PRIVACY POLICY

Last Updated: 20/02/2026

1. Introduction

This Privacy Policy explains how BETZONE s.r.o., operating the Travellin platform, collects, uses, stores, discloses and otherwise processes personal data in connection with the Travellin website, booking platform, applications, digital services, customer-support services, communications and related services. Travellin is an international travel technology and booking platform through which users may search, compare, discover, arrange and, where available, book travel products and services supplied by Travellin, independent suppliers, booking providers, affiliate partners and other third parties. Travellin is committed to protecting personal data and respecting applicable privacy and data-protection laws. Where the General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies, Travellin processes personal data in accordance with the GDPR and applicable national data-protection legislation. Travellin also seeks to comply with other applicable privacy and electronic-communications requirements in jurisdictions in which its services are offered. This Privacy Policy explains, among other matters:

what personal data Travellin may collect;
how personal data is collected;
why personal data is processed;
the legal bases relied upon;
how information is shared;
how long information may be retained;
international transfers;
cookies and tracking technologies;
affiliate and referral tracking;
payment processing;
booking-related processing;
user rights;
security measures;
children’s privacy;
complaints;
and how to contact Travellin.

This Privacy Policy should be read together with the Travellin Terms & Conditions, Cookie Policy, Affiliate & Referral Disclosure, Legal Notice & Company Information and any other applicable privacy notices presented during a particular service or booking.

2. Data Controller

For the processing activities covered by this Privacy Policy, the relevant data controller is: Legal entity: BETZONE s.r.o. Trading / Platform name: Travellin Legal form: Společnost s ručením omezeným (s.r.o.) Jurisdiction of establishment: Czech Republic Registered office: Maletín 9, 789 01 Maletín, Czech Republic Company registration number (IČO): 28802471 VAT / Tax identification number (DIČ): CZ28802471 Commercial Register: Czech Commercial Register Registration court: Krajský soud v Ostravě File / Registration reference: C 76632 General enquiries: info@travellin.info Booking enquiries: bookings@travellin.info Privacy enquiries: privacy@travellin.info Telephone: +420 732 844 855 Website: https://travellin.info For specific processing activities, Travellin may act as an independent controller, joint controller or processor depending on the circumstances and the contractual arrangements involved. Where another organisation determines independently why and how your personal data is processed, that organisation may be a separate data controller.

3. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

the Travellin website;
Travellin booking interfaces;
search and comparison tools;
user accounts;
booking forms;
checkout pages;
customer-support channels;
email communications;
contact forms;
affiliate and referral links;
marketing activities;
surveys and feedback mechanisms;
Travellin applications or digital interfaces;
and other services operated by Travellin.

It applies to visitors, users, registered users, travellers, booking customers, persons making bookings on behalf of others, business contacts and other individuals whose personal data Travellin may lawfully process.

4. Principles of Data Processing

Travellin seeks to process personal data according to the core principles of applicable data-protection law. These include:

lawfulness, fairness and transparency;
purpose limitation;
data minimisation;
accuracy;
storage limitation;
integrity and confidentiality;
and accountability.

These principles are recognised as fundamental GDPR requirements by the European Data Protection Board. Travellin seeks to collect only information that is reasonably relevant to the purposes for which it is processed.

5. Categories of Personal Data We May Collect

Depending on how you interact with Travellin, we may process different categories of personal data. These may include:

Identification information

first name;
surname;
title;
date of birth where required;
nationality where required;
passenger identification information;
passport or identity-document information where necessary for a booking.

Contact information

email address;
telephone number;
postal address;
billing address;
communication preferences.

Booking information

booking reference;
travel dates;
destination;
departure location;
arrival location;
accommodation information;
room information;
passenger information;
baggage information;
activity information;
vehicle-rental information;
cruise information;
voucher information;
and other information necessary to fulfil a booking.

Account information

username;
account identifier;
password credentials in appropriately protected form;
account preferences;
saved searches;
saved travel preferences;
and account activity.

