Privacy Policy

1. Introduction

TripZynx is a tour management and distribution platform that connects tour operators, travel agents, resellers, and travellers through an integrated platform for managing tour packages, inquiries, bookings, visa applications, customer communications, and related business operations.

TripZynx also provides subscription-based access to platform features, CRM functionality, payment integrations, and white-label websites and booking pages, depending on the services enabled for each customer.

This Privacy Policy explains how TripZynx collects, uses, stores, shares, retains, and protects personal information when you visit our website, create an account, use our platform, make or manage a booking, communicate with a tour operator, or interact with our integrations and white-label services.

We are committed to protecting personal information in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, applicable National Privacy Commission issuances, and other applicable privacy laws.

By using our services, you acknowledge that you have been provided access to this Privacy Policy. Where consent is required for a particular processing activity, we will seek it through an appropriate mechanism. Using the platform does not, by itself, constitute consent to every type of data processing described in this policy.

2. Who We Are

TripZynx Co. ("TripZynx," "we," "us," or "our") operates the TripZynx platform.

This Privacy Policy applies to:

Our website at https://www.tripzynx.com and applicable subdomains.
The TripZynx dashboard and applications.
White-label websites and booking pages made available through TripZynx.
Supported integrations, including Facebook Messenger.
Subscription administration, booking-related services, and associated customer support.

Contact Information

Company: TripZynx Co.
Business address: Baguio City, Philippines
General support: [email protected]
Privacy requests: [email protected]

3. Our Role in Processing Personal Information

Our role depends on the purpose of processing and the service being used.

3.1 TripZynx account and subscription information

For information relating to our own customer accounts, subscriptions, billing, platform security, customer support, and service administration, TripZynx generally acts as a personal information controller where it determines the purposes and means of processing.

This may include information about tour operators, business owners, managers, staff, travel agents, resellers, and other registered users.

3.2 Traveller information managed by tour operators

When a tour operator uses TripZynx to collect inquiries, manage bookings, process visa applications, or communicate with travellers, the tour operator generally determines why the traveller's information is collected and how it is used.

In these circumstances, TripZynx may act as a personal information processor, handling information on the tour operator's documented instructions to provide the relevant services.

The exact role of each party depends on the processing activity. TripZynx may have separate responsibilities for activities where it independently determines the purposes of processing.

Travellers with questions about how a particular tour operator uses their information should contact that operator. We will assist with requests relating to information processed on the operator's behalf, as appropriate.

3.3 White-label websites

A tour operator or reseller may use TripZynx to publish a white-label website or booking page.

Depending on the arrangement, the website operator may determine the purposes of collecting traveller information, while TripZynx provides the underlying technology and processes information to operate the service.

The parties' respective responsibilities depend on the actual configuration, contractual arrangements, and processing activities. Each party remains responsible for the obligations applicable to its role.

4. Personal Information We Collect

The information we collect depends on how you interact with TripZynx and which features are enabled.

4.1 Account and profile information

When you register or use the platform, we may collect:

Full name.
Email address and mobile number.
Login credentials and authentication information.
Profile photograph and account preferences.
User role, company affiliation, and assigned permissions.
Information necessary to verify or administer an account.

Passwords should be stored using appropriate secure hashing methods rather than as readable text.

4.2 Business and subscription information

For tour operators, travel agents, resellers, and other business customers, we may collect:

Business name, address, logo, and contact information.
Business registration, permits, and accreditation details provided by the customer.
Subscription plan, billing period, account status, and renewal information.
Billing records, transaction references, payment status, and relevant invoices or receipts.
Tour packages, itineraries, prices, photographs, availability, travel dates, and other published content.
White-label website configuration and related account settings.

4.3 Traveller inquiries and bookings

When a traveller submits an inquiry or makes a booking through TripZynx or a connected white-label website, the information processed may include:

Traveller name and contact details.
Number of adults and children.
Destination, travel dates, itinerary, and booking preferences.
Responses to inquiry forms and special requests.
Booking references, proposals, confirmation status, and related correspondence.
Payment status and transaction references.
Other information supplied through booking forms or required to manage the requested service.

The specific information collected depends on the tour operator's configuration and the nature of the booking.

4.4 Visa applications and travel documents

Where visa management features are used, TripZynx may process applicant information and uploaded documents, including passport details, photographs, identification information, and supporting documents.

These materials may contain sensitive personal information or other information requiring heightened protection.

Such information must be processed only for legitimate, disclosed purposes and on an appropriate legal basis. Access should be restricted to authorized persons involved in the relevant application or service.

4.5 Messages and attachments

When users communicate through the TripZynx inbox or supported integrations, we may process message content, attachments, timestamps, delivery information, and other communication records needed to provide the service.

This may include communications between tour operators, their authorized staff, travel agents, resellers, and travellers.

4.6 CRM contacts and marketing information

Where CRM and email campaign features are enabled, we may process contact names, email addresses, contact lists, campaign settings, message content, delivery records, and related information supplied or generated through the platform.

Customers are responsible for ensuring that contact information they upload and marketing communications they send comply with applicable privacy and communications laws.

4.7 Support and correspondence

If you contact us for assistance, report a problem, request a demonstration, or submit a privacy request, we may collect your contact details, the information you provide, and relevant records needed to respond.

