Privacy Policy

2. Data We Collect

We may collect the following categories of personal data:

• Identity Data: Full name, date of birth, nationality, passport or ID number.
• Contact Data: Email address, phone number, mailing address.
• Account Data: Username, password (hashed), profile preferences.
• Booking Data: Tour packages booked, travel dates, passenger details, special requests.
• Payment Data: Payment method, transaction history (we do not store full card numbers).
• Technical Data: IP address, browser type, device information, cookies.

3. How We Use Your Data

• Processing and managing your tour bookings and reservations.
• Communicating with you about your bookings, updates, and promotions.
• Providing customer support and responding to inquiries.
• Improving our services, website, and user experience.
• Complying with legal obligations and regulatory requirements.
• Preventing fraud and ensuring the security of our platform.

4. Data Sharing

We may share your personal data with the following third parties only as necessary to provide our services:

• Tour operators and hotels to fulfill your bookings.
• Payment processors to process transactions securely.
• Cloud service providers (e.g., Supabase) for data hosting.
• Government authorities when required by law.

We do not sell your personal data to any third party.

5. Your Rights under PDPA

As a data subject, you have the following rights:

• Right to Access: Request a copy of your personal data.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your personal data.
• Right to Restrict Processing: Limit how we use your data.
• Right to Data Portability: Receive your data in a structured format.
• Right to Withdraw Consent: Withdraw your consent at any time.
• Right to Object: Object to processing based on legitimate interests.

To exercise any of these rights, please contact us at privacy@novatrip.co.

6. Cookies

We use essential cookies to ensure the proper functioning of our website (e.g., authentication, session management). We may also use analytics cookies to understand how visitors interact with our website. You can manage your cookie preferences through our cookie consent banner.

7. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Booking records are retained for a minimum of 5 years for regulatory compliance. You may request deletion of your account data at any time.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. These include encryption, access controls, and regular security assessments.

9. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact:

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.