Payment information

Depending on the payment method and provider, this may include:

payment status;
transaction reference;
billing information;
payment method;
partial payment-card information;
transaction amount;
currency;
and fraud-prevention information.

Travellin generally does not need to receive or store full payment-card credentials when payment is processed directly by an authorised third-party payment provider.

Technical information

We may process:

IP address;
browser type;
operating system;
device type;
device identifiers;
language;
approximate location derived from technical information;
time zone;
referral information;
pages viewed;
interactions;
technical logs;
error information;
and security information.

Usage information

This may include:

searches;
filters used;
pages viewed;
products viewed;
clicks;
booking interactions;
preferences;
saved products;
and interaction history.

Communications

We may process information contained in communications with Travellin, including:

emails;
support requests;
enquiries;
complaints;
feedback;
and other correspondence.

6. Special Categories of Personal Data

Certain travel transactions may require information that could reveal or relate to sensitive circumstances. Examples may include information concerning:

accessibility requirements;
dietary requirements where they reveal health or religious information;
medical requirements;
mobility assistance;
or other special travel needs.

Travellin will seek to minimise the collection of such information and process it only where necessary and where an appropriate legal basis and, where required, an additional condition under applicable data-protection law exists. Users should avoid providing sensitive personal information unless it is genuinely necessary for the requested service. Where a supplier requires such information to fulfil a travel service, it may be transmitted to the relevant supplier or service provider as necessary.

7. Information Collected Directly From You

Travellin may collect personal data directly when you:

create an account;
search for travel;
submit a booking;
complete checkout;
contact customer support;
subscribe to communications;
submit an enquiry;
complete a form;
request assistance;
submit a review;
participate in a survey;
communicate with Travellin;
or otherwise voluntarily provide information.

Where personal data is collected directly from you, applicable transparency requirements generally require information about the controller, purposes, legal bases and other relevant matters to be provided at the time of collection. GDPR Article 13 sets out these requirements.

8. Information Collected From Third Parties

Travellin may receive personal data from third parties where lawful and necessary. Examples include:

airlines;
accommodation providers;
booking platforms;
activity providers;
cruise operators;
vehicle-rental providers;
affiliate networks;
payment providers;
fraud-prevention providers;
API providers;
technology partners;
and persons making a booking on behalf of another traveller.

Where personal data is obtained indirectly, applicable transparency obligations may also apply. The EDPB notes that information requirements can apply even where personal data has been obtained through a third party rather than directly from the individual.

9. Purposes of Processing

Travellin may process personal data for the following purposes.

9.1 Providing the Platform

We use information to:

operate the website;
provide search functionality;
display relevant results;
maintain accounts;
provide requested services;
personalise permitted settings;
maintain security;
and operate technical infrastructure.

9.2 Processing Bookings

We may process information to:

create bookings;
communicate with suppliers;
issue confirmations;
transmit traveller information;
process amendments;
facilitate cancellations;
process refunds;
provide customer support;
and administer travel transactions.

9.3 Payments

Information may be processed to:

initiate payments;
confirm payment status;
prevent fraud;
reconcile transactions;
issue invoices;
process refunds;
and maintain financial records.

9.4 Customer Support

Information may be used to:

respond to enquiries;
investigate complaints;
resolve booking problems;
communicate with suppliers;
and maintain support records.

9.5 Security

Information may be processed to:

detect suspicious activity;
prevent fraud;
protect accounts;
investigate security incidents;
prevent abuse;
and protect Travellin, users and third parties.

9.6 Legal Compliance

Information may be processed where necessary to:

comply with legal obligations;
respond to lawful requests;
maintain accounting records;
meet tax obligations;
establish or defend legal claims;
or comply with regulatory requirements.

9.7 Analytics

Subject to applicable law and consent requirements, information may be used to understand:

website performance;
user behaviour;
search behaviour;
conversion;
technical errors;
and service performance.

