This is a template, not our notice, and not legal advice.

An agency using ONE Travel OS is the one who holds its households’ personal information and the one who owes them a notice about it. This is a starting point drafted against what ONE Travel OS actually does, so an agency is not writing from a blank page. It describes the software’s default behavior; it does not know your agency’s practices.

Read it, change what is wrong, delete what you do not do, and have a lawyer look at it before you publish. Anything in [SQUARE BRACKETS] is a blank for you to fill.

Notice has to be given at or before collection. Publish it before you start collecting, not when somebody first asks.

---

Privacy notice

[AGENCY NAME] (“we”, “us”) arranges travel for you. This notice explains what we hold about you and the people you travel with, why, how long, and what you can ask us for.

Last updated [DATE].

What we collect

About you

Your name, email address, phone number and postal address. Notes our advisors keep about your preferences and your trips. Which of our advisors looks after you.

About the people you travel with

To book and to get you through an airport or a border, we hold, for each traveler: their name and preferred name, date of birth, contact details, and passport number, issuing country and expiry date. Where they apply, a known traveler number or redress number, and loyalty program numbers.

We also hold what we need to make a trip work: an emergency contact, dietary requirements, and accessibility needs. Some of that can say something about health or belief, and we treat it as more sensitive than the rest: we collect it only where it is needed for a trip, and we pass it to a supplier only where the trip requires it.

Passport numbers, dates of birth, known traveler and redress numbers and loyalty membership numbers are encrypted where we store them.

About your trips and payments

What was quoted, booked and paid; suppliers, dates and confirmation numbers; amounts owed and received; and any travel credits held for you.

Do not email us card details. If you do, our system removes the number before the message is stored; we keep the brand and last four digits so we can tell one card from another, and nothing more of the number. When your advisor needs a card to pay a supplier for your trip, they will send you the supplier’s card authorization form instead. We do not keep cards on file, in any form.

When you approve a card for a booking, we record that approval: when you gave it, the wording you agreed to, and the network address and browser you gave it from. We keep that so we can show a supplier or a bank that the charge was authorized. We also record every time one of our staff displays your card, and which member of staff it was. Where you give a card to an advisor over the phone instead of typing it yourself, the address and browser recorded are theirs, and the record says so.

Your correspondence with us

When you email your advisor, that message is stored in our system and attached to your file, so that whoever picks up your trip can see what has already been discussed. This includes messages you send us and messages we send you.

We do not keep email attachments. Anything you attach to an email is discarded; we keep the message and a note of what was attached. To send us a passport, ID or any other document, use the secure form your advisor will send you, so it reaches your file instead of being thrown away.

Documents you send us

Passport scans, visas, insurance certificates and anything else you upload through a secure form. These are stored against your record and are downloadable only by our staff, through links that expire after five minutes.

A passport read instead of typed. Where we have it switched on, we can have the details on a passport scan you gave us read by an outside service instead of typing them in. That happens only after the traveler has agreed to it, and we record which of us confirmed it and when. One of us checks what was read before any of it is saved. Saying no costs you nothing: we type the details in, as we always have.

You can also ask for it yourself. Where it is switched on, each scan you upload in your portal has a button to fill in the passport details from it, and the page says the scan goes to an outside service to be read before you press it. You see what was read, and only what you tick is saved; we then check it against the scan. The portal shows what was read for an hour and never again, and once you have saved it, it shows only that you did and when. If you leave without saving, what was read comes to us to finish instead. Not pressing it costs you nothing either.

Confirmations you forward to your trip’s own address. Where we have document parsing switched on, each of your trips has an email address of its own, shown in your portal. Forward a flight or hotel confirmation to it and we read the dates and times straight out of it instead of re-typing them.

That address is the one place where something of yours goes to an outside company because you sent it, so we would rather over-explain it:

• Sending it is how you agree to it. Nothing is taken from your mailbox and nothing goes anywhere unless you forward it. The address is only ever shown in your portal, directly beneath a short explanation of where a document sent to it goes and a link to the full account, so the facts are in front of you before you use it, which is the point.
• We read the confirmation, attached or not. If you attach it, we read the attachment and not your email. If you forward the booking email with nothing attached, we read and keep the email’s text under the same rules as an attachment. We also read any note you type above a forwarded booking, so send notes for your advisor in a separate email.
• You can choose not to use it. Send the confirmation to your advisor the way you always have and they will enter what they need. Nothing about your trip depends on using the address, and asking us to stop is enough.
• If it ever goes astray, tell us and we will reset it. The old address stops working immediately.

Why we collect it

To arrange and service your travel: to book it, to hold the details a supplier or a border needs, to bill you, to keep track of what is owed, and to keep a complete record of your trip in one place: what was booked, what was agreed, and what was said.

