Privacy Policy

This Privacy Policy explains how TripZen DWC-LLC ("Trip Zen", "we", "us" or "our") handles personal data collected through this website and the forms on it. Trip Zen is a business-to-business technology provider: we license cloud-based travel booking infrastructure to travel businesses. We are not a travel agency, and we do not sell travel products to the public through this website.

TripZen DWC-LLC is a limited liability company registered in the Dubai South Free Zone, Dubai, United Arab Emirates (registration number 12624) and licensed by the Dubai Aviation City Corporation (commercial license number 13659). Its registered office is at Business Centre, Floor 3, Building A3, Business Park, Dubai South, Dubai, United Arab Emirates.

For personal data collected through this website, Trip Zen is the controller (referred to as the "data fiduciary" under India's Digital Personal Data Protection Act, 2023). This means we decide why and how that data is processed.

This policy does not cover:

• Data processed inside the Trip Zen platform for our customers. When a travel business uses Trip Zen to manage its products, bookings and travelers, that business decides how its data is used, and we process it under our agreement with that business and the SaaS Licensing Terms. If you booked travel through one of our customers, please contact that business directly.
• Third-party websites and services that link to or from this website. They have their own privacy policies.

We collect personal data when you give it to us, automatically when you submit a form, and, with your consent, through analytics.

Information you provide through our forms

The fields depend on the form you use, and each form shows which fields are required.

• Demo requests: full name, company name, business email, phone number, country, company type, number of users, current booking system, travel products of interest, expected monthly booking volume and an optional message.
• Sales enquiries: full name, company name, business email, phone number, country, company type, number of users, expected booking volume, plan of interest, billing preference, specific requirements and an optional message.
• Contact messages: full name, email address, topic and message, plus company name and phone number if you choose to add them.
• Partner applications: full name, company name, email address, country, partner type, website, products offered and a message, plus a phone number if you choose to add one.
• Career enquiries: full name, email address, role of interest and a message, plus phone number, country, LinkedIn profile and portfolio links if you choose to add them.
• Newsletter sign-ups: your email address and where on the website you subscribed.

Every form also records your consent choices: your agreement to this Privacy Policy, whether you opted in to marketing communications, and when you made those choices. Please do not include sensitive personal data, such as health, financial account or government identification details, in free-text messages.

Information collected automatically when you submit a form

• Hashed IP address. Our servers convert your IP address into a salted, one-way hash before storing it. We use the hash to detect abuse and repeated spam. We do not store the raw IP address with your submission.
• Browser user agent: a short text string that describes your browser and operating system, used for security and troubleshooting.
• Attribution details: the page you submitted the form from, the first page you visited in your browsing session, the external website that referred you (without its query parameters) and any campaign (UTM) parameters in the link you followed. These are held in your browser until you submit a form. See the Cookie Policy.
• Anti-spam signals: a hidden field that should stay empty, the time the form was opened and, when bot protection is enabled, a verification token from Cloudflare Turnstile.

Information collected with your consent

If you allow analytics in your cookie preferences, we use Google Analytics 4, Plausible Analytics or both, depending on how the website is configured. They help us understand how the site is used, for example which pages are viewed, the type of device and browser, the referring website and approximate location derived from your IP address. Analytics does not run until you consent. The Cookie Policy has the details.

We use personal data to:

• Respond to demo requests, sales enquiries, contact messages, partner applications and career enquiries, and follow up on them.
• Assess how Trip Zen could fit your business, and prepare the demonstrations, proposals or licensing agreements you ask for.
• Notify the right Trip Zen team members when a form is submitted, so we can reply promptly.
• Send the newsletter and product updates you asked to receive, including a confirmation email where double opt-in applies.
• Protect our forms, website and systems from spam, fraud, abuse and security threats.
• Understand, with your consent, how visitors use the website so we can improve its content and performance.
• Learn which pages and campaigns lead to enquiries, using the attribution details sent with a form.
• Keep records of consent, comply with legal obligations, and establish, exercise or defend legal claims.

We do not use personal data collected through this website for automated decision-making that produces legal or similarly significant effects for you. We do not sell personal data, and we do not use it for third-party advertising.

Data protection laws require a lawful ground for each use of personal data. Depending on where you are and the purpose, we rely on:

• Consent: for analytics, the newsletter and other marketing communications. You can withdraw consent at any time, and withdrawal does not affect processing that happened before it.
• Steps before entering into a contract: when you ask about a demo, pricing or licensing, we process your details to respond and to prepare a possible agreement with your business.
• Legitimate interests: to operate and secure our website, prevent spam and abuse, understand which channels bring enquiries, and manage business relationships, where those interests are not overridden by your rights. You can object to this processing, as explained in Your privacy rights.
• Legal obligation: where we must keep or disclose information to comply with applicable law.

Where India's Digital Personal Data Protection Act, 2023 applies, we process personal data on the basis of your consent or, where the Act allows, for a legitimate use, such as acting on information you have voluntarily provided for a specific purpose.

We use a necessary cookie named tz_consent to remember your cookie choices, and a session storage item named tz_tracking that holds first-touch attribution in your browser until you submit a form. Analytics tools run only if you allow them.

You can change your choices at any time with Cookie settings in the website footer. The Cookie Policy lists each cookie and storage item, what it does and how long it lasts.

