Privacy Policy

Who this policy covers

TravelBrisk Limited ("TravelBrisk", "we", "us") provides travel-technology software to travel businesses ("Agencies"). Personal data reaches us in three ways, and our role differs for each:

• Visitors to travelbrisk.com — people who browse this site, request a demo, register or download material. We are the controller.
• Agency users — owners, staff, sub-agents and corporate travel managers who sign in to a TravelBrisk product. We are the controller for account, billing, security and support data.
• Travellers — people who search, book or pay on an Agency's storefront, portal or widget. The Agency is the controller; we are its processor and handle Traveller data only on the Agency's instructions. If you are a Traveller, the privacy notice of the Agency you booked with governs your data; this policy explains what we do on that Agency's behalf.

This policy is written under the Nigeria Data Protection Act 2023 (NDPA). Where the EU or UK GDPR applies to a customer we honour the equivalent obligations.

The data we collect

Visitors and agency users

• Identity and contact — name, business name, role, email address, phone number, country.
• Business and billing — company registration details, tax identifiers, billing address, invoice and payment history, the payment method reference returned by the payment provider (never the full card number).
• Account and usage — login records, roles and permissions, actions taken in the Platform, support conversations, preferences.
• Technical — IP address, browser and device information, pages visited, error reports, and the cookies described in the Cookie Policy.
• Supplier credentials an Agency stores in the vault, which we encrypt and use only to fulfil that Agency's requests.

Travellers (processed for the Agency)

• Names, dates of birth, gender and nationality as required for a booking.
• Passport or identity-document details where a Supplier requires them.
• Contact details, frequent-flyer or loyalty numbers, seat, meal and accessibility requirements.
• Itinerary, ticket and booking references, payment status and refund history.
• Travel-insurance applications, including the consent recorded at purchase for the insurer to issue the certificate.

We do not ask for special-category data. Where a Traveller volunteers it (for example a medical requirement for an accessibility request), it is processed only to fulfil that request.

Why we use it and on what basis

• To provide the service (performance of a contract) — create and run accounts, process bookings and payments, issue documents, send transactional messages, provide support.
• To run our business safely (legitimate interests) — secure the Platform, prevent fraud and abuse, monitor performance, improve products, keep records of what was agreed.
• To meet legal obligations — tax and accounting records, know-your-customer and sanctions checks, responses to lawful requests from authorities, aviation and travel-industry record-keeping.
• With consent — marketing emails to prospects, non-essential cookies, and any purpose we ask you about separately. You can withdraw consent at any time.

Traveller data is processed on the Agency's documented instructions, under the data-protection terms in our Terms of Service.

Who we share it with

We share personal data only as needed to provide the service, with these categories of recipient:

• Travel suppliers and distribution systems — airlines, global distribution systems, hotel and accommodation providers, travel insurers and their aggregators, to search, price, book, ticket and service a booking.
• Payment providers — card and transfer gateways and, for some subscription payments, a merchant of record, to take payment and process refunds.
• Infrastructure — cloud hosting, storage, content delivery, email and SMS delivery, error monitoring.
• Analytics — on this website only, and only where you accept performance or marketing cookies.
• Professional advisers and authorities — auditors, lawyers, regulators and law-enforcement agencies where the law requires or permits.
• A successor — if our business is sold or merged, on the same terms as this policy.

We do not sell personal data. Sub-processors handling Traveller data are bound by written contracts that impose data-protection obligations equivalent to ours. An Agency may request a current list of sub-processor categories by product from privacy@travelbrisk.com.

International transfers

Our hosting providers may store data inside or outside Nigeria, and Suppliers operate worldwide, so personal data crosses borders as part of providing the service. We transfer data only to countries the NDPA recognises as adequate or under contractual safeguards (such as standard data-protection clauses) and, for EU and UK data, under the mechanisms the GDPR requires.

How long we keep it

• Account and billing data — for the life of the account and for 7 years afterwards for tax and accounting purposes.
• Booking records — for as long as the Agency's account is active and, after that, for the period aviation, tax and consumer rules require; an Agency may export its data for 30 days after its account ends.
• Security and access logs — 12 months.
• Support conversations — 3 years.
• Marketing data — until you unsubscribe or ask us to delete it.
• Cookies — see the Cookie Policy for each cookie's lifetime.

When data is no longer needed we delete it or anonymise it so it no longer identifies anyone.

How we protect it

Data is encrypted in transit and at rest. Access inside the Platform is role-based and scoped to the Agency that owns the data; staff access to production data is limited, logged and reviewed. Supplier credentials are encrypted with keys held separately from the data. We test for common vulnerabilities and fix what we find. If we become aware of a breach that affects personal data we will notify the affected Agency (as controller) without undue delay and, where the law requires, the Nigeria Data Protection Commission within 72 hours.

No system is perfectly secure. Keep your credentials private and tell us immediately if you suspect misuse.

Your rights

Subject to the law that applies to you, you may ask us to:

• access the personal data we hold about you and receive a copy;
• correct data that is inaccurate or incomplete;
• delete data we no longer need to keep;
• restrict or object to processing based on legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent where consent is the basis, without affecting earlier processing.

Email privacy@travelbrisk.com. We will verify your identity and respond within 30 days. If you are a Traveller, we will pass your request to the Agency you booked with, because it decides how your booking data is used; we will help it respond. You also have the right to complain to the Nigeria Data Protection Commission or, if you are in the EU or UK, to your local supervisory authority.

Marketing

We send product news and offers only to people who have opted in or who are existing business customers, and every message has an unsubscribe link. We never send marketing to Travellers on an Agency's behalf without that Agency's instruction and a lawful basis it has established.

Children

This website and the Platform are for businesses and are not directed at anyone under 18. A child's details may be entered in a booking by the adult travelling with or responsible for them; that data is processed as Traveller data for the Agency.

Cookies

This website uses a small number of cookies and similar technologies. Essential ones keep the site working; performance and marketing ones load only if you accept them. The full list, what each does and how to change your choice is in the Cookie Policy.

Changes to this policy

We review this policy at least yearly and whenever our processing changes. Material changes are announced by email to account owners and posted here at least 14 days before they take effect. The effective date and version at the top of this page identify the version you are reading.

Contact and legal identity

Questions about this privacy policy go to privacy@travelbrisk.com. For anything else, support@travelbrisk.com or +234 707 776 6007.