Privacy Policy

This policy explains what personal data HOTAC ("we", "us") handles when you use this booking portal, why, who sees it, and what choices you have. The portal is for travel agencies and corporate travel teams, so most of the data in it is about the people you travel and book for as well as about you.

What we collect

Your account. Your name, work email address, phone number, role and the agency you belong to, and your password, which is stored in hashed form. Your agency's administrator creates and manages accounts.

Bookings and travellers. To search and book we process the details you enter: guest and passenger names, titles and ages; the booking contact's email address and phone number; special requests; and, for flights, the passport number and expiry date, date of birth and nationality that airlines require. We also keep your booking references, prices, invoices and vouchers, and the cost centres, account codes and labels your agency uses.

Payments. Card payments are taken on the payment gateway's own secure page. We do not receive or store your card number. We receive the outcome of the payment, such as approved, declined or cancelled, together with a transaction reference and the gateway's message. Bookings made on hold or on credit are recorded against your agency's account.

How you use the portal. The searches you run (kept to let you repeat recent ones, and counted per agency for reports), when you sign in, the IP address of a booking request, and technical logs of errors with a request reference so problems can be traced. We do not use advertising or third-party analytics cookies.

AI search. If you use the AI search box, the text you type is sent to an AI service provider so it can be turned into search settings. Please don't type personal data into it that you would not enter in the ordinary search form.

Cookies and local storage

We use only what the portal needs to work:

• a session cookie that keeps you signed in. It is encrypted and not readable by scripts, and ends after about 8 hours;
• short-lived cookies for a sign-in code or password reset that is in progress;
• an optional "trusted device" cookie, so you are not asked for a sign-in code again on a device you have already verified, for the period set for your account;
• your language and display preferences, and your last search form entries and selected service, which are kept in your own browser.

Why we use it

• to sign you in, keep your account secure and apply your agency's permissions;
• to search, price, book, change and cancel travel, and issue vouchers and invoices;
• to take payment and settle your agency's account;
• to support you, investigate problems and prevent fraud and misuse;
• to give your agency's administrators the usage and booking reports they are entitled to;
• to meet legal, tax and accounting obligations.

Who we share it with

• Suppliers. Hotels, airlines and the intermediaries who connect us to them receive the traveller and booking details they need to make and honour a booking.
• Service providers. The platform that processes bookings and accounts for us, hosting and infrastructure providers, the payment gateway and the AI provider mentioned above, each only for the purpose we engage them for.
• Your agency. Other people in your agency can see bookings according to their role: an agent sees their own, and administrators and finance users see more.
• Authorities and advisers where the law requires it or to protect our legal rights.

We do not sell personal data.

Transfers abroad

Suppliers and some of our providers operate in other countries, so personal data may be processed outside the one you are in. Where we are responsible for that transfer we take reasonable steps to make sure the data stays protected.

How long we keep it

Booking, invoice and account records are kept for as long as needed to run your account and to meet legal, tax and accounting requirements. Your recent searches are kept for up to 90 days. Aggregated sign-in and search counts used in reports are kept for about 13 months. Sign-in and reset codes expire within minutes.

Security

Connections to the portal are encrypted, sessions are encrypted and expire, access depends on your role, and repeated sign-in and reset attempts are limited. No system is completely secure, so please keep your password private and tell us straight away if you think your account has been misused.

Your choices and rights

Depending on the law that applies to you, you may ask to see the personal data we hold about you, correct it, have it deleted, or object to certain uses. Because accounts and bookings belong to your agency, it is often quickest to ask your agency's administrator first; you can also contact us directly using the details below. We may need to keep some records where the law requires it.

If you enter other people's details, such as a traveller's passport information, you are responsible for having the right to do so and for letting them know how it will be used.

Children

The portal is for professionals and is not aimed at children. Children's names and ages are entered by an adult only where a booking needs them.

Changes to this policy

When we change this policy we will update the date at the top of this page.

Contact us

HOTAC, info@hotac.travel, +971 4 295 2950.