9.8 Marketing

Where permitted, Travellin may use contact information to send:

newsletters;
travel information;
promotional communications;
offers;
destination information;
and other marketing communications.

Where consent is legally required, Travellin will obtain it before sending the relevant marketing communications.

10. Legal Bases for Processing

Where GDPR applies, Travellin relies on one or more lawful bases under Article 6 GDPR depending on the processing activity. These may include:

Contractual necessity

Processing may be necessary to enter into or perform a contract, including:

creating a booking;
processing traveller information;
communicating booking information;
facilitating payment;
and providing requested services.

The EDPB has issued specific guidance concerning Article 6(1)(b) and the use of contractual necessity for online services.

Legal obligation

Processing may be necessary to comply with legal obligations, including:

accounting;
taxation;
financial reporting;
legal claims;
regulatory requirements;
fraud prevention;
or lawful requests.

Legitimate interests

Travellin may process personal data where necessary for legitimate interests, provided that those interests are not overridden by the individual’s rights and freedoms. Potential legitimate interests may include:

website security;
fraud prevention;
service improvement;
internal administration;
business communications;
network security;
and defending legal claims.

Where legitimate interests are relied upon, Travellin will consider the relevant balancing requirements.

Consent

Consent may be relied upon where appropriate, including for certain:

marketing;
cookies;
analytics;
advertising;
profiling;
or other optional processing activities.

Where consent is the legal basis, it may generally be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

11. Marketing Communications

Travellin may send marketing communications where permitted by law. These may include:

travel offers;
destination inspiration;
newsletters;
promotions;
product updates;
partner offers;
and other commercial communications.

Where consent is required, marketing will be sent only after appropriate consent has been obtained. Users may unsubscribe using the mechanism provided in the relevant communication. Transactional communications relating to bookings, payments, security or essential services are not necessarily marketing communications and may continue where necessary.

12. Personalisation

Travellin may use information such as:

selected destination;
search criteria;
language;
currency;
previous interactions;
and saved preferences

to improve the relevance of the Platform. Where personalisation constitutes profiling or automated decision-making regulated by applicable law, Travellin will provide the information and rights required by that law.

13. Automated Decision-Making

Travellin may use automated systems for purposes such as:

search ranking;
recommendation;
fraud detection;
technical optimisation;
availability matching;
and personalised presentation.

Not every automated process constitutes legally regulated automated decision-making. Where Travellin carries out solely automated decision-making that produces legal effects or similarly significant effects within the meaning of applicable data-protection law, Travellin will provide the applicable safeguards and information required by law.

14. Search and Booking Data

Search information may be processed to provide requested search results. Depending on the service, searches may be transmitted to third-party:

airline systems;
hotel systems;
booking platforms;
activity suppliers;
API providers;
or other travel-data providers.

The information transmitted will depend on the search and booking requirements.

15. Travel Supplier Data Sharing

Where necessary to complete or administer a booking, Travellin may provide relevant personal data to the applicable supplier. These may include:

airlines;
hotels;
accommodation providers;
cruise operators;
activity providers;
transportation providers;
vehicle-rental companies;
equipment-rental providers;
restaurants;
venues;
and other service providers.

Only information reasonably necessary for the relevant service should be transmitted.

16. Payment Providers

Payments may involve third-party payment providers such as:

Stripe;
banks;
card networks;
payment gateways;
fraud-prevention providers;
or supplier payment systems.

The payment provider may process payment information independently under its own privacy documentation. Travellin may receive transaction-related information such as:

payment status;
transaction reference;
amount;
currency;
and limited payment information necessary for reconciliation.

17. Affiliate and Referral Tracking

Travellin may participate in affiliate and referral programmes. Affiliate tracking may involve:

referral URLs;
cookies;
pixels;
tracking parameters;
attribution identifiers;
session information;
or server-side attribution.

