Privacy policy

Travagon is operated by [Company legal name], a company registered in [England and Wales] under company number [company number], whose registered office is at [registered office address]. In this policy, “we”, “us” and “our” mean that company.

We are registered with the UK Information Commissioner’s Office (ICO) under registration number [ICO registration number]. For anything about your personal data, write to [privacy email] or to our registered office.

We handle personal data in two different capacities, and this policy covers the first:

• As a controller, for our own purposes: people who visit this website, the staff of agencies who hold a Travagon account, and people who contact us or whom we bill.
• As a processor, on behalf of the travel agencies that use Travagon: their customers, travellers and employees whose details the agency keeps in Travagon. The agency decides what is collected and why, and its own privacy notice applies. We only process that data on the agency’s instructions, under our data processing addendum. If you are a traveller with a question about your booking data, please contact your travel agency first; we will help them answer you.

• When you visit the website: the technical details every web request carries, such as IP address, browser type and the page requested. Our server logs leave out query strings, cookies and sign-in headers. We do not use analytics or advertising cookies (see our cookie policy).
• When you have an account: your name, work email address, role in your agency, a hash of your password (never the password itself), your two-factor authentication settings, and a log of security-relevant actions with the IP address they came from.
• When you contact us or we bill your agency: what you tell us, your contact details, and the billing contact and invoices for your agency’s subscription.

Travagon includes an optional assistant that answers questions about an agency’s records. When it is switched on, the question and the records it looks up are sent to our AI provider (listed on our sub-processors page) to produce the answer. It never sends passport details, card data or payroll. Assistant conversations are deleted after 90 days.

We do not sell personal data, and we do not share it for advertising. We use a small number of service providers to run Travagon, such as our hosting provider and email delivery provider. Each is bound by a contract that limits what they can do with the data. The current list is on our sub-processors page.

When an agency connects its own accounts with other services, such as Stripe for payments or Meta for WhatsApp, Instagram and Messenger, data passes between Travagon and that service on the agency’s instruction, under the agency’s own agreement with it.

We may also disclose data where the law requires it, or to protect the rights and safety of our users or others.

Our servers, database and file storage are in Germany, in the European Economic Area, which the UK recognises as giving adequate protection. Some of our service providers are based in, or may access data from, other countries, including the United States. Where that happens we rely on a lawful transfer mechanism, such as the UK International Data Transfer Addendum to the EU standard contractual clauses or the UK Extension to the EU-US Data Privacy Framework.

• Account details are kept while your agency has a Travagon account, and then deleted or anonymised unless we need them for the reasons below.
• Billing and accounting records are kept for as long as UK tax law requires (currently six years).
• Backups are kept for 14 days and then overwritten.
• Assistant conversations are deleted after 90 days.
• Records we hold for agencies are kept and deleted as described in the data processing addendum.

• All traffic is encrypted in transit (HTTPS).
• Passport numbers and connected-account credentials are encrypted in the database with AES-256-GCM, using a separate key for each agency. Passport numbers are shown masked, and every time one is revealed it is logged with who, when and why.
• Each agency’s data is kept separate at the database level, and staff only see what their role allows.
• Agency owners must use two-factor authentication.
• If our team ever needs to look inside an agency’s account to help, the session is time-limited and every action in it is logged.

Under UK data protection law you have the right to:

• ask for a copy of your personal data
• ask us to correct it
• ask us to delete it
• ask us to restrict how we use it
• object to our using it, including for direct marketing at any time
• ask for it in a portable format
• withdraw consent, where we rely on consent

To use any of these rights, email [privacy email]. We will reply within one month. If the data is held for a travel agency, we will pass your request to them and help them answer it.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put it right first.

Travagon is a business service for travel agencies. It is not aimed at children, and we do not knowingly collect children’s data for our own purposes.

We will update this page when our practices change, and show the date of the latest version at the top. If a change is significant, we will tell account holders by email.