Privacy Policy

1. Who we are and what this policy covers

Avanta Group LLC, a limited liability company organized under the laws of the State of Delaware, United States (“Avanta”, “we”, “us”) provides a workspace for travel agencies, tour operators and destination management companies, also presented as TravelOS. This policy explains how we handle personal data on our website (avantatravel.io and its blog), in the workspace, and on the storefront sites that agencies publish with Avanta.

It does not cover what an agency does with its own customers’ data. Each agency has its own privacy notice for that.

2. Our two roles

• For our own purposes we decide why and how personal data is used. This covers visitors to our website, people who ask for a demo, and the account, billing and usage data of the agencies that use the workspace and of their staff. In data protection terms we are the controller of this data.
• For agencies we handle the data they put into the workspace: their travellers, their contacts, their bookings and their conversations. The agency decides why and how that data is used, and we process it only on the agency’s instructions and under our Data Processing Addendum. In data protection terms the agency is the controller and we are its processor.

If you are a traveller or a customer of an agency, the agency is the right place to start with any question or request about your data. You can also write to us and we will pass the request to the agency and help it respond.

3. Personal data we collect for our own purposes

• Account data. The name, email address, phone number, role, language and sign-in details of each user, and the company details of the organization: legal name, address, tax identifiers and, where the travel business requires them, licence or registration numbers.
• Billing data. The plan, invoices, payment status and billing contact of the organization. Card details are collected and held by our payment processors; we receive only a reference and limited details such as the card brand and last four digits.
• Messages you send us. Demo requests, support tickets, emails and survey answers, and anything else you choose to tell us.
• Usage and device data. Log records of the pages and features used, actions taken, dates and times, IP address, browser, device and operating system, and error reports.
• Cookies and similar technologies. See our Cookie Policy.
• Data from others. Information from the services you connect to the workspace (see sections 7 and 8), and business contact details from public sources or from partners who introduce us.

4. Personal data we process for agencies

Depending on how an agency uses the workspace, the data it holds there can include:

• travellers’ names, contact details, dates of birth, nationality, gender, and passport or identity document details;
• bookings, itineraries, quotes, invoices, payments and loyalty or frequent traveller numbers;
• requests a traveller makes for a trip, which can reveal sensitive information such as dietary, accessibility or medical needs;
• messages and attachments exchanged with the agency by email, Facebook Messenger, Instagram or WhatsApp, with the sender’s name and, where the channel provides it, profile picture;
• enquiries and requests submitted through the agency’s storefront;
• notes, tasks and documents the agency’s staff add.

Agencies should enter sensitive information only where a booking needs it.

5. Why we use personal data, and on what basis

We do not make decisions about people by automated means alone that have legal or similarly significant effects on them.

6. Artificial intelligence features

Some features use artificial intelligence, for example to draft a reply, summarize a conversation or describe a tour. To produce a result we send the content needed, which can include personal data in a message or a trip, to the provider that runs the model for us. The provider processes it on our behalf. We do not use agencies’ data to train generally available models, and we do not allow our providers to do so. A person at the agency reviews the output before it is used.

7. Messaging channels and Meta platform data

When an agency connects a Facebook Page, an Instagram professional account or a WhatsApp Business number, we receive through Meta’s interfaces the identifiers and display name of that channel, an access token, and the messages, attachments, sender names and profile pictures of the conversations on it. The access token is stored encrypted.

We use this data for one purpose: so the agency’s staff can read and answer its customers from the workspace. We do not use it for advertising, we do not build profiles of people across agencies, and we do not sell it. We handle it in line with Meta’s Platform Terms and Developer Policies. An administrator can revoke the connection at any time in the workspace or in their Facebook or Instagram settings. See Data Deletion.

8. Google and Microsoft account data

When an agency connects a Gmail or Microsoft mailbox, we access that mailbox’s messages, attachments and basic profile, and send email from it, so that the agency’s staff can read and answer its customers’ email in the workspace. We use this data only to provide that feature.

Avanta’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to develop or train generalized artificial intelligence models, and no person at Avanta reads it except with the user’s permission, for security purposes, or where the law requires it.

9. Who we share personal data with

We do not sell personal data. We share it only as follows:

• Travel suppliers. To make and service a booking we send the traveller details the supplier needs to airlines, hotels, accommodation wholesalers, transfer and activity operators and global distribution systems, at the agency’s instruction. Each supplier handles that data under its own privacy policy.
• The agency’s network. Where an agency buys through a network, the organization above it can see the bookings that pass through it.
• Service providers. Companies that provide services to us under contract, listed below.
• Services the agency connects. Messaging platforms, email providers, payment processors and tax authorities’ invoicing systems, at the agency’s instruction.
• Authorities and legal process. Where the law requires it, or to establish, exercise or defend legal claims and protect the rights and safety of our users and others.
• A successor. If our business is merged, acquired or sold, the data passes to the successor under this policy.

We update this list when our providers change.

10. International transfers

We are based in the United States and our providers operate there and in other countries, so personal data is transferred to and stored in countries whose data protection laws may differ from those where you live. Where the law requires a safeguard for a transfer, we rely on the standard contractual clauses approved by the European Commission, with the United Kingdom addendum where it applies, or on another mechanism the law recognizes. You can ask us for a copy of the safeguard.

11. How long we keep personal data

• Account data for as long as the account is open.
• Data we process for an agency until the agency deletes it or closes its account. After an account is closed the agency has 30 days to ask for an export, and we then delete the data from our live systems within 90 days.
• Access tokens for connected channels until the channel is disconnected or the authorization is removed, when they are erased.
• Booking, invoice, payment and tax records for the period the applicable travel, accounting and tax laws require.
• Logs and security records for up to 12 months, unless they are needed longer to investigate an incident.
• Marketing contacts until you unsubscribe or ask us to delete them.
• Backups are overwritten on our normal backup cycle.

12. Security

We protect personal data with measures suited to its sensitivity, including encryption in transit, encryption of credentials and access tokens, separation of each organization’s data, role-based access, short-lived sessions and logging of access. No system is completely secure. If we learn of a breach affecting personal data we will notify the agencies concerned and the authorities as the law requires.

13. Your rights

Depending on where you live, you may have the right to: know whether we hold personal data about you and receive a copy; have it corrected; have it deleted; restrict or object to its use; receive it in a portable form; withdraw a consent you gave; and not be discriminated against for using these rights. To use them, write to privacy@avantatravel.io. We may ask for information to confirm who you are. We answer within the time the law sets, and in any case within 30 days unless the request is complex. See Data Deletion for deletion requests.

If your data is held by an agency in its workspace, we will pass your request to the agency, which is responsible for answering it.

European Economic Area, United Kingdom and Switzerland. You have the rights set out in the General Data Protection Regulation and its United Kingdom and Swiss equivalents, and the right to complain to the data protection authority where you live or work.

United States. Residents of California and of other states with privacy laws have the rights of access, correction, deletion and portability described above, the right to appeal a decision we make about a request, and the right to opt out of the sale of personal information and of its sharing for targeted advertising. We do not sell personal information. The advertising measurement on our website, described in our Cookie Policy, may count as sharing for targeted advertising under some of those laws; you can opt out by writing to us. We do not knowingly sell or share the personal information of anyone under 16.

Latin America. If you live in Argentina, Brazil, Chile, Colombia, Mexico, Peru or another country with a data protection law, you have the rights that law gives you, including the rights of access, rectification, cancellation or deletion, and opposition. In Argentina, the Agencia de Acceso a la Información Pública, as the supervisory authority of Law 25.326, hears complaints from anyone who believes their rights under that law have been affected. In Brazil, you have the rights set out in the Lei Geral de Proteção de Dados and may complain to the Autoridade Nacional de Proteção de Dados.

14. Children

Our website and the workspace are for businesses and are not directed to anyone under 18. Agencies may enter the details of travellers who are children, as part of a booking made by an adult. We process that data for the agency as described in section 2.

15. Changes to this policy

We update this policy when our practices change. If a change is material we tell account owners by email or in the workspace before it takes effect. The effective date at the top shows when it was last revised.

16. Contact

Avanta Group LLC, a limited liability company organized under the laws of the State of Delaware, United States. Questions about this policy or about your data: privacy@avantatravel.io.