Privacy Policy

TourOmni owns and operates the TourOmni Platform that connects you ("user", "you", or "your") with travel agencies, destination management companies (DMCs), their team members, suppliers, and the travellers they serve, and allows you to rely on the TourOmni Services. Remember that your access and use of the TourOmni Platform and any Services is at all times subject to our Terms of Service ("Terms"), which incorporates this Privacy Policy. Any terms we use in this Privacy Policy without defining them have the definitions given to them in the Terms.

We respect the privacy of your personal information. We are committed to complying with this privacy policy ("Privacy Policy"), which describes what personal information we collect about you and others, including how we collect it, how we use it, with whom we may share it, and certain rights you have regarding your personal information that we collect or hold about you. By using the term "personal information" in this Privacy Policy, we mean information from or about you that can be used to uniquely contact, identify, or locate you.

Additional terms may apply to you based upon the state or country in which you reside. Please see the region or state specific sections that may be included below to learn more about such additional terms and rights.

Privacy Policy scope

This Privacy Policy applies to your use of the TourOmni Services, as well as when you contact us, use our social media pages or marketing activities, or otherwise interact with us and the TourOmni Services.

TourOmni determines the purposes and means of the processing of your personal information as described in this Privacy Policy and therefore acts as a "data controller" (or equivalent/similar terms under applicable data privacy laws) of such information. We may share your personal information with our affiliates and conduct processing activities as controllers or joint controllers for the purposes set out in this Privacy Policy.

In certain circumstances, there may be more than one data controller processing your personal information. For example, a Tenant (travel agency or DMC) may also act as a data controller over the customer and traveller data it manages within the Platform. In these situations, we act as an independent data controller over our processing activities. This means we determine how your personal information will be processed independently from the other data controllers. The other data controllers have their own obligations under applicable data privacy laws and the processing of your personal information by those other data controllers is governed exclusively by the terms and conditions or privacy policies of those third parties. TourOmni is not responsible for other data controllers' processing activities, and you should contact them directly for questions about how they process your personal information and about how to exercise your privacy rights in relation to such processing.

This Privacy Policy does not apply to certain processing activities where we are not the controller. For example, where TourOmni processes personal information as a processor or service provider on behalf of our users who are Tenants and Suppliers. When we act as a processor or service provider, the privacy policy of the Tenant or Supplier who uses our Services applies, instead of this Privacy Policy. If you have concerns about personal information that we process on behalf of a Tenant or Supplier, or wish to exercise your privacy rights regarding such personal information, please contact the Tenant or Supplier directly.

If you have any questions about how TourOmni processes your personal information, please see the "Contact Us" section below.

TourOmni uses Google APIs to offer services like calendar integration, mapping, bot prevention, and AI-powered features. Data accessed via these APIs is subject to the Google API Services User Data Policy including the Limited Use requirements. You can learn more about these policies in our Google Services Notice.

TourOmni uses Meta Platform services to provide unified messaging (WhatsApp Business API, Facebook Messenger, Instagram DMs) and optional single sign-on authentication (Meta Login). Data accessed via these APIs is subject to the Meta Platform Terms and WhatsApp Business Solution Terms. You can learn more in our Meta Services Notice.

Information we collect

TourOmni collects information (including personal information) from and about users of the TourOmni Services directly when a user provides it to us, from third-party sources, and automatically when a user accesses the TourOmni Platform and/or uses the TourOmni Services. TourOmni has several primary user types: Tenants (travel agencies and DMCs), Team Members, Suppliers, and Travellers/Customers. The type of personal information that TourOmni collects varies by user as specified below.

Information you provide us

Tenants (travel agencies and DMCs)

Tenants use the TourOmni Services to manage their travel business. We collect information that Tenants and their administrators provide to us including:

• Personal information: name, email, phone number, address, account user credentials, passwords, and other personal information.
• Business information: company name, business address, phone number, email address, company website, social media accounts, calendars, emails, and other business and travel related information.
• Financial information: invoice amounts, line-item breakdowns, payment status, deposit schedules, subscription billing details processed by our payment providers (we do not store full card numbers), employee payroll data including salary, deductions, and payslip history, and bank account information for employee payroll disbursement (stored encrypted).
• Traveller client information: client's, and their family members' and other travel companions', name, email, phone number, address, date of birth, passport information (number, nationality, issuing country, expiry date), dietary requirements, medical or mobility needs, travel preferences, emergency contact information, and other traveller client related information input by the Tenant into the TourOmni Platform.
• Employee information: employee records including full name, job title, department, employment status, role assignments, and permission settings within the organisation.

