Privacy Policy

iTravel provides branded B2B travel portals to travel businesses. This policy explains how we handle personal data across our platform, for tenant staff, sub-agent users, and travellers whose details are entered into bookings.

Account data (name, email, phone, language, timezone); business data (company details, products, prices, bookings); traveller data entered by agents (lead guest name and contact details as required by suppliers); wallet and billing records; technical logs required for security and reliability.

To operate the portals and process bookings (performance of contract); to bill subscriptions and service charges; to secure the platform, prevent fraud and meet legal obligations; and, for tenant administrators, to send service and lifecycle communications, which can be opted out of where not essential.

Booking data is shared with the relevant travel supplier to fulfil the booking. We use infrastructure and email delivery sub-processors bound by data protection agreements. We do not sell personal data.

Each tenant's data is logically isolated with enforced tenant scoping at every layer, encrypted transport, hashed credentials, two-factor authentication for platform staff, and audit trails on money movements.

We process personal data in accordance with India's Digital Personal Data Protection Act, 2023 and, for individuals in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR/UK GDPR). Our legal bases under the GDPR are: performance of contract (operating portals and processing bookings), legitimate interests (platform security, fraud prevention, service communications), legal obligation (tax, accounting, anti-money-laundering) and consent where specifically requested.

Data is processed in India and Singapore, and by hosting and email sub-processors in other jurisdictions. Where personal data of EEA/UK individuals is transferred outside those regions, we rely on appropriate safeguards including standard contractual clauses with our sub-processors.

Booking and financial records are retained for a minimum of 8 years as required by applicable tax law. Analytics data is aggregated after 26 months. Upon account termination, tenant data is available for export for a defined window and then deleted or irreversibly anonymised, save where retention is legally required.

Subject to applicable law, individuals may request access, correction, erasure, restriction of processing, portability, and may object to processing based on legitimate interests, or withdraw consent. EEA/UK individuals may additionally lodge a complaint with their supervisory authority; individuals in India may complain to the Data Protection Board of India. Where we act as processor for a tenant's traveller data, we will refer requests to the tenant as controller.

Privacy questions and rights requests: admin@itravel.cloud (Grievance Officer, TDMC Global Travel Rep LLP). Phone: +91 78380 07208 (India) · +65 8034 8190 (Singapore).