Such processing may be necessary to determine whether Travellin is entitled to a referral commission. Additional information is provided in the Travellin Affiliate & Referral Disclosure and Cookie Policy. Where consent is required for the relevant tracking technology, Travellin will seek the appropriate consent.

18. Cookies and Similar Technologies

Travellin may use:

essential cookies;
preference cookies;
analytics technologies;
security technologies;
affiliate tracking technologies;
advertising technologies;
pixels;
local storage;
and similar technologies.

Essential technologies may be used where necessary to provide requested services. Optional technologies will be handled according to applicable consent requirements. The Travellin Cookie Policy provides additional information concerning individual technologies and choices. The EDPB has specifically addressed the application of Article 5(3) of the ePrivacy Directive to modern tracking technologies, including URL and pixel tracking and unique identifiers.

19. Data Minimisation

Travellin seeks to limit the personal data collected and processed to information that is relevant and reasonably necessary for the applicable purpose. For example, information required to issue a flight ticket may be substantially different from information required to subscribe to a newsletter. Travellin does not intend to require unnecessary personal information merely because it could technically be collected.

20. Data Accuracy

Travellin seeks to maintain accurate personal information. Users should notify Travellin if information is inaccurate or has changed. Certain information, especially traveller names and identification details, may need to match official travel documentation exactly. Travellin may retain historical information where necessary for legal, accounting, dispute-resolution or record-keeping purposes.

21. Data Retention

Travellin retains personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law. Retention periods may depend on:

the nature of the information;
the purpose of processing;
the existence of a booking;
accounting requirements;
tax requirements;
legal limitation periods;
disputes;
fraud-prevention requirements;
security;
and regulatory obligations.

Different categories of information may therefore have different retention periods.

22. Account Data

Where a user creates an account, Travellin may retain account information while the account remains active. If an account is closed, certain information may nevertheless be retained where required for:

legal compliance;
accounting;
fraud prevention;
dispute resolution;
security;
or other legitimate purposes.

23. Booking Records

Booking-related information may need to be retained for a longer period than ordinary website activity because of:

contractual obligations;
accounting;
tax;
customer-service requirements;
refund administration;
legal claims;
regulatory obligations;
or supplier requirements.

24. Security Logs

Technical and security logs may be retained for a limited period appropriate to their purpose. Retention may be extended where necessary to investigate:

security incidents;
fraud;
abuse;
legal claims;
or other unlawful activity.

25. Data Sharing

Travellin may disclose personal data to recipients where necessary and lawful. These may include:

travel suppliers;
booking providers;
payment processors;
technology providers;
cloud-hosting providers;
analytics providers;
fraud-prevention providers;
customer-support providers;
email providers;
affiliate networks;
professional advisers;
insurers;
legal advisers;
regulators;
law-enforcement authorities;
courts;
and other authorised recipients.

26. Data Processors

Travellin may use third-party organisations to process personal data on its behalf. Examples may include providers of:

hosting;
cloud infrastructure;
email;
CRM;
customer support;
payment infrastructure;
analytics;
security;
database management;
and other technical services.

Where GDPR requires a processor relationship to be governed by appropriate contractual terms, Travellin will seek to implement the required safeguards.

27. Independent Controllers

Some suppliers and service providers may act as independent data controllers. For example, an airline, hotel or activity provider may independently determine how it processes traveller data after receiving the information necessary to provide its service. Those organisations may have their own privacy policies. Users should review the relevant supplier privacy documentation where appropriate.

28. International Data Transfers

Travellin may use suppliers and service providers located outside the European Economic Area. Where personal data is transferred internationally, Travellin will seek to ensure that an appropriate lawful transfer mechanism is available where required. Depending on the circumstances, this may include:

an adequacy decision;
Standard Contractual Clauses;
another legally recognised safeguard;
or a specific derogation where legally applicable.

Where required, Travellin will provide information concerning the relevant safeguards.