Team members (employees and consultants)

Team Members access the TourOmni Services under permissions granted by their Tenant. We collect information that Team Members provide to us including:

• Personal information: name, email, phone number, account user credentials, job title, department, and other personal information.
• HR and payroll information: salary, deductions, payslip history, bank account information for payroll disbursement (where the HR module is enabled by the Tenant).

Travellers and customers

TourOmni provides traveller-facing features that allow Travellers to interact with their travel agency through journey links, quotation approval pages, client portals, and payment pages. We collect information that Travellers provide to us including:

• Personal information: name, email, phone number, address, date of birth, passport information, dietary requirements, medical or mobility needs, travel preferences, emergency contact information, and other personal information regarding the Traveller and any family members and/or companions travelling with them.
• Financial information: payment method details to authorise bookings and process invoice payments (card data is handled directly by our payment providers under PCI-DSS compliance; we do not store full card numbers).
• Travel information: travel preferences, destination, travel dates, group size, budget details, and other travel related information.

Suppliers

Suppliers use the TourOmni Services to connect with Tenants via a dedicated supplier portal. We collect information that Suppliers provide to us including:

• Personal information: name, email, phone number, account user credentials, and other personal information of the authorised Supplier representative.
• Business information: business name, address, phone number, company website, and other business and travel related information.
• Rate sheets and offerings: information, images, documents, and other materials regarding the Supplier's travel-related offerings, services, and products (e.g., accommodation, ground transport, tours, activities), including rate sheets in PDF, CSV, or image formats processed by AI extraction.

Third-party provision of information

The TourOmni Platform is designed to connect Tenants, Team Members, Travellers, and Suppliers. As a result of those connections, others may be able to input personal information about you, including other users of the TourOmni Platform. For example, a Tenant can input personal information regarding Travellers in order to use and benefit from the TourOmni Platform. Tenants may also input or process personal information about family members and other travel companions in connection with bookings. If you input information about others into the TourOmni Platform, you must only do so if you have first provided sufficient notice and received any required permissions, and have an appropriate legal basis if required by applicable law.

We also receive personal information about you from other third parties where you have provided consent or as permitted by applicable law. We protect and process personal information obtained from third parties as described in this Privacy Policy, consistent with any additional restrictions imposed by the source of the information. Our third-party sources may vary over time and depend upon how you use the TourOmni Platform. For example, we receive information from:

• Linked third-party services. If you choose to sync a non-TourOmni account/service (e.g., Google Calendar, Microsoft Outlook, email, Meta Login, WhatsApp Business, or a bank account) with your TourOmni account, we will receive information from that account/service according to your settings with that account/service.
• Supplemental information and identity verification providers. We may work with certain third parties to help us verify your identity, the specifics of your business, and/or supplement the personal information you have provided and ensure the accuracy of your personal information.
• Customer support providers. We receive personal information about you or your interaction with the TourOmni Platform from certain third parties for troubleshooting purposes.

Automatic collection of information

TourOmni and our service providers automatically collect information, including personal information, from users when they interact with the TourOmni Services, including:

• Device information. Information about your device(s) such as IP addresses, log information, error messages, device type, and unique device identifiers. For example, we may collect IP addresses from you as part of our sign-in and security features.
• Usage information. Information about your use of the TourOmni Platform, such as the pages you viewed, the Services and features you used or interacted with, your browser type, and details about any links or communications with which you interacted.
• Session identifiers. Authentication tokens stored in HTTP-only, SameSite cookies for session management and security.
• Audit logs. Records of who accessed or modified which records and when, retained for security and compliance purposes.
• Communication interaction data. Information from email providers, communication providers, and social networks, such as your interactions with our email or other communications (e.g., whether you open and/or forward emails).
• Error reports and diagnostics. Performance diagnostics and error reports to help us identify and resolve issues with the TourOmni Platform.

Cookies and other technologies

We and our service providers use cookies and other technologies (collectively "Cookies") to collect information about you so we can provide the experiences you request, recognise your visit, track your interactions, and improve your and other users' experiences.

The TourOmni Platform uses strictly necessary cookies for session management and security (HTTP-only, SameSite). We do not use third-party advertising or tracking cookies on the application. Our marketing website may use analytics tools to measure page performance; these do not identify individual users. Google reCAPTCHA is used on public-facing forms to prevent automated abuse and is subject to Google's own privacy policy.

