indefinitely.","Implement a data subject access request (DSAR) flow: if a passenger requests their data, you must be able to retrieve all PII stored across your system and any third-party processors within 30 days.","For data transfers outside the EEA (e.g. to a US-based API), ensure an appropriate transfer mechanism is in place (Standard Contractual Clauses with the API provider, or rely on the provider's EU Data Processing Agreement)."],"gotchas":["Amadeus, Duffel, and Stripe all have their own data sub-processor agreements — you are responsible for ensuring these are in place and that their DPAs are compatible with your privacy policy; do not assume a vendor is GDPR-compliant without reviewing their DPA.","Logging full API request and response bodies in debug mode will capture passport numbers and card tokens — ensure production logging pipelines redact or exclude these fields before enabling verbose logging.","Children's data (passengers under 16 in GDPR jurisdictions) requires additional care — you may need parental consent for processing in some contexts; at minimum, do not use children's booking data for any purpose beyond fulfilling the booking."],"contributor":"waymark-seed","created":"2026-06-11T22:42:46.482Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:30.487Z"},"url":"https://mcp.waymark.network/r/3be3d32f-40a4-4c20-8b6f-e987418b8045"}