29. Data Security

Travellin uses reasonable technical and organisational measures intended to protect personal data against:

unauthorised access;
accidental loss;
destruction;
alteration;
disclosure;
misuse;
and other unlawful processing.

Security measures may include:

access controls;
authentication;
encryption where appropriate;
secure transmission;
monitoring;
backups;
logging;
vulnerability management;
and restricted internal access.

No internet-based system can guarantee absolute security.

30. Data Breaches

Where a personal-data breach occurs, Travellin will assess the incident and take measures required by applicable law. Where GDPR requires notification to a supervisory authority, Travellin will seek to comply with the applicable notification requirements. Where notification to affected individuals is legally required, Travellin will provide the relevant communication.

31. Children’s Privacy

Travellin’s services are generally intended for adults capable of entering into legally binding transactions. Travellin does not knowingly seek to collect unnecessary personal data from children. Where a booking involves a minor, information may need to be processed because it is necessary to provide the requested travel service. The adult making the booking should ensure that the relevant information is provided lawfully and appropriately.

32. User Rights Under GDPR

Where GDPR applies, individuals may have rights including:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to data portability;
right to object;
right to withdraw consent;
and rights concerning automated decision-making, where applicable.

The availability of a particular right depends on the legal basis and circumstances of the processing. The EDPB provides dedicated guidance concerning data-subject rights under GDPR.

33. Right of Access

You may request confirmation as to whether Travellin processes personal data concerning you. Where applicable, you may request access to:

the personal data;
purposes of processing;
categories of data;
recipients;
retention information;
legal bases;
international transfers;
and other information required by GDPR.

34. Right to Rectification

You may request correction of inaccurate personal data. You may also request completion of incomplete information where appropriate. Travellers should be aware that certain booking information may need to be changed through the relevant supplier rather than directly through Travellin.

35. Right to Erasure

You may request deletion of personal data in circumstances provided by applicable law. The right is not absolute. Travellin may retain information where necessary to:

comply with legal obligations;
establish or defend legal claims;
exercise legal rights;
prevent fraud;
maintain required records;
or otherwise comply with applicable law.

36. Right to Restriction

You may request restriction of processing in circumstances provided by GDPR. During restriction, Travellin may retain the relevant information while limiting other processing activities as required by law.

37. Right to Data Portability

Where the legal requirements are satisfied, you may request personal data provided to Travellin in a structured, commonly used and machine-readable format. This right generally applies where processing is based on:

consent; or
a contract;

and is carried out by automated means.

38. Right to Object

Where processing is based on legitimate interests, you may have the right to object. You may also have an unconditional right to object to direct marketing. Where you object to direct marketing, Travellin will stop the relevant marketing processing, subject to limited exceptions permitted by law.

39. Withdrawal of Consent

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

40. Automated Decision-Making Rights

Where applicable GDPR provisions concerning automated decision-making apply, individuals may have rights to:

obtain human intervention;
express their point of view;
contest the decision;
and receive relevant information concerning the processing.

These rights apply only in the circumstances specified by applicable law.

41. How to Exercise Your Rights

Privacy requests should be sent to: Privacy enquiries: privacy@travellin.info Please include enough information for Travellin to:

identify you;
understand the request;
identify the relevant account or booking where applicable;
and respond appropriately.

Travellin may need to verify identity before disclosing or changing personal data.

42. Response Times

Travellin will respond to valid data-subject requests within the time period required by applicable law. Under GDPR, requests will generally be addressed without undue delay and, in principle, within one month, subject to the circumstances and permitted extensions. Where an extension is permitted, Travellin will provide the required information concerning the extension.

43. Identity Verification

To protect personal data, Travellin may request reasonable information necessary to verify the identity of a person making a privacy request. Travellin will seek to avoid collecting unnecessary identification information solely for this purpose.

