WhatsApp Notification Privacy Policy (Addendum)
Scope of This Addendum
This policy applies to any user who consents to receive order-related messages through WhatsApp. It is relevant for:
- EU/EEA users, under the GDPR
- U.S. residents, especially in California, Virginia, Colorado, Connecticut, and Utah
Categories of Data Collected
We collect the following categories of personal data for WhatsApp-based communication:
Identifiers: Phone number, IP address
Commercial Information: Booking reference and itinerary
Internet/Network Activity: Device information, language preference
Inferences (not collected): No profiling or behavioral analytics applied
Purpose and Legal Basis for Processing
- GDPR (EU/EEA Users): Processing is based on your explicit consent (Art. 6(1)(a) GDPR), collected via a checkbox at checkout.
- CCPA/CPRA (U.S. Users): Processing is done only for operational/transactional purposes; we do not sell or share your personal data within the meaning of the CCPA/CPRA.
Use of WhatsApp and Your Rights
We use WhatsApp exclusively for:
- Booking confirmations
- Travel updates and operational alerts
- Customer support messages
We do not use WhatsApp to send marketing messages unless you separately opt in.
Disclosure of Personal Information
- We share your information with Meta Platforms Ireland Ltd. (WhatsApp Business API provider), who processes it under a data processing agreement.
- For U.S. users, this constitutes a service provider relationship under the CCPA/CPRA.
Data Transfers and Safeguards
- For EU/EEA users, any data transferred outside the EEA (e.g., to Meta in the U.S.) is protected by Standard Contractual Clauses (SCCs).
- For U.S. users, data is handled according to state-level privacy laws requiring reasonable security measures.
Data Retention
- We retain your WhatsApp consent and communication logs for up to 3 years for auditing and compliance.
- We do not retain message content beyond the operational purpose.
Your Rights
Under GDPR (EU/EEA Users):
- Access, rectification, erasure, restriction, objection, data portability, withdrawal of consent
Under U.S. Laws (e.g., California, Virginia):
- Right to know categories of data collected and shared
- Right to request deletion
- Right to opt out of sale or sharing (not applicable—we do neither)
- Right to non-discrimination
You can opt out of WhatsApp communications at any time by replying “STOP” in the chat or contacting us at [email protected].
Security
We implement industry-standard technical and organizational safeguards, including:
- Secure API messaging infrastructure
- Access control to WhatsApp accounts
- Consent audit logging
- Use of WhatsApp only through official and secured business systems
Contact Information
For privacy inquiries or to exercise your rights, contact us at [email protected].
Additional Notices for U.S. Residents
Under California law, we are required to disclose:
- No Sale or Sharing of Personal Information
- No Use of Sensitive Personal Information for Profiling
- No Automated Decision-Making Involving WhatsApp Data
You may designate an authorized agent to make a request on your behalf under the CCPA/CPRA by submitting proof of identity and written authorization.
Reference and Integration
This addendum is an integral part of our main Privacy Policy, which includes additional information about cookies, user rights, data transfers, and your legal recourse.
