TRVLfor travel agencies
EN
ΕλληνικάEnglish
Back to home

B2B TRVL AIR Privacy Policy

Last updated: 27 October 2026

1. Data Controller

  1. Details: The data controller is TWENTYONE WEST COAST TRVL STORIES I.K.E., General Commercial Registry (GEMI) number 191601903000 ("TRVL" or "we"). For any personal data matter: welcome@trvl.gr.
  2. Scope: This Policy covers the b2b.trvl.gr site and the B2B TRVL AIR platform (the "Platform"), meaning the data of travel agencies and their representatives.
  3. Traveller Data: For the details of end travellers that an Agency enters into the Platform, the Agency is the Data Controller and TRVL acts as Data Processor, in accordance with section 10 of the Terms of Use.

2. What Data We Collect

  1. Interest Form: Agency name, VAT number (AFM), EOT Special Operating Licence (MHTE number), full name of the contact person, city, email, phone, the plan you are interested in and your message.
  2. Agency Account: Details of the Agency's users (full name, email, role), booking history, markup settings, subscription billing details and the documents issued through the Platform.
  3. Technical Data: IP address, device and browser type, and date and time of access, recorded automatically by our servers for security and abuse prevention.

3. Purposes & Legal Bases

  1. Responding to an Application: Communicating with you and reviewing your registration request. Legal basis: taking steps before entering into a contract, at your request (Article 6(1)(b) GDPR).
  2. Providing the Platform: Creating and managing your account, carrying out bookings, issuing documents, website and booking engine. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  3. Tax Obligations: Invoicing subscriptions and keeping the related records. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
  4. Security: Protecting the Platform from malicious or abusive use. Legal basis: legitimate interest of TRVL (Article 6(1)(f) GDPR).
  5. No Advertising: The details in the interest form are used only to contact you about your application. We do not sell or rent personal data to third parties.

4. Recipients

  1. Infrastructure Providers: Server hosting and email delivery providers, which process data only on our behalf and under contract.
  2. Certified Invoicing Provider: For the Plus and Ultra plans, document data is transmitted to the Certified Electronic Document Issuing Provider and from there to the Greek tax authority AADE (myDATA).
  3. Accommodation & Suppliers: To carry out each booking, the necessary details are transferred to the accommodation and the corresponding wholesaler or supplier.
  4. Payment Provider: For online payments through the booking engine, payment details are processed directly by a licensed Payment Institution. The Platform does not store card details.
  5. Public Authorities: Tax, judicial or other authorities, where required by law.

5. Transfers outside the EEA

  1. Bookings Abroad: When an accommodation or supplier is located outside the European Economic Area, booking details are transferred because this is necessary to perform the booking contract (Article 49(1)(b) and (c) GDPR).
  2. Technical Services: The site loads fonts from Google Fonts and code libraries from the jsDelivr network. To load them, your browser sends your IP address to these services.

6. Retention Period

  1. Applications: Interest form details are kept for up to twelve (12) months if no cooperation follows, and are then deleted.
  2. Accounts: Account details are kept while the account is active and, after it is closed, for as long as tax legislation requires or for the defence of legal claims.
  3. Technical Records: Server logs are deleted automatically after a short period, unless they are needed to investigate a security incident.

7. Security

  1. Protection Measures: All communication with the Platform is encrypted (HTTPS). Access to data is limited to the persons who need it to provide the service, and measures are applied to prevent malicious use.

8. Cookies

  1. Essential: Used for the operation and security of the site and your account, and to remember your cookie choice. They are always on.
  2. Statistics: Show us how the site is used, so we can improve it. Activated only with your consent.
  3. Marketing: Used to measure and show our advertising. Activated only with your consent.
  4. Your Choice: On your first visit we ask you to choose. You can change or withdraw your consent at any time from the "Cookie settings" link at the bottom of every page. Your choice applies for six (6) months, after which we ask again.

9. Your Rights

  1. Rights: You have the right of access, rectification, erasure, restriction of processing, portability and objection, under the conditions of the GDPR.
  2. Exercise: Send your request to welcome@trvl.gr. We respond within one (1) month of receipt.
  3. Complaint: If you believe the processing breaches the law, you may lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

10. Changes to this Policy

  1. Notice: We may update this Policy. The date of the last update appears at the top of the page, and we inform Agencies by email of material changes.