44. Complaints to a Supervisory Authority

You have the right, where applicable, to lodge a complaint with a competent data-protection supervisory authority. Individuals in the European Economic Area may generally contact the supervisory authority in the country of their habitual residence, place of work or place of an alleged infringement, subject to applicable law. For Travellin’s Czech establishment, the competent national supervisory authority is: Úřad pro ochranu osobních údajů (Office for Personal Data Protection) Czech Republic Travellin recommends contacting the company first where appropriate so that it has an opportunity to investigate and resolve the issue.

45. Direct Marketing and Opt-Out

Every promotional email sent by Travellin will provide an appropriate mechanism for unsubscribing where required. Users may also contact: privacy@travellin.info to request removal from marketing communications. Transactional and legally necessary communications are not necessarily affected by a marketing opt-out.

46. Third-Party Links

The Travellin Platform may contain links to third-party websites. Travellin is not responsible for the privacy practices of third parties operating their own websites or services. Users should review the relevant third party’s privacy policy before submitting personal information.

47. Social Media

Travellin may maintain social-media profiles or integrate social-media functionality into the Platform. Interactions with social-media services may result in processing by those third parties. The relevant social-media provider’s privacy policy will govern its processing.

48. Analytics

Travellin may use analytics technologies to understand:

traffic;
page performance;
technical problems;
searches;
interactions;
conversions;
and general Platform performance.

Where applicable, analytics technologies will be used according to consent requirements.

49. Advertising

Travellin may use advertising technologies or advertising partners. Advertising technologies may process information such as:

device identifiers;
browsing interactions;
approximate location;
advertising identifiers;
or other technical information.

Where consent is required, Travellin will obtain appropriate consent before using non-essential advertising technologies.

50. Profiling

Travellin may analyse permitted information to understand user preferences or improve search and recommendation functionality. Where profiling is subject to specific legal requirements, Travellin will provide the information and rights required by applicable law.

51. Affiliate Attribution

Where a user arrives at a supplier through Travellin, an affiliate network may process information necessary to attribute the referral. This may include:

referral source;
timestamp;
click identifier;
transaction identifier;
and qualifying booking information.

Affiliate attribution is used primarily to determine whether Travellin is entitled to a commission.

52. Booking Data and Affiliate Partners

Where a booking is completed through an affiliate or referral arrangement, relevant transaction information may be exchanged between Travellin, the supplier and the affiliate network. The exact information exchanged depends on the technical and contractual arrangement. Travellin seeks to limit data sharing to what is reasonably necessary.

53. Fraud Prevention

Travellin may process technical, account and transaction information to identify:

fraudulent bookings;
payment abuse;
account takeover;
automated attacks;
suspicious activity;
referral abuse;
or other security threats.

Fraud-prevention providers may process relevant information on Travellin’s behalf or independently where legally permitted.

54. Legal Claims

Travellin may retain and process personal data where necessary to:

establish;
exercise;
defend;
investigate;
or respond to

legal claims or disputes. Such processing may continue beyond the ordinary retention period where legally necessary.

55. Corporate Transactions

If Travellin undergoes a merger, acquisition, restructuring, sale of assets or similar corporate transaction, personal data may be transferred as part of the transaction where lawful. Any such transfer will remain subject to applicable privacy obligations.

56. Accounting and Tax Records

Travellin may retain personal and transaction information where necessary to comply with:

accounting requirements;
tax legislation;
financial reporting obligations;
anti-fraud requirements;
or other legal obligations.

These records may be retained for periods prescribed by applicable law.

57. Communication Records

Travellin may retain relevant correspondence for purposes such as:

customer support;
quality assurance;
dispute resolution;
security;
training;
legal compliance;
and record keeping.

Where communications are recorded or monitored, Travellin will provide additional notice where required.

58. Changes to This Privacy Policy

Travellin may update this Privacy Policy to reflect:

changes in law;
regulatory guidance;
new services;
new suppliers;
new technologies;
changes in processing;
security improvements;
or changes in business operations.

The “Last Updated” date will be changed when material updates are made. Where required by law, Travellin will provide additional notice concerning material changes.

