Privacy Policy

1. Introduction

AdvaTrav ("AdvaTrav," "we," "us," or "our") is a global travel discovery and booking platform that enables users to search and compare hotels, resorts, villas, apartments, hostels, vacation rentals, travel experiences, tours, and activities. We also provide destination guides, travel blogs, AI-powered travel recommendations, and visa information tools.

We are committed to protecting your privacy and the confidentiality of your personal information. This Privacy Policy explains what information we collect, how we use it, the choices you have, and the safeguards we have put in place to protect your data.

This Privacy Policy applies to the AdvaTrav website (https://advatrav.com), our mobile applications for iOS and Android, and all related services (collectively, the "Services"). By creating an account, browsing, or booking through AdvaTrav, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect information that you provide directly to us, information collected automatically when you use our Services, and information from third parties.

2.1 Information You Provide

• •Account information: When you create an AdvaTrav account, we collect your full name, email address, phone number, and a password. You may also add a profile photo and a short biography.
• •Profile and travel preferences: Preferred destinations, travel dates, budget ranges, accommodation types, dietary requirements, accessibility needs, and language preferences.
• •Booking information: Check-in and check-out dates, number of guests, property or experience selections, special requests, and booking modifications.
• •Payment-related information: AdvaTrav does not store full credit card numbers or banking credentials. Payment information is processed by our certified payment processors (e.g., Stripe, PayPal, M-Pesa, Airtel Money, and partner banks). We may retain the last four digits of your card, card brand, and billing name for transaction records and receipts.
• •Identity verification information: To comply with KYC (Know Your Customer) requirements, hosts and merchants may be asked to provide government-issued identification, business registration documents, address proof, and a selfie for facial matching. Guests may be asked to verify their identity before certain bookings.
• •User-generated content: Reviews, ratings, comments, photos, and other content you post on AdvaTrav.
• •Customer service interactions: Records of communications with our support team, including chat transcripts, email exchanges, and call recordings where applicable.
• •Newsletter subscriptions: Your email address and communication preferences when you opt in to receive promotional materials.

2.2 Information Collected Automatically

• •Device and browser information: Device type, operating system, browser version, screen resolution, language settings, and unique device identifiers.
• •IP address: Your Internet Protocol address, used for security, fraud prevention, and approximate geolocation.
• •Location information: With your consent, precise or approximate location data from your device's GPS to provide relevant search results and local recommendations. You can disable location access at any time through your device settings.
• •Usage data: Pages visited, search queries, clicks, scroll depth, session duration, booking funnel interactions, and features used.
• •Cookies and tracking technologies: See Section 7 for details on how we use cookies and similar technologies.

2.3 Information from Third Parties

We may receive information from third-party travel suppliers, social media platforms (when you sign in with or link a social account), advertising partners, and analytics providers. This data is used to enhance your experience and improve our Services.

3. How We Use Information

We use the information we collect for the following purposes:

• •Account management: To create, verify, and manage your AdvaTrav account, process login authentication (including passkeys and biometric login), and maintain profile information.
• •Booking facilitation: To process search requests, display availability, confirm reservations, coordinate with hosts and travel suppliers, and manage booking modifications and cancellations.
• •Customer support: To respond to your inquiries, resolve disputes, and provide assistance before, during, and after your trip.
• •Fraud prevention: To detect and prevent fraudulent transactions, fake accounts, suspicious booking patterns, payment abuse, and platform manipulation.
• •Security monitoring: To monitor for unauthorized access, suspicious activity, security incidents, and potential threats to platform integrity.
• •Personalization: To tailor search results, accommodation recommendations, and travel suggestions based on your past bookings, saved favorites, and stated preferences.
• •Recommendation engines: To power AI-driven travel recommendations, destination suggestions, and experience matching using machine learning models.
• •Marketing communications: To send newsletters, promotional offers, travel deals, and relevant updates, where you have opted in or where permitted by applicable law. You can unsubscribe at any time.
• •Legal and regulatory compliance: To fulfill obligations under tax laws, anti-money laundering (AML) regulations, KYC requirements, data protection laws, and responses to lawful requests from authorities.
• •Analytics and service improvement: To analyze user behavior, measure feature performance, conduct A/B testing, identify bugs, and improve the usability, speed, and reliability of our platform.
• •Community trust and safety: To verify user identities, enforce our community standards, and maintain a safe and trustworthy marketplace for all users.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we process personal information under the following legal bases as defined by the General Data Protection Regulation (GDPR) and the UK GDPR:

• •Contract performance: Processing necessary to provide the Services you have requested, including account creation, booking processing, and payment facilitation (Article 6(1)(b)).
• •Consent: Processing based on your explicit consent, such as for marketing communications, location tracking, and non-essential cookies (Article 6(1)(a)). You may withdraw consent at any time.
• •Legitimate interests: Processing necessary for our legitimate business interests, such as fraud prevention, security monitoring, service analytics, and platform improvement, provided these interests are not overridden by your rights (Article 6(1)(f)).
• •Legal obligations: Processing required to comply with applicable laws, including tax record retention, AML/KYC regulations, and responses to lawful government requests (Article 6(1)(c)).
• •Protection of vital interests: Processing necessary to protect the vital interests of you or another person, such as in emergency situations (Article 6(1)(d)).
• •Protection against fraud and abuse: Processing for the prevention, detection, and investigation of fraud, money laundering, and other illegal activities, based on our legitimate interests and legal obligations.

Where we rely on consent, you have the right to withdraw consent at any time by contacting us at privacy@advatrav.com or through your account settings. Withdrawing consent will not affect the lawfulness of processing conducted before the withdrawal.

5. Sharing of Information

We may share your personal information with the following categories of recipients:

5.1 Travel Suppliers

• •Hotels and property hosts: Booking details (guest name, check-in/out dates, number of guests, special requests) necessary to fulfill your reservation.
• •Tour operators and activity providers: Participant information, booking references, and any health or accessibility requirements relevant to the experience.
• •Vacation rental managers: Guest contact information and booking terms for direct coordination.

5.2 Service Providers

• •Payment processors: Stripe, PayPal, M-Pesa, Airtel Money, and partner banks process payment transactions. These processors operate under their own privacy policies and are certified under PCI DSS.
• •Cloud service providers: Hosting, storage, and computing infrastructure providers that support our platform operations.
• •Analytics providers: Providers of web analytics, crash reporting, and performance monitoring tools.
• •Customer support vendors: Third-party helpdesk, live chat, and communication tools used to deliver support services.
• •Identity verification providers: KYC, document verification, and facial recognition services used for host and guest verification.

5.3 Legal and Regulatory

• •Regulatory authorities: When required by law, court order, or regulatory obligation.
• •Law enforcement: When legally required or in response to a valid law enforcement request, subpoena, or government inquiry.
• •Legal proceedings: In connection with legal claims, disputes, or investigations where disclosure is necessary to establish, exercise, or defend our legal rights.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of AdvaTrav's assets, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website of any such change.

AdvaTrav does not sell personal information.

We do not, and will not, sell your personal data to any third party for monetary or other valuable consideration. We do not share your personal information for cross-context behavioral advertising in a manner that constitutes a "sale" or "share" under the California Consumer Privacy Act (CCPA/CPRA).

6. International Data Transfers

AdvaTrav operates globally. Your personal information may be processed, stored, and transferred across international borders to countries that may have different data protection laws than your country of residence.

6.1 Transfer Safeguards

When transferring personal data from the European Economic Area, the United Kingdom, or Switzerland to countries that have not been recognized as providing an "adequate" level of data protection, we rely on:

• •Standard Contractual Clauses (SCCs): The European Commission's approved Standard Contractual Clauses for the transfer of personal data to third countries.
• •UK International Data Transfer Addendum: Where applicable, the UK addendum to the SCCs.
• •Binding Corporate Rules (BCRs): Where applicable to our corporate group entities.
• •Adequacy decisions: Transfers to countries recognized by the European Commission, UK Government, or Swiss Federal Council as providing adequate data protection.

6.2 Cross-Border Commitments

We ensure that all international transfers are subject to appropriate safeguards and that recipients are bound by contractual obligations to protect your personal information in accordance with this Privacy Policy and applicable data protection laws. We regularly review our transfer mechanisms to ensure ongoing compliance with evolving regulatory requirements.

7. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to operate, secure, and improve our Services.

7.1 Types of Cookies

• •Essential cookies: Required for core functionality, including user authentication, session management, security features, and booking processing. These cannot be disabled.
• •Functional cookies: Remember your preferences, such as language, currency, and recently viewed properties, to provide a more personalized experience.
• •Analytics cookies: Collect anonymized or pseudonymized data about how visitors interact with our website, helping us improve performance, identify issues, and optimize user journeys.
• •Advertising cookies: Used to deliver relevant travel advertisements and measure the effectiveness of advertising campaigns, where you have consented.

7.2 Cookie Consent Management

When you first visit AdvaTrav, we present a cookie consent banner allowing you to accept, reject, or customize your cookie preferences. You may change your cookie preferences at any time through the cookie settings link in our website footer or your account settings.

7.3 Browser Controls

You can also control cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Please note that if you disable essential cookies, some features of our Services may not function correctly.

8. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

8.1 Retention Periods

• •Account information: Retained for the duration of your account. If you request account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.
• •Booking records: Retained for the duration necessary to provide booking services, process payments, handle cancellations and refunds, and resolve disputes. Booking records are typically retained for 7 years for tax and regulatory compliance.
• •Identity verification data: KYC documents are retained for the legally required period (typically 5–7 years) to comply with AML regulations, after which they are securely deleted.
• •Fraud investigation records: Personal information associated with fraud investigations, account suspensions, or trust and safety incidents is retained for up to 7 years to prevent repeat offenses and support legal proceedings.
• •Tax and regulatory records: Financial transaction records, invoices, and tax-related data are retained for the period required by applicable tax laws, typically 5–7 years.
• •Marketing data: Retained until you opt out or until your account is deleted.
• •Customer service interactions: Retained for up to 3 years after the last interaction to support quality assurance and dispute resolution.

8.2 Deletion and Anonymization

When personal information is no longer needed, we either securely delete it or anonymize it so that it can no longer be used to identify you. Anonymized data may be retained for statistical and research purposes.

9. User Rights

Depending on your location, you may have the following rights regarding your personal information:

• •Right of access: You may request a copy of the personal information we hold about you.
• •Right to correction: You may request that we correct inaccurate or incomplete personal information.
• •Right to deletion: You may request that we delete your personal information, subject to legal retention obligations.
• •Right to restriction: You may request that we restrict the processing of your personal information in certain circumstances.
• •Right to object: You may object to the processing of your personal information based on legitimate interests or for direct marketing.
• •Right to data portability: You may request a machine-readable copy of your personal information to transfer to another service provider.
• •Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• •Right to opt out of marketing: You may opt out of marketing communications at any time by clicking the unsubscribe link in our emails, through your account settings, or by contacting us.
• •Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing of your personal information infringes applicable data protection laws.

To exercise any of these rights, please contact us at privacy@advatrav.com. We will respond to your request within 30 days, or as required by applicable law.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• •Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purpose for collecting, and the categories of third parties with whom we share it.
• •Right to delete: You may request that we delete your personal information, subject to applicable exceptions.
• •Right to correct: You may request that we correct inaccurate personal information.
• •Right to limit use of sensitive information: You may limit the use and disclosure of sensitive personal information (such as government ID numbers, precise geolocation, and financial account information) to purposes necessary for providing the Services or as permitted by law.
• •Right to opt out of sale or sharing: AdvaTrav does not sell personal information. We also do not share personal information for cross-context behavioral advertising.
• •Non-discrimination rights: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a CCPA/CPRA request, contact us at privacy@advatrav.com. We will verify your identity before processing your request.

11. Singapore PDPA Rights

If you are a resident of Singapore, the Personal Data Protection Act 2012 (PDPA) provides you with certain rights regarding your personal data:

• •Access Requests: You may request access to the personal data we hold about you and information about how it has been used.
• •Correction Requests: You may request correction of any personal data that is inaccurate, incomplete, or outdated.
• •Withdrawal of Consent: Where processing is based on your consent, you may withdraw consent for the collection, use, or disclosure of your personal data at any time.
• •Protection Obligations: AdvaTrav is required to protect your personal data by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks.
• •Data Breach Notification: In the event of a notifiable data breach under the PDPA, we will notify affected individuals and the Personal Data Protection Commission (PDPC) as required by law.

To exercise your PDPA rights, contact our Data Protection Officer at privacy@advatrav.com. We will respond within 30 days of receiving your request.

12. Children's Privacy

AdvaTrav's Services are not intended for, or directed at, children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information.

If you believe we have collected personal information from a child under 13, please contact us at privacy@advatrav.com so we can investigate and take appropriate action.

Some experiences or activities listed on AdvaTrav may be family-oriented or require adult supervision. In such cases, bookings must be made by an adult, and the adult is responsible for any minors traveling with them.

13. Security Measures

We implement industry-standard technical, organizational, and physical security measures designed to protect your personal information:

• •Encryption: All data in transit is encrypted using TLS (Transport Layer Security). Sensitive data at rest is encrypted using AES-256 or equivalent standards.
• •Access controls: Role-based access control (RBAC) restricts access to personal information to authorized personnel who need it to perform their job functions. Multi-factor authentication (MFA) is enforced for administrative access.
• •Monitoring and logging: Continuous monitoring of systems for suspicious activity, unauthorized access attempts, and anomalous behavior. Security event logs are retained for forensic analysis.
• •Secure cloud infrastructure: Our infrastructure is hosted on reputable cloud platforms that maintain recognized certifications including ISO 27001, SOC 2 Type II, and PCI DSS.
• •Incident management: We maintain a documented incident response plan with defined escalation procedures. In the event of a personal data breach, we will notify affected users and relevant authorities as required by applicable law.
• •Regular assessments: We conduct periodic security assessments, vulnerability scans, and penetration testing to identify and remediate potential weaknesses.
• •Data minimization: We collect only the personal information necessary for the purposes described in this Privacy Policy.
• •Vendor management: Third-party service providers are evaluated for security and privacy practices before engagement and are contractually required to maintain appropriate safeguards.

Despite our efforts, no system can be guaranteed to be 100% secure. If a security incident occurs that affects your personal information, we will notify you and the appropriate authorities in accordance with applicable law.

14. Third-Party Links and Services

AdvaTrav may contain links to external websites and services operated by third parties, including:

• •Booking partners: Hotels, airlines, car rental companies, and activity providers that process bookings on their own platforms.
• •Advertisers: Third-party advertising networks that may display ads on or alongside our Services.
• •Travel content providers: Destination guides, travel blogs, and visa information services that may be embedded or linked from our platform.
• •Social media platforms: Integration with social media services for sign-in, sharing, and content embedding.

These third parties have their own privacy policies and data practices. AdvaTrav is not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies before providing any personal information.

When you complete a booking through a third-party travel supplier, your personal information may be shared with that supplier to fulfill your booking. The supplier's privacy policy will govern the use of your information once shared.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will:

• •Update the "Last Updated" date at the top of this page.
• •Provide a prominent notice on our website or within the app for a reasonable period.
• •Send an email notification to registered users where the changes significantly affect their rights or the way we process their personal information.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your information. Your continued use of the Services after any changes take effect constitutes your acceptance of the updated Privacy Policy.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, please contact our Privacy Officer:

Privacy Officer AdvaTrav Ltd Company no. 17413197 (registered in England & Wales) 128 City Road, London, EC1V 2NX, United Kingdom Email: privacy@advatrav.com Website: https://advatrav.com

For data protection requests under the GDPR, UK GDPR, CCPA/CPRA, or Singapore PDPA, please include "Privacy Request" in the subject line of your email. We will verify your identity before processing requests involving personal data access, correction, or deletion.