Travinora

Travinora — Privacy Policy

Last Updated: July 30, 2026

Effective Date: July 30, 2026

Introduction

This Privacy Policy explains how Travinora, a unit of CalmGetaways Travel and Tourism L.L.C-FZ ("Travinora," "we," "us," or "our"), collects, uses, discloses, and protects personal data when you access or use the Travinora platform, currently hosted at https://travinora.com/ and its successor official domain(s) (the "Platform").

This Policy should be read together with our Terms of Use. By using the Platform, you acknowledge that your personal data will be processed as described in this Policy. If you do not agree with this Policy, you should not use the Platform.

We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") and, where applicable to users located in the European Economic Area or United Kingdom, the General Data Protection Regulation ("GDPR"), and other applicable data protection laws.

1. Who This Policy Applies To

This Policy applies to:

  • Visitors browsing the Platform without an account;
  • Registered users who create an account to build, save, or share itineraries; and
  • Individuals whose data we receive indirectly, such as recipients of a shared itinerary link or collaborators invited to a trip.

2. Information We Collect

2.1 Information You Provide Directly

  • Account information: name, email address, password (if applicable), and profile details you choose to add.
  • Itinerary content: trip names, destinations, dates, activities, notes, and any other content you enter into the itinerary builder.
  • Communications: information you provide when you contact our support or legal team, including the content of your message.
  • Shared content details: names, contact details, or notes you choose to include when sharing or collaborating on an itinerary with others.

2.2 Information Collected Automatically

  • Usage data: pages viewed, features used, itinerary interactions, referral source, and timestamps.
  • Device and technical data: IP address, browser type and version, operating system, device identifiers, and general connection information.
  • Approximate location data: derived from your IP address or, where you grant permission, from device-level location services, used to power mapping, routing, and travel-time features.
  • Cookies and similar technologies: as described in Section 6 below.

2.3 Information from Third-Party Services

  • Authentication data: when you register or log in via a third-party authentication service provider, we receive account identifiers and basic profile information (such as name and email) needed to create and manage your Travinora account.
  • Booking-related data: if you proceed to book a tour or activity through an affiliated tour operator or booking partner, that partner may share limited information back with us (e.g., confirmation that a booking was completed) for the purpose of tracking referrals and improving the Platform. We do not receive or store your full payment card details from these transactions.
  • Mapping and location-service data: aggregated or derived data returned by third-party mapping and location-data services we use to calculate travel times and routes.

2.4 Information We Do Not Intentionally Collect

We do not knowingly collect sensitive personal data (such as health information, religious beliefs, or biometric data) through the Platform, and we ask that you do not include such information in itinerary notes, shared content, or communications with us.

3. How We Use Your Information

We use personal data for the following purposes:

  • Providing the Service: Creating and managing your account, saving and displaying itineraries, generating travel-time estimates and conflict alerts.
  • Enabling sharing features: Displaying shared itineraries to designated recipients or collaborators.
  • Facilitating bookings: Arranging or referring you to tour and activity bookings through affiliated operators.
  • Communications: Responding to support requests, sending account or transactional notices, and (where you opt in) marketing updates.
  • Improving the Platform: Analyzing usage patterns, diagnosing errors, and developing new features.
  • Security & fraud prevention: Detecting and preventing unauthorized access, abuse, or violations of our Terms of Use.
  • Legal compliance: Meeting our obligations under UAE law, responding to lawful requests from authorities, and enforcing our Terms of Use.

Where the GDPR or a similar framework applies to you, we rely on one or more of the following legal bases: performance of a contract with you, your consent (e.g., for marketing communications or location permissions), our legitimate interests (e.g., improving and securing the Platform), and compliance with legal obligations.

4. How We Share Your Information

We do not sell your personal data. We may share personal data in the following circumstances:

  • With third-party service providers who support our operations, including authentication service providers, mapping and location-data providers, image content providers, hosting and infrastructure providers, and analytics providers — each acting under contractual obligations to protect your data and use it only for the purposes we specify. We do not publicly disclose the specific identity of individual technology or booking partners we work with, as this information is treated as confidential and proprietary to our business.
  • With affiliated tour operators and booking partners when you choose to book a tour, activity, or experience through the Platform, to the extent necessary to complete or facilitate that booking.
  • With other users you choose to share an itinerary with, or who you invite to collaborate on a trip.
  • With professional advisors such as legal counsel, auditors, or insurers, where necessary for our legitimate business purposes.
  • With regulators or authorities where required by UAE law, court order, or to protect our rights, property, or safety, or that of our users or the public.
  • In connection with a corporate transaction, such as a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

5. International Data Transfers

Given the nature of a travel platform, your personal data may be transferred to and processed in countries other than your country of residence, including the United Arab Emirates and countries where our third-party service providers operate. Where such transfers occur, we take reasonable steps to ensure an adequate level of protection is applied, consistent with the requirements of the UAE PDPL and, where applicable, the GDPR (for example, through contractual safeguards with our service providers).

6. Cookies & Similar Technologies

We use cookies and similar tracking technologies to:

  • Keep you logged in and remember your preferences;
  • Understand how the Platform is used so we can improve it; and
  • Support core functionality such as itinerary builder session state.

You can control cookies through your browser settings; disabling certain cookies may limit some Platform functionality. Where required by applicable law, we will request your consent before placing non-essential cookies and provide a mechanism to manage your preferences.

7. Data Retention

We retain personal data for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

  • Account and itinerary data is retained for as long as your account remains active, and for a reasonable period afterward in case you wish to reactivate it, unless you request earlier deletion.
  • Shared itinerary content may persist beyond account deletion where it has already been shared with and saved by another user, or remains accessible via a previously distributed link.
  • Transactional and communication records are retained as needed to comply with applicable legal, accounting, or regulatory retention requirements.

8. Data Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encrypted credential storage, access controls, and secure session handling. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate or incomplete personal data;
  • Delete your personal data, subject to legal or contractual retention requirements;
  • Object to or restrict certain processing activities;
  • Withdraw consent where processing is based on consent (e.g., marketing communications or optional location permissions), without affecting the lawfulness of processing before withdrawal; and
  • Data portability, where applicable, to receive a copy of your data in a structured, commonly used format.

To exercise any of these rights, contact us using the details in Section 13. We will respond within the timeframe required by applicable law. We may need to verify your identity before actioning a request.

10. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under 18 years of age, consistent with the eligibility requirements in our Terms of Use. If we become aware that we have inadvertently collected personal data from someone under 18, we will take reasonable steps to delete it.

The Platform contains links to, and integrations with, third-party websites and services (including affiliated booking partners). This Policy does not apply to those third parties, and we encourage you to review their respective privacy policies before providing them with personal data. We are not responsible for the privacy practices of third parties.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will update the "Last Updated" date above and, for material changes, provide additional notice through the Platform or by email where appropriate. Your continued use of the Platform after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Legal Entity: CalmGetaways Travel and Tourism L.L.C-FZ (operating Travinora as a unit of the company)

Registered Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates

Email: legal@travinora.com

If you are not satisfied with our response, you may also have the right to lodge a complaint with the UAE Data Office or the relevant supervisory authority in your jurisdiction of residence.

By using the Travinora Platform, you acknowledge that you have read and understood this Privacy Policy.