59. Transparency

Travellin aims to provide privacy information in a clear, accessible and understandable form. The EDPB’s transparency guidance emphasises that privacy information should be concise, transparent, intelligible, easily accessible and expressed in clear and plain language. This Privacy Policy therefore explains the principal categories of processing without attempting to conceal relevant processing practices behind unnecessarily technical language.

60. No Sale of Personal Data

Travellin does not intend to sell personal data as a commodity. Where information is shared with suppliers, booking providers, payment providers, affiliate networks, technology providers or other third parties, the sharing is carried out for legitimate operational, contractual, commercial, legal or other permitted purposes rather than as a general sale of personal information. Where another jurisdiction provides a broader statutory definition of “sale” or “sharing”, Travellin will assess its activities according to the applicable local law.

61. Data From Persons Making Bookings for Others

If you make a booking on behalf of another traveller, you confirm that you are authorised to provide the relevant information. You should inform the other traveller of the applicable privacy information. This is particularly important where you provide:

passport information;
identification information;
contact details;
date of birth;
accessibility information;
or other personal information.

62. Special Travel Requirements

If you voluntarily provide special travel information, Travellin may process and transmit that information where necessary to arrange the requested service. Examples include:

wheelchair assistance;
mobility assistance;
dietary requirements;
accessible accommodation;
medical equipment requirements;
or other travel arrangements.

Travellin will seek to limit access and disclosure to parties that need the information to provide the requested service.

63. International Suppliers

Travel is inherently international. A booking may require Travellin to transmit information to suppliers located in another country. This may include:

an airline based outside the EEA;
a hotel outside the EEA;
a cruise operator;
a vehicle-rental company;
an activity provider;
or another supplier.

International transfers will be managed according to applicable data-protection law.

64. Data Protection by Design and Default

Travellin seeks to incorporate privacy considerations into the design of its systems and services. This may include:

limiting unnecessary fields;
restricting access;
protecting authentication;
separating operational data where appropriate;
using appropriate security controls;
and reviewing data flows.

The EDPB’s guidance on data protection by design and default emphasises transparency, autonomy, clarity and avoidance of deceptive interfaces in privacy-related processing.

65. Privacy and Booking Forms

Where a booking form requests personal data, Travellin should identify information that is:

required;
optional;
necessary for the booking;
necessary for legal compliance;
or requested for additional services.

Users should not be required to provide optional information merely to complete a basic booking unless there is a legitimate reason for the requirement.

66. Privacy and Checkout

The Travellin checkout process may process:

traveller information;
contact information;
billing information;
payment information;
booking information;
supplier information;
and transaction information.

The checkout interface should provide appropriate privacy information and links to the applicable legal documents.

67. Privacy and Customer Accounts

Users should keep account credentials confidential. Travellin will not intentionally request a user’s password through an unsolicited email. If an account appears compromised, the user should contact Travellin promptly.

68. Data Accuracy in Travel Transactions

Certain information may be technically essential to a booking. For example, an airline may require the passenger’s name to match the identity document used for travel. Travellin may therefore process and transmit information where necessary to fulfil the traveller’s request.

69. Supplier Privacy Policies

A supplier may process traveller data independently after receiving it from Travellin. Examples include:

airlines;
hotels;
cruise lines;
activity operators;
car-rental providers;
payment providers;
and other suppliers.

Travellers should review supplier privacy policies where relevant.

70. Data Retention After Cancellation

Cancelling a booking does not necessarily result in immediate deletion of all related information. Travellin may need to retain information for:

refund processing;
accounting;
tax;
supplier reconciliation;
fraud prevention;
complaints;
disputes;
legal claims;
or regulatory requirements.

71. Data Deletion

Where data is no longer required and there is no legal reason for continued retention, Travellin seeks to delete, anonymise or securely dispose of the information. Deletion may occur through automated retention processes or controlled manual procedures.

