Privacy Policy

1. Information We Collect

1.1 Personal Data You Provide

• Contact form submissions: name, email address, subject, and message content.
• Chat widget conversations: name, email address, and chat messages exchanged with our AI assistant.
• Questionnaire responses: hotel and property onboarding information, including property details, operational data, and contact information submitted through our onboarding questionnaires.
• Admin accounts: email address and password (stored as a salted hash, never in plain text).

1.2 Data Collected Automatically

• IP address: collected when you submit a contact form or interact with the chat widget.
• Usage data: pages visited, time on site, click patterns, referral sources, browser type, device type, operating system, and screen resolution, collected via Google Analytics.
• Cookies and similar technologies: see Section 6 below.

1.3 Data We Do Not Collect

We do not collect payment card information, government-issued identification numbers, health data, or biometric data through this website.

2. How We Collect Information

We collect information through the following methods:

• Contact forms: when you submit an inquiry, request a demo, or send us a message via the contact page.
• Chat widget: when you interact with our AI-powered chat assistant, your messages and provided contact details are collected and processed.
• Onboarding questionnaires: when you complete a hotel or property onboarding form to set up your account on our platform.
• Google Analytics / Google Tag Manager: we use Google Tag Manager (container ID: GTM-5FSQV7WQ) and Google Analytics 4 to automatically collect usage data and analytics.
• Cookies: first-party and third-party cookies placed on your device when you visit our website.
• Server logs: your IP address is automatically recorded when you make requests to our servers.

3. Legal Basis for Processing

We process your personal data on the following legal bases, as recognised under applicable data protection laws:

• Consent: when you voluntarily submit a contact form, use the chat widget, or complete a questionnaire.
• Contractual necessity: to provide our services, create your account, and fulfil our obligations to you as a customer.
• Legitimate interests: to improve our website and services, prevent fraud, ensure security, and conduct analytics — where those interests do not override your rights.
• Legal obligation: where we are required to process data to comply with applicable laws and regulations.

4. How We Use Your Data

We use the information we collect for the following purposes:

• Responding to your inquiries and contact form submissions.
• Powering the AI chat assistant to provide helpful responses to your questions about our products and services.
• Processing hotel and property onboarding questionnaires to set up your account on our platform.
• Sending transactional emails (e.g., form submission confirmations) via our email service.
• Analysing website usage and traffic patterns to improve our website, user experience, and service offerings.
• Maintaining the security and integrity of our website and services.
• Complying with legal obligations and enforcing our Terms of Service.

5. Data Sharing & Third Parties

We do not sell your personal data. We share data with the following third-party service providers only as necessary to operate our services:

5.1 Google Analytics (Google LLC)

We use Google Analytics 4 via Google Tag Manager to collect anonymised usage data, including pages visited, session duration, device information, and geographic region. Google may process this data on servers located outside your jurisdiction. Google's privacy policy is available at policies.google.com/privacy.

5.2 OpenAI (OpenAI, L.L.C.)

Our chat widget is powered by OpenAI's GPT-4o-mini model. When you use the chat, your messages (and any personal information you include in them) are sent to OpenAI's API for processing. We do not send your email or name to OpenAI unless you include them in your chat messages. OpenAI's data usage policies are available at openai.com/policies/privacy-policy.

5.3 Email Service (SMTP)

We use Nodemailer with an SMTP provider to send transactional emails. When you submit a contact form, your name, email, and message content are transmitted via our email service to deliver notifications to our team.

5.4 Other Disclosures

We may disclose your personal data if required by law, court order, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of Travona, our users, or the public.

6. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies:

6.1 Essential Cookies

Required for the website to function properly. These include session cookies for admin authentication and any cookies necessary for security. These cannot be disabled.

6.2 Analytics Cookies

Google Analytics and Google Tag Manager set cookies (e.g., _ga, _ga_*) to distinguish unique users and sessions. These cookies help us understand how visitors interact with our website.

6.3 Managing Cookies

You can control or delete cookies through your browser settings. Please note that disabling cookies may affect the functionality of certain features on our website. Most browsers allow you to refuse cookies or alert you when cookies are being sent.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy:

• Contact form submissions: retained for up to 24 months from the date of submission, then deleted.
• Chat conversations: retained for up to 12 months, then deleted.
• Questionnaire responses: retained for the duration of the business relationship, plus 12 months following termination.
• Admin accounts: retained for the duration of the account's active use, plus 12 months following deactivation.
• Analytics data: Google Analytics data retention is set to 14 months. Aggregated, non-identifiable data may be retained indefinitely.
• Server logs: IP addresses in server logs are retained for up to 90 days.

8. Your Rights

Under applicable data protection laws, you may have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you, including the categories, sources, purposes, and third parties with whom it is shared.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data, subject to legal retention requirements.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Right to restrict processing: request that we limit how we process your data in certain circumstances.
• Right to object: object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to opt out of sale of personal data: we do not sell or share your personal information for cross-context behavioural advertising. If this ever changes, we will provide a clear opt-out mechanism.
• Right to non-discrimination: we will not discriminate against you for exercising any of your data protection rights, including by denying services, charging different prices, or providing a different level of quality.
• Right to lodge a complaint: if you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction or to seek legal remedies under applicable law.

To exercise any of these rights, please contact us at info@travona.travel. We will respond within 30 days of receiving your request, or within the timeframe required by applicable law.

9. Email Communications

We may send you transactional emails related to your use of our services (e.g., form submission confirmations, account notifications). If we send commercial or promotional emails, we will:

• Clearly identify the message as a commercial communication.
• Include our contact information and a clear subject line.
• Provide a straightforward unsubscribe mechanism in every message.
• Honour opt-out requests promptly, within 10 business days at most.

You can manage your email preferences or unsubscribe at any time by using the unsubscribe link included in our emails or by contacting us directly at info@travona.travel.

10. Data Storage & International Transfers

In-country data storage: Where we have arrangements with local data centre providers, your data is stored within the jurisdiction where your property operates. We prioritise in-country hosting to comply with local data protection regulations and to minimise cross-border data transfers.

Third-party services: Certain third-party services we use (such as analytics and AI-powered features) may process data in jurisdictions outside your country of residence. Where such transfers are necessary, we ensure appropriate safeguards are in place, including contractual data protection clauses with our service providers.

We will only transfer personal data to jurisdictions that provide an adequate level of data protection or where we have implemented appropriate safeguards in compliance with applicable data transfer regulations. You may contact us to learn more about the specific safeguards applied to your data.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• HTTPS/TLS encryption for all data transmitted between your browser and our servers.
• Passwords stored using industry-standard salted hashing algorithms (never in plain text).
• Access controls limiting who can view and manage personal data.
• Regular review of our data collection, storage, and processing practices.
• Use of secure, authenticated SMTP connections for email transmission.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

12. Children's Privacy

Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete that information as promptly as possible. If you believe we have collected information from a child under 16, please contact us immediately at info@travona.travel.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or a prominent notice on our website. We encourage you to review this policy periodically to stay informed about how we protect your data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: