Privacy Notice
How TravelBookingWidgets collects, uses, shares and protects personal data — for subscribing tour operators and their staff, visitors to our website, guests who enquire through our widgets, and suppliers. Written to describe what the platform actually does today.
1. Who we are, and the roles we play
The TravelBookingWidgets platform is operated by VHK Tech Ltd, a private limited company registered in England & Wales under company number 10522820 ("TravelBookingWidgets", "we", "us"). You can reach our privacy team at privacy@travelbookingwidgets.com.
We are a business-to-business software provider. Tour operators subscribe to our platform to manage enquiries, quotes, itineraries, documents, communications and payment initiation. We are not a tour operator, travel agent or package organiser: we do not sell, offer or confirm travel services to travellers. Trips are sold, confirmed and paid directly by the tour operator you book with.
We act in two data-protection roles:
- As a controller for our own business data — our operator accounts and billing, website leads and newsletter subscribers, support conversations, supplier outreach contacts, and our website analytics.
- As a processor for the data our operator customers store about their travellers and bookings (the operator is the controller of that data). We process it only on the operator's documented instructions.
We apply this notice alongside the UK General Data Protection Regulation and Data Protection Act 2018, and — because operators, travellers and suppliers are located in Kenya — the Kenya Data Protection Act 2019. Our registrations with the UK Information Commissioner's Office (data protection fee) and the Kenya Office of the Data Protection Commissioner are being completed; we will add the registration numbers to this notice once issued.
2. Whose data this notice covers
- Operators (subscribing tour operators) and their staff who use the platform.
- Visitors to our public website — including people who submit a booking request through an embedded widget, use our chat, or join our newsletter.
- Travellers and guests: if you are a traveller, the operator you are booking with is the controller of your data. We process it on their behalf, and this notice explains how. For anything specific to your trip or booking, contact your operator.
- Suppliers (hotels, camps, activity providers) and their contacts who provide rates or use the supplier portal.
- Operator billing contacts.
3. What we collect
- Account data: your name, work email, workspace/company name, role and seat, multi-factor authentication settings, and IP addresses and session/security logs.
- Traveller and booking data (processed on behalf of operators): travellers' names, contact details, trip details, quotes, itineraries, generated documents such as invoices and payment requests, and payment metadata.
- Website submissions: booking requests sent through embedded widgets (name, email, phone number, trip notes) — these are routed to the operator the widget belongs to so the operator can reply; chat messages and attachments sent through our website chat; newsletter subscriptions; and page-referral information (for example UTM parameters).
- Communications: where an operator connects a mailbox to the platform, we sync that mailbox's emails and attachments (including supplier rate documents) so the operator can manage correspondence in one place. We also send approved support replies over WhatsApp via the WhatsApp Business Cloud API (recipient phone number and reply text).
- Supplier data: supplier business names, contact names and emails, rate correspondence and rate documents, and supplier-portal accounts.
- Payment metadata only: amount, currency, provider tracking references, payment status and redirect URLs. We never receive card numbers or payment credentials — card checkout takes place on the payment provider's own hosted page (Pesapal), mobile-money approvals take place on the guest's own phone (M-Pesa), and funds settle directly to the operator's own merchant accounts.
- Analytics: pseudonymous, cookie-based analytics (Google Analytics 4) on our public marketing website only, loaded after you opt in via the cookie banner. We do not run analytics inside the operator app, and not inside widgets embedded on operators' own sites. See the Cookie Policy.
- Uploads: documents and rate sheets uploaded by operators or suppliers are stored in managed cloud storage buckets.
Depending on enabled features and provider configuration, AI-assisted processing may involve supplier emails, contact details and text extracted from rate documents. Configured services may include OpenRouter/TypeSafe or Cloudflare. The data sent, model providers, processing locations, retention and any training use require confirmation before publication; this draft makes no assurance about what AI does or does not do.
Attachment virus scanning is currently switched off. Guest chat attachments and supplier rate sheets are labelled "not virus-scanned". File-type and size checks are not malware scans. The former VirusTotal upload integration has been removed.
4. Why we use data, and on what basis
| Purpose | Our role | Basis (UK GDPR) |
|---|---|---|
| Providing and securing the service to operators | Controller | Contract; legitimate interests (security) |
| Storing and processing travellers' bookings, documents and communications | Processor | The operator's documented instructions — the operator determines the lawful basis (typically its contract with the traveller) |
| Responding to website enquiries, chat and demo requests | Controller | Legitimate interests / contract |
| Newsletter and marketing emails to individuals | Controller | Consent (you can withdraw at any time). For corporate subscribers we rely on the electronic-marketing rules that permit business opt-out marketing, and every marketing email has an unsubscribe link |
| Analytics on our public marketing site | Controller | Consent — off until you opt in via the cookie banner (see the Cookie Policy) |
| Supplier outreach and the supplier portal | Controller | Legitimate interests / contract with the supplier |
| Billing operators for their subscriptions | Controller | Contract; legal obligation (tax and accounting) |
| Fraud, abuse and security prevention | Controller | Legitimate interests; legal obligation |
Campaign emails support opt-out links and suppression records. Existing lead and contact records do not all contain consent evidence; collecting an email address alone does not establish consent. Newsletter confirmation and lead unsubscribe flows require review before any double opt-in or complete consent-record claim is published.