72. Anonymisation

Where appropriate, Travellin may anonymise information so that it can no longer reasonably be associated with an identifiable individual. Anonymised information may be used for purposes such as:

statistics;
analytics;
service development;
reporting;
and business analysis.

Properly anonymised information is no longer personal data under GDPR.

73. Aggregated Information

Travellin may create aggregated statistical information from Platform activity. Examples include:

destination trends;
search volumes;
booking statistics;
technical performance;
and general usage patterns.

Where information is genuinely anonymised or aggregated so that individuals cannot reasonably be identified, it may be used for legitimate business purposes.

74. No Absolute Security Guarantee

Although Travellin takes security seriously, no electronic transmission, database or internet service can be guaranteed to be completely secure. Users should therefore also take reasonable precautions, including:

using strong passwords;
protecting devices;
avoiding suspicious links;
and promptly reporting suspicious activity.

75. Contact Information

For privacy-related enquiries, requests or complaints: BETZONE s.r.o. — Travellin Privacy enquiries: privacy@travellin.info General enquiries: info@travellin.info Booking enquiries: bookings@travellin.info Telephone: +420 732 844 855 Registered office: Maletín 9, 789 01 Maletín, Czech Republic Company registration number: 28802471 VAT / Tax identification number: CZ28802471

76. Data Protection Officer

Data Protection Officer (DPO): [INSERT IF FORMALLY APPOINTED] Travellin will publish DPO contact details if and when a Data Protection Officer is legally required or formally appointed. The absence of a DPO designation on this page should not be interpreted as a statement that no data-protection obligations apply to Travellin.

77. Supervisory Authority

For matters concerning Travellin’s Czech establishment, the relevant national supervisory authority is: Úřad pro ochranu osobních údajů Office for Personal Data Protection Czech Republic Individuals may have the right to complain to another competent supervisory authority depending on their residence, workplace or the circumstances of the alleged infringement.

78. Final Privacy Commitment

Travellin recognises that personal data is entrusted to the Platform in connection with travel planning, bookings, payments and communications. Travellin therefore seeks to:

process information lawfully;
explain processing clearly;
collect only information that is reasonably necessary;
protect personal information;
limit access;
use appropriate safeguards;
respect applicable data-subject rights;
and maintain transparency concerning third-party processing.

Travellin will continue to review its data-processing practices as its technology, suppliers, booking systems, affiliate relationships and international operations develop. Nothing in this Privacy Policy is intended to remove or restrict any mandatory data-protection right available under applicable law. Travellin — your journey is personal. Your privacy matters.

LEGAL IMPLEMENTATION NOTICE

This Privacy Policy is drafted as the principal public privacy notice for BETZONE s.r.o. / Travellin and is designed to address the principal GDPR transparency requirements. Before publication, Travellin’s technical implementation should be audited against this document. In particular, the live Platform should be checked for:

every cookie and tracking technology actually deployed;
Google Analytics or equivalent analytics;
Meta/TikTok/other advertising pixels if used;
affiliate tracking systems;
Travelpayouts or other affiliate networks;
Hotel/Accommodation APIs;
flight APIs;
payment processors;
WooCommerce;
hosting providers;
CRM systems;
email systems;
fraud-prevention systems;
CDN and security services;
WordPress/Elementor/ACF data storage;
user-account data;
checkout data;
supplier API data flows;
international data transfers;
data-retention periods;
deletion procedures;
and actual database fields containing personal information.

The final production Privacy Policy must match the actual technical data flows. A privacy policy should not claim that a particular provider, cookie, tracking mechanism, processor or transfer exists unless it is actually used, and it should not omit processing that actually occurs. The GDPR requires transparency concerning purposes, legal bases, recipients/categories of recipients, retention and relevant international-transfer information, and the EDPB stresses that privacy information must be accessible, intelligible and provided in clear language. For this reason, this document should be treated as the master legal Privacy Policy, followed by a technical data-flow and cookie audit before publication.