You have control over some of the information we collect from Cookies and how we use it. Please see the "Your Personal Information Rights and Choices" section below for more information.

Please be advised that certain third parties that are beyond the scope of this Privacy Policy may collect information in connection with our Services. We are not responsible for the acts or omissions of such third parties.

How we use your personal information

TourOmni uses your personal information in a number of ways or as otherwise described at the time of collection. This includes, but is not limited to:

• Operating and providing the TourOmni Services, including CRM, itinerary generation, quotation building, booking management, invoicing, and payment collection
• Creating and managing your accounts
• Personalising and improving our Services, user experience, and our business
• Communicating with you and for customer service-related purposes
• Security purposes, including monitoring, risk assessment, addressing integrity and security issues related to the Services, and fraud and crime prevention and detection
• Sending information that you request from us, including responding to enquiries or requests for information about or from us as well as sharing updates with you
• Promotional, marketing, and advertising related purposes
• Operating the unified messaging inbox (WhatsApp Business, Facebook Messenger, Instagram DMs) and routing inbound and outbound messages
• HR and payroll management, including employee records, leave management, and payslip generation
• Other business purposes, including, without limitation, market, product, and service research and development, analytics, verifying your identity, investigating complaints, and dispute resolution
• Complying with legal obligations, law enforcement, and legal processes, and to protect our rights, privacy, safety or property, and/or that of our affiliates, users, business partners, service providers, or other third parties
• Artificial Intelligence (AI) and automated processing related purposes, such as itinerary generation, supplier rate sheet extraction, lead parsing, and providing a more personalised and enhanced experience. PII is masked before transmission to AI providers where technically feasible

How we share your personal information

We do not sell your personal information. We may share and disclose your personal information to:

• Service providers and third-party processors to provide the TourOmni Services and for the purposes set out in this Privacy Policy. Such third-party providers perform functions such as payment processing (Stripe, PayPal, PayHere), cloud infrastructure (Amazon Web Services), AI processing (OpenAI, Google Gemini, Anthropic Claude, OCR.space), messaging (Meta WhatsApp Business API, Facebook Messenger, Instagram), email marketing (Mailchimp, Brevo), calendar integration (Google Calendar, Microsoft Outlook), hotel and travel APIs (Amadeus, Sabre, Agoda, Stuba), mapping services (Google Maps Platform), bot prevention (Google reCAPTCHA), and authentication (Meta Login). All providers are contractually bound to process data only as instructed and to maintain appropriate security standards.
• Professional advisors, such as lawyers, auditors, bankers, and insurers, in the course of the professional services they render to us.
• Law enforcement, in response to a subpoena or court order, or for other legal purposes such as to establish or exercise our legal rights, to assert or defend against legal claims, or if we believe such disclosure is necessary to investigate, prevent, or take other action regarding actual or suspected illegal or fraudulent activities or potential threats to the physical safety or well-being of any person.
• Third parties in connection with a corporate transaction, such as a merger, asset sale, financing, investment, liquidation, bankruptcy, or dissolution during the course of such transaction. In any such transactions, your personal information is a company asset that may be sold or transferred to third parties.

Your personal information rights and choices

We provide all users with the following options to manage the privacy of their personal information. Depending on your jurisdiction (including GDPR, UK GDPR, Australian Privacy Act, and similar frameworks), you may have additional rights.

• Update your privacy settings. You may update your privacy settings by visiting your account settings within the TourOmni Platform.
• Correct your personal information. You can edit and correct certain personal information at any time by changing it in your account profile.
• Access your personal information. You may request a copy of the personal information we have about you by contacting us as set forth below in the "Contact Us" section.
• Delete your personal information. You may ask us to delete your personal information by contacting us as set forth below in the "Contact Us" section.
• Data portability. You may request to receive your data in a structured, machine-readable format where technically available.
• Restriction of processing. You may request that we limit processing of your data in certain circumstances.
• Objection. You may object to processing based on legitimate interest, including direct marketing.
• Consent withdrawal. You may withdraw any consent previously given, without affecting the lawfulness of prior processing.
• Cookies and other tracking technologies. You can manage browser Cookies through your browser settings. The "Help" feature on most browsers will tell you how to prevent your browser from accepting new Cookies, how to have the browser notify you when you receive a new Cookie, how to block Cookies, and when Cookies will expire. If you block all Cookies on your browser, neither we nor third parties will transfer Cookies to your browser. If you do this, however, you may have to manually adjust some preferences every time you visit the TourOmni Platform and some Services and features may not work.
• Manage marketing communications from us. To update your marketing communication preferences, you can go to your account settings or contact us as set forth below in the "Contact Us" section. You may also unsubscribe using the link found at the bottom of all marketing and promotional emails.