We also use it to run our own business: our accounts, our tax obligations, and paying the advisor who looked after you.

It is not sold. We do not use it for third-party advertising. It is not shared with anyone for their own purposes, with one exception we would rather write down than leave you to discover: where we have document parsing switched on, booking confirmations are sent to an outside service to be read, and the service that reads them may be one whose own terms let it use what we send to train and improve itself. Only those documents go, and nothing else about you. Each one goes because a person sent it, either one of us or you. Ask us whether it is switched on.

We do market our own trips and offers, but only to people who have asked us to. You can turn that on or off whenever you like, and it is never a condition of booking. Where you have given us permission, that may include using a photograph or a few words about your trip in our own marketing, and you can withdraw that permission at any time.

If you do not market to your households at all, delete the paragraph above rather than keeping it; a notice that describes something you do not do is the same problem in reverse.

Who can see it

Your advisor, and the staff who administer bookings and payments. Correspondence is visible to administrators once it has been filed against your record; it is not browsed, and it is not read for any purpose other than serving you and running the agency.

Suppliers (airlines, hotels, cruise lines, tour operators, insurers) get what they need to hold your booking, and no more. What they then do with it is governed by their own privacy notices.

Our software runs on services provided by other companies (hosting and file storage), which are contractually barred from using anything they hold for their own purposes.

Where maps are switched on for us, the map on your itinerary and the pictures of the places on it are loaded from a mapping provider while you are looking at the page, so that provider sees your device’s network address and the places the map is showing. It is not told your name, your contact details or your booking. It is not under that same undertaking either: it decides its own purposes for what it receives, and our data processing addendum says so in terms.

Where trip photos are switched on for us, the photograph of where your trip is going is loaded from a photo library, Unsplash, while you are looking at the page, so Unsplash sees your device’s network address. To find the photograph we send Unsplash the name of your destination, and nothing else: not your name, your contact details, your dates or your booking. Unsplash is not under that same undertaking either, and our data processing addendum says so too.

Where document parsing is switched on for us, two document-reading services also receive the booking confirmations and supplier statements we hand them and, where the traveler agreed to it or asked for it in the portal, a traveler’s passport, and nothing else. One is under that undertaking, and its terms bar it from training on what it reads; it reads supplier statements and passports, and may read booking confirmations. The other is not: its own terms let it use what we send it to train and improve itself, and it does not offer us an agreement barring that. It never reads supplier statements or passports, but it may read booking confirmations. We would rather write that down than let you assume otherwise. A document reaches it only because one of us uploaded it or because you forwarded it yourself; nothing is swept up automatically. Ask us and we will tell you whether it is switched on.

We will also disclose information where the law requires it.

How long we keep it

The bracketed numbers are the software’s defaults and each agency sets its own; put in the ones you use.

Anything may be kept longer in the specific case of an unresolved dispute or a legal requirement, and only for as long as that lasts.

Your rights

You can ask us to:

• Tell you what we hold about you and where it came from.
• Give you a copy of it.
• Correct anything wrong.
• Delete it.

You will not be treated differently for asking. No worse service, no different price.

Three honest limits

We cannot delete what we are required to keep. Booking and payment records sit behind our tax filing. When you ask us to delete, we erase your personal details and keep the financial rows, so the totals still add up but no longer describe a person.

We cannot change what someone wrote. An email is a record of what was said. We can correct our own records, and where a message is filed; we cannot edit its contents.

Some messages involve other people. If a message concerns you and also a supplier or another traveler, deleting it outright would destroy their record too. In that case we remove your details from it and keep the rest. If you ask for a copy of what we hold, we give you the messages you were part of, not other people’s correspondence that happens to mention you.

How to ask

Write to [PRIVACY CONTACT EMAIL]. Tell us what you want and enough for us to find you. We will answer within [45] days and tell you if we need longer.

Somebody may ask on your behalf if they have your written authority. If we turn a request down we will say why, and you can appeal by replying to us.

If you are not our household

You may appear in our records because you emailed one of our advisors, or because somebody mentioned you, without ever being our household. You have the same rights as anyone else, and you can exercise them by writing to [PRIVACY CONTACT EMAIL].

We will not always know we hold information about you until you tell us, because we do not index correspondence by everyone named inside it. If you contact us from an email address that appears in our records, we can find it and act on it.

Children

We hold a child’s details only as a traveler on a booking made by their parent or guardian, and only what the trip needs. Requests about a child’s information should come from the parent or guardian who made the booking.

Changes to this notice

We will change this notice as what we do changes. The date at the top says when it last changed, and we keep previous versions. If you need to know what you were told at the time, ask.

If we ever want to use your information for something not described here, we will ask you first.

Contact

[AGENCY NAME] [POSTAL ADDRESS] [PRIVACY CONTACT EMAIL] [PHONE]