1.Who we are and how to reach us
Travel4Tech (“Travel4Tech”, “we”, “us”) is a travel-technology company that builds software, AI and automation products for travel agencies and travel companies.
For any question about this policy, about how we handle personal data, or to exercise your rights, write to admin@travel4tech.com. This is our point of contact for privacy and data-protection matters, and we reply to every request within one month.
2.Our role: controller and processor
The GDPR distinguishes between whoever decides why and how personal data is used (the “controller”) and whoever processes it on the controller's behalf (the “processor”). Our role depends on the data:
- Travel4Tech as controller — for data about visitors to our website, prospective customers, and the people who hold an account in our Services (sign-in, security, billing, support and communication).
- Travel4Tech as processor — for the “Customer Data” that a travel agency or company loads into or connects to the Services: bookings, supplier invoices, traveller details, supplier contacts and similar. In that case the agency is the controller and decides what is processed and why; we process the data only on its documented instructions, under the data processing terms in our Terms of Use (Article 28 GDPR).
If you are a traveller or a supplier contact whose data is held in an agency's system, please contact that agency first. We will help the agency respond to you.
3.What personal data we process
- Website visitors: IP address and technical data in server logs (browser, device, pages requested, date and time); your language and theme preference, stored in your browser; and anything you send us when you contact us or request a demo (name, business email, company, message).
- Account holders and users: name, work email address, organisation, role in the workspace, unique account identifiers, sign-in and activity logs, and support conversations.
- Sign-in with Microsoft: the basic profile data described in section 4.
- Customer Data (as processor): booking data, supplier invoices and related documents, traveller names and details, tax identification numbers (NIF/VAT), bank account numbers (IBAN), booking references and supplier contact details.
- Data we do not seek: we do not deliberately collect special categories of personal data (Article 9 GDPR) or data about children. The Services are intended for professional use, and customers should not upload such data unless strictly necessary.
We obtain data directly from you, from your organisation's administrators, from Microsoft when you sign in and, for Customer Data, from the agency and the booking or supplier systems it connects to the Services.
4.Sign-in with Microsoft
InvoiceManager.AI lets you sign in with your Microsoft work or school account (Microsoft Entra ID) or your Microsoft account. When you do:
- We receive basic profile information that Microsoft releases after you consent: your name, email address, a unique account identifier and your organisation's (tenant) identifier. We never receive or store your Microsoft password.
- We use it only to authenticate you, to create and secure your account, and to attach your activity to the right agency workspace.
- Any permission beyond basic sign-in (for example, permissions needed to send supplier invoice requests on the agency's behalf) is shown on the Microsoft consent screen, needs your approval or your administrator's, and is used only for the function described there.
- We do not use data obtained from Microsoft for advertising, for marketing profiling or for resale, and we do not transfer it to data brokers or to anyone other than the service providers described in section 7.
- Access tokens are used only while you use the Services and are protected with security measures appropriate to the risk.
- Microsoft processes your data as an independent controller under its own privacy statement: https://privacy.microsoft.com/privacystatement
Revoking access. You can withdraw Travel4Tech's access at any time. Users can do so at https://myapps.microsoft.com (work or school accounts) or https://account.live.com/consent/Manage (personal accounts); organisation administrators can remove or restrict the app under Enterprise applications in the Microsoft Entra admin center. After revocation we stop accessing your Microsoft data and delete the associated tokens. To have your account and related data erased, email admin@travel4tech.com.
