1. Data Controller
TravelBook is operated by Poro-IT OU, registered in Tallinn, Estonia (EU). As the data controller under the EU General Data Protection Regulation (GDPR), we are responsible for your personal data. Our Data Protection contact: hello@travelbook.ee.
2. Information We Collect
We collect the following categories of personal data:
- Account data: Name, email address, hashed password, role (customer/business)
- Booking data: Reservation dates, guest count, accommodation/experience details, total price, booking status
- Payment data: Payment method, transaction ID, amount, currency. We do not store full card numbers — payments are processed by third-party providers (Revolut, MobilePay)
- Referral data: If you arrive via a hotel referral code: your name, email, check-in/check-out dates, source platform (e.g. Booking.com)
- Search history: Location searches, date filters, category preferences (used to improve recommendations)
- Device/usage data: Pages visited, browser type, IP address, device type — collected via Google Analytics only with your explicit consent
- Business partner data: Business name, address, bank details, commission rates, channel webhook configurations
- Push notification tokens: If you enable notifications, we store your device push subscription endpoint
3. Legal Basis for Processing
- Contract performance (Art. 6(1)(b)): Processing bookings, payments, and account management
- Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, service improvement
- Consent (Art. 6(1)(a)): Analytics cookies, marketing emails, push notifications — you can withdraw consent at any time
- Legal obligation (Art. 6(1)(c)): Tax record retention, anti-money laundering compliance
4. How We Use Your Data
Your data is used to: process and confirm bookings, send referral experience emails, process payments and commission disbursements, provide customer support, improve platform functionality, send service-critical communications (booking confirmations, cancellations), and comply with legal obligations. We never sell your personal data to third parties.
5. Cookies & Consent
We use two categories of cookies:
- Necessary (always active): Authentication session, CSRF protection, cookie consent preferences, tenant context. These are essential for the site to function.
- Analytics (requires consent): Google Analytics via Google Tag Manager, with Google Consent Mode v2. Only activated after you click “Accept” in the cookie banner. You can change your preference at any time.
We implement Google Consent Mode v2 — analytics storage is denied by default and only granted after explicit user consent.
6. Data Retention
We retain data for the minimum period required by law and business necessity:
| Data Type | Retention Period | Legal Basis |
|---|
| Account data | Until deletion request | GDPR Art. 17 |
| Booking records | 2 years after trip | EU Package Travel Directive 2015/2302 |
| Payment records | 5 years | EU Payment Services Directive (PSD2) |
| Invoice/tax records | 7 years | Estonian Tax Law (Accounting Act) |
| Search history | Until deletion request | Legitimate interest / consent |
| Analytics data | 14 months | Google Analytics default retention |
| Push subscriptions | Until unsubscribe or deletion | Consent |
7. Your Rights (GDPR)
Under GDPR, you have the following rights:
- Right of access (Art. 15): Request a copy of all personal data we hold about you. Use the “Export My Data” feature in your account settings or contact us.
- Right to rectification (Art. 16): Correct inaccurate personal data via your profile settings or by contacting us.
- Right to erasure (Art. 17): Request deletion of your account and personal data. We will anonymize your personal information (name, email, password) while retaining anonymized booking/payment records as required by law. Use the “Delete My Account” feature or contact us.
- Right to restrict processing (Art. 18): Request that we limit how we use your data while a dispute is resolved.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable JSON format.
- Right to object (Art. 21): Object to processing based on legitimate interest.
- Right to withdraw consent: Withdraw analytics/marketing consent at any time via the cookie banner or account settings.
To exercise any of these rights, contact us at hello@travelbook.ee. We respond within 30 days as required by GDPR.
8. Data Erasure Process
When you request account deletion:
- Immediately deleted: Search history, push notification subscriptions, referral email/name data
- Immediately anonymized: Your name and email are replaced with anonymous identifiers (e.g. “Deleted User a1b2c3d4”). Your password and 2FA secrets are wiped.
- Retained in anonymized form: Booking records (2 years), payment records (5 years), and tax/invoice records (7 years) are kept with your anonymized user ID — no personal information is attached. This is required by EU Package Travel Directive, PSD2, and Estonian tax law.
After the legal retention periods expire, all remaining records are permanently deleted.
9. Travel Industry Compliance
As a travel booking platform operating in the EU, we comply with:
- EU Package Travel Directive 2015/2302: Booking record retention, traveler protection, information obligations
- EU Payment Services Directive (PSD2): Strong customer authentication, payment record retention
- Estonian Accounting Act: 7-year retention for financial records
- EU Consumer Rights Directive 2011/83: 14-day withdrawal right for online bookings (where applicable)
- GDPR (Regulation 2016/679): Full data protection compliance including consent management, data minimization, and breach notification
10. Third-Party Processors
- Nile (database): Multi-tenant database hosting (EU region)
- Vercel: Application hosting and CDN
- Google Analytics: Website analytics (with consent only)
- Payment providers: Revolut, MobilePay — process payments under their own data processing agreements
- Google Cloud Storage: Monthly business reports (encrypted, access-controlled)
All processors are contractually bound to GDPR compliance. Data processing agreements are in place with each provider.
11. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) within 72 hours and affected individuals without undue delay, as required by GDPR Articles 33 and 34.
12. Contact & Complaints
Data Controller: Poro-IT OU, Tallinn, Estonia
Email: hello@travelbook.ee
If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at info@aki.ee or any EU supervisory authority.
