Privacy Policy

This Privacy Policy explains how **TripGate OÜ** ("**TripGate**", "**we**", "**us**", "**our**"), the Estonian company (registry code 17046147, VAT EE102857290, registered address Harju maakond, Tallinn, Kesklinna linnaosa, Pille tn 7/5-13, 10138) that owns and operates the **Traviology** travel commerce platform ("**Traviology**", the "**Platform**"), collects, uses, shares, and protects personal data when you visit traviology.com, use a Traviology-powered white-label storefront, or otherwise interact with the Platform. "Traviology" is a product brand of TripGate OÜ and is not itself a separate legal entity; TripGate OÜ is the data controller described in this policy unless stated otherwise for a specific white-label organization.

Who is the data controller

TripGate OÜ is the data controller for account, booking, and platform-usage data processed through traviology.com and the core Platform infrastructure. If you booked through a white-label storefront operated by one of our business clients (a travel agency or tour operator using Traviology under its own brand), that client is generally the data controller for your booking relationship with them, and TripGate OÜ acts as their data processor for the underlying technical infrastructure. Contact details for the specific storefront operator are shown on its site; contact details for TripGate OÜ are at the end of this policy.

What personal data we collect

- **Account data** — name, email address, password (hashed), phone number, and organization/role information when you create or are granted access to an account.

- **Booking and travel data** — traveler names, passport/ID details where required by a supplier, dates of travel, itinerary details, and special requests you submit when searching or booking flights, hotels, transfers, tours, or packages.

- **Payment data** — card top-up and transaction records processed through our payment provider (Stripe); we do not store full card numbers ourselves.

- **Technical and usage data** — IP address, browser and device type, pages visited, and session/log data, collected automatically to operate, secure, and improve the Platform.

- **Communications** — messages you send us through contact forms, support chat, or email, and records of related correspondence.

- **Cookies and similar technologies** — as described below.

How we use your data and our legal bases

We process personal data to: provide search, quoting, booking, and wallet/payment functionality (performance of a contract); operate account authentication and security, prevent fraud, and maintain service integrity (legitimate interest); send booking confirmations, service notices, and — where you have consented — marketing communications (consent, or legitimate interest for existing customers); and comply with tax, accounting, and legal obligations (legal obligation). We do not sell personal information to third parties.

Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to operate booking sessions, and, where you consent, analytics and marketing cookies to understand usage and improve the Platform. You can control non-essential cookies through the cookie banner shown on first visit and through your browser settings.

Google Sign-In

When you choose **Sign in with Google**, we receive basic profile information from Google (such as your name and email address) through Google Identity Services on our website. We use this only to create and secure your Traviology account and to sign you in — we do not use Google user data for advertising, and we do not sell it. You can review or revoke Traviology's access at any time from your Google Account permissions page.

Sharing your data

We share personal data only as needed to operate the Platform: with travel suppliers (airlines, hotels, transfer and tour operators) strictly to create, confirm, or service a booking you request; with infrastructure and service providers who process data on our behalf under contractual safeguards, including Supabase (database and authentication), Stripe (payment processing), Cloudflare (hosting, CDN, and security), and Google (Maps and Sign-In services); and where required to comply with law, enforce our terms, or protect the rights, safety, or property of TripGate OÜ, our clients, or users. We do not share personal data for third-party advertising purposes.

International data transfers

Our infrastructure providers may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards recognized under GDPR, such as Standard Contractual Clauses or an adequacy decision, to protect transferred personal data.

Data retention

We retain account and booking data for as long as your account is active and for the period required to meet our tax, accounting, and legal obligations after account closure or a completed booking, after which data is deleted or anonymized. Support correspondence is retained only as long as reasonably needed to resolve your query and for our records.

Your rights

Subject to applicable law, you have the right to request access to, correction of, deletion of, or a copy (portability) of your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority. To exercise these rights, contact us using the details below.

Children's privacy

The Platform is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

Security

We use industry-standard technical and organizational measures — including encryption in transit, access controls, and audited infrastructure providers — to protect personal data against unauthorized access, loss, or misuse. No system is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version here with a new "Last updated" date; material changes will be highlighted on the Platform.

Contact us

**TripGate OÜ** — Harju maakond, Tallinn, Kesklinna linnaosa, Pille tn 7/5-13, 10138, Republic of Estonia

Privacy and data protection requests: legal@traviology.com

General support: support@traviology.com

Last updated: 1970.