We share personal data only where needed for the purposes described in this policy, with:

• Hosting and infrastructure providers that run our website, servers and database.
• Email delivery providers that send form notifications to our team, and confirmation emails and newsletters to you.
• Internal collaboration tools we may use to alert our team to new enquiries. These alerts do not include your email address or phone number.
• Analytics providers, only with your consent: Google (Google Analytics 4) and Plausible Analytics, depending on which the website is configured to use.
• Bot protection: Cloudflare, when Turnstile is enabled on our forms. Cloudflare receives technical information from your browser and, when we verify a submission, your IP address.
• Professional advisers, such as lawyers and accountants, who are bound by duties of confidentiality.
• Authorities and other parties where required by law, regulation or legal process, or where necessary to protect the rights, property or safety of Trip Zen, our customers or others.
• A buyer, investor or successor in connection with a merger, acquisition, financing or sale of all or part of our business, subject to confidentiality obligations and this policy.

Our service providers may use personal data only to provide their services to us, in line with their contractual commitments. Where a provider loads directly in your browser, its own privacy policy also describes its practices: Google (opens in new tab), Plausible (opens in new tab) and Cloudflare (opens in new tab).

Trip Zen and our service providers may store and process personal data in countries other than the one where you live, and those countries may not offer the same level of data protection.

When personal data moves across borders, we transfer it in line with applicable law. This includes respecting any restrictions notified under India's Digital Personal Data Protection Act, 2023 and, where the EU or UK GDPR applies, using appropriate safeguards such as adequacy decisions or standard contractual clauses.

To learn more about the safeguards that apply to your data, email [email protected] or use our Contact page.

We keep personal data only for as long as we need it for the purposes described in this policy, unless the law requires or permits a longer period.

• Enquiries and applications: kept while we are in discussion with you and for a reasonable period afterwards, so we can follow up, keep an accurate record of our relationship and handle later questions or claims. If your business signs a licensing agreement, relevant records are kept for the term of that agreement and any retention period it requires.
• Newsletter subscriptions: kept while you are subscribed. If you unsubscribe, we keep a minimal record of your email address and the date you unsubscribed so we can respect your choice.
• Cookie choices: stored in your browser for 180 days. Attribution details in session storage are cleared when your browsing session ends.
• Security and server logs: kept for a limited period for troubleshooting and to detect abuse.

When we no longer need personal data, we delete it or anonymize it so it can no longer be linked to you.

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse or alteration, including:

• Encrypted HTTPS connections between your browser and our website.
• Salted hashing of IP addresses before storage, and hashed tokens for newsletter confirmation and unsubscribe links.
• Authenticated, role-based access to enquiry records, limited to team members who need it.
• Rate limiting, input validation and bot protection on public forms.
• Redaction of passwords, tokens and similar secrets from application logs.

No method of transmitting or storing data is completely secure, so we cannot promise absolute security. If a personal data breach affects you, we will notify you and the relevant authorities where the law requires us to.

To report a security concern, follow the responsible disclosure process on our Security page.

Depending on the law that applies to you, including India's Digital Personal Data Protection Act, 2023 and, where applicable, the EU or UK General Data Protection Regulation, you may have the right to:

• Access: ask whether we process your personal data, receive a copy of it and learn how it is used and with whom it is shared.
• Correction: ask us to correct inaccurate data, complete incomplete data or update it.
• Deletion: ask us to erase your personal data when it is no longer needed or you withdraw consent, unless we must keep it by law.
• Objection and restriction: object to processing based on legitimate interests, including direct marketing, or ask us to restrict processing in certain circumstances.
• Withdrawal of consent: withdraw consent for analytics, the newsletter, marketing or any other consent-based processing at any time. Withdrawing consent is as easy as giving it.
• Portability: receive the data you provided to us in a structured, commonly used, machine-readable format, where the law provides this right.
• Grievance redressal and nomination: where India's Digital Personal Data Protection Act, 2023 applies, have your grievances addressed by us, and nominate another person to exercise your rights in the event of your death or incapacity.
• Complaint to a regulator: complain to a data protection authority, such as the Data Protection Board of India after using our grievance process, or a supervisory authority in the European Union or United Kingdom.

1. 1

   Send us your request

   Email [email protected] or use our Contact page. Tell us which right you want to exercise and the email address you used on our website.

2. 2

   Confirm your identity

   We may ask for information to confirm that the request comes from you, such as a reply from the email address in our records. We use it only to handle your request.

3. 3

   Receive our response

   We respond within the time the applicable law requires. If we cannot fully meet your request, for example because we must keep certain records by law, we explain why.

To stop marketing emails straight away, use the unsubscribe link in any newsletter email. To change analytics choices, use Cookie settings in the website footer.

Exercising your rights is free. Where the law allows, we may decline requests that are manifestly unfounded or excessive.

This website is intended for businesses and professionals. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, contact us and we will delete it.

We may update this Privacy Policy to reflect changes to our website, our practices or the law. When we do, we revise the "Last updated" date at the top of this page.

If a change materially affects how we use personal data you have already given us, we will take reasonable steps to let you know, such as by email, and ask for your consent where the law requires it.

If you have questions about this policy or how Trip Zen handles personal data, or you want to raise a grievance, email [email protected] or use our Contact page. Mention "privacy" in your message so it reaches the right team.

Where the law requires us to designate a contact person for privacy questions or grievances, that person can be reached through the same channels.