5. Who we share data with
Service providers may process data for hosting, database and authentication, email, messaging, payments, analytics and configured AI-assisted features. Browser-loaded fonts, maps, images and push services may also receive request metadata. The draft inventory at /legal/subprocessors requires owner and legal review, including provider locations and contractual roles.
For guest payments: we initiate payment requests on behalf of the operator using the operator's own credentials with its payment providers (Pesapal, and M-Pesa via Safaricom Daraja). Funds settle directly to the operator's accounts; we never hold or settle traveller funds.
A booking request submitted through a widget is shared with the operator that widget belongs to — that is the purpose of the enquiry. We also share data with professional advisers where needed, and with authorities where the law requires or permits it.
6. International transfers
We and our subprocessors process data in, and from, countries other than the UK and Kenya. Examples: our hosting provider (Vercel, a US company), our database and authentication provider (Supabase), Google Analytics (US), Meta (US) and Microsoft. Kenyan data subjects' data may also be processed outside Kenya, for example payment data with Pesapal in Kenya and communications data with Meta and Microsoft abroad. Our database, authentication and file storage are hosted by Supabase in the EU (Ireland); our application servers run on Vercel in the United States (Washington, D.C.) with a global edge network. Full details are in our subprocessor list (/legal/subprocessors).
Transfer safeguards require legal review: confirm which transfers need a UK IDTA or UK Addendum, provider agreements and transfer risk assessments, and which Kenyan cross-border requirements apply. Their execution is not verified in this draft.
7. How long we keep data
Proposed retention defaults for owner and legal review follow. They are not verified legal minimums or guarantees that deletion runs on these dates. Subscription cancellation does not automatically archive a workspace. Archive and purge tooling exists, with a 30-day archive window; automated destructive runs depend on configuration and safety gates.
- Workspace and traveller data: proposed export and recovery window of 30 days after explicit archive; deletion must be reviewed and scheduled separately from subscription cancellation.
- Financial and payment metadata: proposed default of 6 years, subject to jurisdiction, accounting requirements and disputes. Financial-record preservation during workspace deletion remains a launch blocker pending an approved database design.
- Unlinked inbox metadata: proposed 30 days; CRM-linked, booking-linked, replied and snoozed correspondence needs separate treatment. Retention execution requires verification.
- Inactive support threads and demo leads: proposed 24 months since last activity; campaign send and event logs: proposed 36 months. Existing configurable policies require deployment verification.
- Notification logs: proposed 12 months. This default is not yet enforced, including rows without a workspace identifier.
- Marketing consent and opt-out evidence: keep the minimum needed to honour preferences and evidence them; the duration and legacy records need legal review.
- Analytics, provider logs and backups: actual settings and deletion/restore windows must be confirmed with each provider before publication.
8. Your rights
Subject to applicable law, you have the right to: access a copy of your data; correct inaccurate data; have your data erased; restrict or object to processing; data portability; and withdraw consent where processing is based on consent. Data subjects in Kenya have substantially similar rights under the Kenya Data Protection Act 2019.
If you are a traveller or guest: your request should go to the operator you are booking with — it is the controller of your data. We support operators in fulfilling requests and will handle directly any request addressed to us. Today, exports and deletions are handled manually by our team (there is no self-service tool yet); we aim to respond within one month.
You can complain to the UK Information Commissioner's Office (ico.org.uk) or, for data subjects in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke). Please contact us first and we will try to resolve the issue directly.
9. How we protect data
- Encryption in transit and at rest.
- Two-step verification for operator accounts, with optional multi-factor authentication.
- Accounts are isolated from one another at the database level, so operators only see their own data.
- Mailbox connection credentials stored encrypted.
- File-type and size checks, rate limiting and monitoring; attachment virus scanning is currently off.
No system is perfectly secure. If you have a security concern, contact security@travelbookingwidgets.com.
10. Changes and how to contact us
We will post any changes to this notice on this page and update the date above. If changes materially affect how we process your personal data, we will provide a more prominent notice.
Questions, requests or complaints: email privacy@travelbookingwidgets.com. This mailbox is monitored by VHK Tech Ltd, the operator of TravelBookingWidgets.