Privacy Policy

Regarding the agency account data (email, login details), HolaTrip —a product of VortexLabs— acts as the controller.

Regarding traveler data, the agency is the controller: it is the agency that collects it from its clients and decides to upload it. HolaTrip acts only as the processor, meaning it processes that data on behalf and at the instruction of the agency, for the sole purpose of organizing and displaying it. HolaTrip is not the owner of that data and does not use it for its own purposes.

From the agency and its agents: the email address and the data needed to create and manage the account.

From travelers: the name, the identity document number and the trip details (flights, hotels, insurance, transfers, excursions) extracted from the PDF documents the agency uploads. It is the agency that decides what information to include; HolaTrip does not add traveler data on its own.

The data is used to build and show the traveler their trip in a link, to generate secure access to that link, and to send the notifications the agency chooses. Traveler data is not used for advertising and is not sold.

HolaTrip processes the agency data in order to provide the service. Traveler data is processed on behalf of the agency, on the legal basis the agency has determined (usually consent or performance of the travel contract). The agency is responsible for having that legal basis.

Security is designed in layers. Measures include: encryption of information in transit and at rest; sensitive data, such as document numbers, is stored encrypted; strict isolation between agencies, so that none can see another agency information; traveler access to their trip through a signed, temporary and revocable link; automatic backups; and security event monitoring.

Because of encryption at rest, the HolaTrip team does not have travelers sensitive data in plain view during normal operation. Technical access to that data is possible only under strict controls and for a legitimate purpose, never casually.

Effective security depends both on HolaTrip technical measures and on the responsible use by the agency. HolaTrip keeps the described technical measures in place. The agency is responsible for protecting its login credentials, for having the legal basis to process its travelers data, and for verifying the data before sharing the link.

HolaTrip relies on infrastructure providers that help run the service (database and application hosting, and email delivery), which process the data on HolaTrip behalf and under contract.

The data is not sold or transferred to third parties for commercial purposes.

The data is kept while the account is active and for as long as it is needed to provide the service. The PDF documents of each trip are automatically deleted once their purpose is fulfilled. If the agency closes the account, its data is deleted, unless the law requires keeping something.

You may request to access your data, correct it, delete it, take it to another service (portability) or object to its processing. To exercise any of these rights, write to info@holatrip.app. If the data belongs to a traveler, the request is handled through the agency, which is the controller of that data.

Nothing in this policy removes the mandatory rights granted to you by the data protection law of your country of residence. If you are in the European Union, the GDPR applies; in Brazil, the LGPD; in Colombia, Law 1581; and so on in each jurisdiction. Those rules prevail where applicable.

Because HolaTrip uses cloud infrastructure, data may be stored on servers located outside your country. In those cases we seek to ensure appropriate safeguards are in place to protect it.

Only what is necessary for the session to work and to remember the language preference is used. For now no third-party advertising trackers are used.

If this policy is updated, the new version is published on this same page with its date. We recommend reviewing it from time to time.

For any question about privacy, write to info@holatrip.app.