5.Why we use personal data and on what legal basis
PurposeProvide, operate, secure and support the Services and your account, including sign-in
Legal basis (GDPR)Performance of a contract (Art. 6(1)(b)). For Customer Data, the agency's instructions — we act as processor
PurposeAnswer enquiries and demo requests, and take steps before a contract
Legal basis (GDPR)Steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f))
PurposeKeep the Services and website secure, prevent fraud and abuse, diagnose errors, and improve the Services using aggregated or non-content usage data
Legal basis (GDPR)Legitimate interest in the security and improvement of our Services (Art. 6(1)(f))
PurposeSend service notices (security, changes to terms, outages)
Legal basis (GDPR)Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f))
PurposeSend information about our products to business contacts, where the law allows
Legal basis (GDPR)Legitimate interest with an easy opt-out (Art. 6(1)(f)), or consent (Art. 6(1)(a)) where the law requires it
PurposeComply with accounting, tax and other legal obligations, and respond to authorities
Legal basis (GDPR)Legal obligation (Art. 6(1)(c))
PurposeEstablish, exercise or defend legal claims
Legal basis (GDPR)Legitimate interest (Art. 6(1)(f))
Where we rely on legitimate interests we have weighed them against your rights and interests, and you may object at any time (see section 11). Where we rely on consent you may withdraw it at any time, without affecting processing that took place before.
6.Artificial intelligence and automated processing
InvoiceManager.AI and Viajis use AI to read documents, extract fields, suggest matches and prepare drafts. AI output is a suggestion: no reconciliation is marked complete, and no decision producing legal or similarly significant effects on a person is taken, without a person confirming it. We therefore do not carry out solely automated decision-making within the meaning of Article 22 GDPR. Where you interact with an AI assistant (such as Vika in Viajis) you are told that it is AI. AI output can be inaccurate and should always be reviewed.
Where we use third-party AI providers, they act as our sub-processors and receive content only to deliver the requested functionality (see section 7).
8.International transfers
We aim to keep personal data within the European Economic Area (EEA). Where a provider or its support staff operate outside the EEA, we transfer data only on a valid basis under Chapter V GDPR — an adequacy decision (for example, the EU–US Data Privacy Framework for certified US providers) or Standard Contractual Clauses with supplementary measures where necessary. You can request a copy of the safeguards at admin@travel4tech.com.
9.How long we keep data
- Customer Data: for as long as the agency's contract runs. After termination the agency can export it for 30 days; we then delete or anonymise it, and remaining backup copies are overwritten within 90 days, unless the law requires longer retention.
- Account and support data: while your account is active and afterwards only as long as needed to handle legal claims and keep required records.
- Security and server logs: up to 12 months.
- Enquiries and demo requests: up to 24 months after our last contact, unless a contract follows.
- Accounting and tax records: for the period required by law.
10.How we protect data
We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), including:
- encryption in transit, and field-level encryption (AES-256-GCM) with tokenisation of sensitive values such as tax IDs and booking references; values with no business need to reappear — email addresses, IBANs and personal names — are removed at source;
- separation between customers' data, so that one agency's data is never visible to another, enforced at several layers;
- need-to-know access control, separate permissions for reading content and for re-identifying a field, and audit logs that record events without storing the sensitive values themselves;
- automatic analysis of files before they become available, with access blocked by default if any step fails;
- human confirmation of AI-suggested results (see section 6).
If a personal-data breach occurs we notify affected customers without undue delay after becoming aware of it and, for data we control, the competent supervisory authority within 72 hours where Articles 33 and 34 GDPR require it.
11.Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased (“right to be forgotten”) in the cases provided by law;
- restrict processing in the cases provided by law;
- receive your data in a structured, commonly used, machine-readable format and have it transmitted to another provider (portability);
- object at any time to processing based on legitimate interests and to direct marketing;
- withdraw consent at any time, where processing is based on consent;
- not be subject to a decision based solely on automated processing that significantly affects you.
To exercise any right, email admin@travel4tech.com. We may ask you to verify your identity. We respond within one month, which can be extended by two further months for complex or numerous requests (we will tell you if so), and free of charge unless a request is manifestly unfounded or excessive. If your data is Customer Data, we forward your request to the agency, which is the controller, and assist it.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State where you live or work or where the alleged infringement took place. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD, https://www.cnpd.pt); in Spain, the Agencia Española de Protección de Datos (AEPD, https://www.aepd.es). The full list of authorities is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. We would appreciate the chance to address your concern first.
13.Changes to this policy
We update this policy when our Services or the law change. The date at the top shows the latest version, and we notify customers of material changes in advance by email or in the product.
14.Contact
For any question, request or concern about privacy, write to admin@travel4tech.com.