Privacy Policy

1. Who We Are

TripGate is run by {{PLACEHOLDER: company legal name}}, a company registered in Sri Lanka (registration number {{PLACEHOLDER: company registration number}}), at {{PLACEHOLDER: registered address}}.

Our role depends on the data:

• For your account, billing and use of TripGate, we are the controller. We decide how that data is used.
• For travellers' data that an agency puts into TripGate, the agency is the controller and we are its processor. We use that data only to provide the service, as set out in the Data Processing Agreement.

2. Data We Collect

• Account data: names, email addresses, roles and login details of agency staff.
• Billing data: company name, billing contact and payment records. Card details are handled by OnePay. We never see or store full card numbers.
• Security and usage data: IP address, browser, login times, and an activity log of changes made in a workspace.
• Travellers' data: names, contact details, travel dates, preferences and messages. These reach TripGate through the agency's connected email, WhatsApp or manual entry.
• Support data: what you tell us when you contact support.

3. Why We Process Data

• To provide TripGate: workspaces, inquiries, itineraries, documents and integrations.
• To read inquiries and rate sheets with AI, so agencies have less to type. Staff check the results.
• To bill for subscriptions.
• To keep the service secure: detecting abuse, logging access and preventing fraud.
• To give support and send service messages, such as invitations, password resets and notices.

We do not sell personal data. We do not use it for advertising. We do not use it to train AI models.

4. Legal Basis for Processing

• Contract: to provide the service you signed up for.
• Legitimate interests: to keep TripGate secure and improve it.
• Legal obligations: for example, keeping invoices for tax.
• Consent: where we ask for it. You can withdraw it at any time.

For travellers' data, the agency, as controller, is responsible for having a legal basis.

5. Sharing and Sub-processors

We share data only with the service providers that help us run TripGate, such as hosting, email, payments and AI. Each one is bound by a contract and may use the data only for us.

The full list, with what each provider does, is on the Sub-processors page.

We also disclose data when the law requires it, or to protect people's safety.

6. International Data Transfers

Some of our providers process data outside Sri Lanka. Where they do, we use contracts that require them to protect it to the standard of this policy. The Sub-processors page shows where each provider processes data.

Our AI provider is set to keep no data after a request and not to use it for training.

7. Data Retention and Deletion

• Account and workspace data: for as long as the workspace exists.
• The full text of incoming emails: emptied after 365 days. The inquiry details read from them stay.
• Raw WhatsApp message data: emptied after 90 days.
• After a workspace closes: the agency can export its data for 30 days, and then it is deleted.
• Invoices: for as long as tax law requires.
• Backups: overwritten on a rolling schedule.

An agency can export or erase one traveller's data at any time from Settings.

8. Your Data Protection Rights

You can ask to:

• See the personal data we hold about you.
• Correct it if it is wrong.
• Delete it.
• Get a copy in a common format.
• Withdraw consent, or object to some processing.

Agency staff can contact us at {{PLACEHOLDER: privacy contact email}}. We reply within 30 days.

Travellers: please contact the travel agency you dealt with. It controls your data and can export or erase it in TripGate. If you contact us instead, we will pass your request to the agency.

9. Data Security Measures

• All connections are encrypted.
• Each agency's data is kept separate from every other agency's.
• Files attached to inquiries can only be opened by logged-in staff, and every download is logged.
• Two-factor login is available for every user.
• Our support staff can enter a workspace only when its admin grants time-limited access, and every visit is recorded.
• Workspace admins can see an activity log of changes.
• Production systems are restricted to a small number of staff.

10. Children's Privacy

TripGate is a business tool and is not meant for children.

Agencies may handle details of children who travel with their families. That data is controlled by the agency.

11. Changes to This Privacy Policy

Each version shows its number and effective date at the top of this page. When we make a material change, we tell workspace admins by email or in the app before it takes effect.

12. Contact Information

For privacy questions or requests, contact us. You also have the right to complain to the Data Protection Authority of Sri Lanka.

• Company: {{PLACEHOLDER: company legal name}} (registration number {{PLACEHOLDER: company registration number}})
• Address: {{PLACEHOLDER: registered address}}
• Support: [email protected]
• Privacy: {{PLACEHOLDER: privacy contact name}}, {{PLACEHOLDER: privacy contact email}}