To exercise any of these rights, email [email protected] with sufficient information to identify your account. We will respond within 30 days. Some requests may be limited where retention is required by law or to protect the legitimate interests of other parties.

Please note: an automated data export mechanism is not currently available within the platform. Export requests are handled manually by our team within the 30-day response window.

Security and retention of personal information

We use reasonable safeguards that are designed to protect the security of your personal information. These include:

• Encryption at rest: sensitive configuration values, API credentials, and personal identifiers are encrypted in the database.
• Encryption in transit: all data is transmitted over TLS. File download links are short-lived and cryptographically signed.
• Password security: user passwords are hashed using bcrypt and are never stored in plain text.
• Multi-factor authentication: TOTP-based MFA is mandatory for all administrator accounts.
• Role-based access control: each team member accesses only the modules and records permitted by their assigned role.
• Tenant isolation: each subscribing agency operates within a logically isolated data environment. Cross-tenant data access is architecturally prevented.
• Session security: authentication sessions use HTTP-only, SameSite cookies with a 120-minute inactivity timeout.
• Audit logging: all significant data access and modification events are logged and retained for 90 days.
• PII masking for AI: where technically feasible, personally identifiable information is masked before data is sent to AI processing services.

However, despite these controls, we cannot completely ensure or guarantee that unauthorised access, hacking, data loss, or other breach will never occur. In the event of a breach, we will take reasonable steps to investigate the situation and, where appropriate, notify affected individuals as required by applicable laws and regulations.

We retain data for as long as it is necessary to provide the Services or in accordance with applicable data retention policies. The following retention periods apply:

Upon your written request we will delete personal information stored by us; however, we may be required to maintain your personal information for as long as necessary to: (i) comply with our legal or regulatory compliance needs (e.g., maintaining records of transactions you have made with us); (ii) exercise, establish, or defend legal claims; and/or (iii) protect against fraudulent or abusive activity on our Services.

There may be occasions where we are unable to fully delete, anonymise, or de-identify your personal information due to technical, legal, regulatory compliance, or other operational reasons. Where this is the case, we will take reasonable measures to secure your personal information from any further processing until such time as we are able to delete, anonymise, or de-identify it.

Children

Our Services are not intended for or directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we may have collected personal information from a child under 13, please contact us. Traveller data relating to minors may be held within Tenant booking records where provided by the Tenant; in such cases the Tenant is responsible for obtaining appropriate consent from the relevant guardian.

International data transfers

We process and store your personal information in accordance with and as permitted by applicable laws and regulations. TourOmni operates globally and uses cloud infrastructure and third-party services that may process data outside your country of residence, including in the United States and European Union. Some of these countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective).

When we transfer, store, or process personal information outside of your jurisdiction, we take appropriate safeguards to require that your personal information remain protected in accordance with this Privacy Policy and applicable law. Some of these recipients of your personal information may be located in countries for which the European Commission and/or UK Government (as and where applicable) have issued adequacy decisions, which means these countries are recognised as providing an adequate level of data protection.

Other recipients of your personal information are located in countries outside the EEA and/or the UK that are not the subject of an adequacy decision. In these cases, we may use the Standard Contractual Clauses approved by the European Commission or, as may be applicable, the International Data Transfer Agreement approved by the UK Government, to help ensure your personal information is protected. For more information on the transfer safeguards we rely on, please contact us as set forth below in the "Contact Us" section.

Privacy Policy updates

From time to time, we may change or update our Privacy Policy. We reserve the right to make changes or updates at any time. If we make material changes that meaningfully impact the way we process your personal information, we will notify you by posting a notice on the TourOmni Platform, by sending you an email, or by other means consistent with applicable law.

You can see when this Privacy Policy was last updated by checking the "last updated" date at the top of this Privacy Policy. Please review this Privacy Policy periodically to stay informed about how TourOmni protects your privacy.

Contact us

If you have any questions about our privacy practices, or if you wish to exercise any of your choices or rights in connection with your personal information, please contact us at:

If you are located in the European Economic Area and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local data protection supervisory authority.