4.8 Information collected automatically

When you visit our website or use the platform, we may automatically collect technical and usage information, including:

IP address.
Browser and device type.
Operating system.
Pages visited and referring pages.
Date, time, and duration of access.
Cookie identifiers and similar technical information.
Security, diagnostic, and system logs.

We use this information, where appropriate, to operate the service, maintain security, troubleshoot errors, understand usage, and improve our website and platform.

4.9 Information received from third parties

We may receive information from:

Maya and other payment providers: payment confirmations, transaction references, payment status, and other information made available through the applicable integration.
Meta: information required to connect Facebook Pages and operate supported Messenger features.
Other platform users: traveller information entered by a tour operator, agent, or reseller to manage an inquiry or booking.
Service providers: information necessary to deliver an enabled integration or service.

We handle information received from third parties in accordance with this Privacy Policy, applicable agreements, and applicable law.

5. How We Use Personal Information

We process personal information for legitimate and disclosed purposes, including:

Creating, authenticating, and administering user accounts.
Providing tour package management, inquiries, proposals, bookings, visa workflows, CRM, messaging, and notification services.
Administering subscriptions, billing periods, payment status, renewals, and account restrictions.
Processing subscription payments through Maya and maintaining relevant transaction records.
Supporting traveller booking payments according to the applicable payment arrangement.
Communicating booking updates, billing notices, security alerts, service changes, and customer support responses.
Enabling authorized tour operators and resellers to manage their own customers and business activities.
Operating white-label websites and booking pages.
Providing customer support and resolving technical or operational issues.
Maintaining platform security, preventing fraud and unauthorized access, and enforcing our Terms of Service.
Measuring website and platform performance and improving our services.
Sending marketing communications where permitted by law and supported by an appropriate legal basis.
Complying with applicable legal, accounting, tax, and regulatory obligations.
Establishing, exercising, or defending legal claims.

We do not sell personal information.

We do not use traveller booking, inquiry, or visa information for our own marketing campaigns unless a separate, lawful purpose has been clearly disclosed and an appropriate legal basis exists.

6. Legal Basis For Processing

We process personal information only where an appropriate legal basis applies.

Depending on the circumstances, this may include:

Contractual necessity: to provide a service you requested, administer your subscription, or manage a booking.
Consent: where you have given consent for a specific processing activity and consent is the appropriate legal basis.
Legal obligation: to comply with applicable laws and regulatory requirements.
Legitimate interests: to secure, maintain, and improve our services or protect our rights, provided those interests do not override the rights and interests of the individual.
Other lawful grounds: where processing is permitted by applicable law.

Sensitive personal information, including certain information contained in visa applications, is processed only where an appropriate legal basis and the additional requirements of applicable law are satisfied.

Where processing relies on consent, you may withdraw your consent subject to applicable law. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal or processing supported by another lawful basis.

7. Subscriptions And Payments

7.1 Subscription payments

TripZynx uses Maya to collect subscription payments.

Depending on the transaction and integration, we may process subscription information such as the selected plan, billing period, payment amount, transaction reference, payment date, and payment status.

Payment credentials and card details are handled according to the relevant payment provider's integration. We do not intentionally store full payment card details where card entry and storage are handled by the payment provider. The actual implementation and information received through the integration determine the precise scope of processing.

7.2 Traveller booking payments

Traveller booking payments may be made directly to the tour operator or processed through a payment arrangement involving TripZynx.

The information TripZynx receives and the responsibilities of each party depend on the arrangement applicable to the booking.

We may process payment confirmations, transaction references, booking status, settlement information, and related records necessary to administer the transaction.

The applicable booking terms should identify the payment recipient and the arrangements for cancellations, refunds, and disputes.

7.3 Expired subscriptions and restricted access

When a subscription expires or is not renewed, TripZynx may restrict access to the account or features associated with the subscription.

An expired or restricted subscription does not automatically mean that all associated information is deleted.

Retained information remains subject to this Privacy Policy, applicable contractual arrangements, lawful retention requirements, and appropriate access controls.

7.4 Payment records

We may retain payment and billing records for accounting, tax, audit, fraud prevention, dispute resolution, and other lawful purposes.

Retention periods depend on applicable legal requirements and the nature of the record.

8. Facebook Messenger And Meta Data

Tour operators may connect Facebook Pages they are authorized to manage so that supported Messenger conversations can appear in the TripZynx inbox and be answered through the platform.

This integration uses Facebook Login and the Meta Messenger Platform.

8.1 Information received

Depending on the permissions granted and functionality used, we may receive:

Information identifying the user connecting a Facebook Page.
Information about Pages the user is authorized to manage.
Page identifiers, names, profile information, and access tokens required for the integration.
Page-scoped identifiers and profile information provided by Meta for people communicating with a connected Page.
Messages, supported attachments, timestamps, and read or delivery information made available by the integration.

8.2 How Messenger information is used

Messenger information is used to display conversations to the relevant tour operator, facilitate customer communications, and transmit the operator's replies.

We do not sell Messenger conversation data or use it to build advertising profiles for our own marketing.

Access to Messenger information should be limited according to the integration's permissions and the relevant account's access controls.

8.3 Disconnecting a Page

A tour operator may disconnect a Facebook Page through the available integration settings or remove the TripZynx app through Meta's business integration settings.

After disconnection, we stop receiving new messages through that connection and revoke or delete the associated access token, subject to applicable technical and security requirements.

Previously received messages and related records may remain subject to the relevant retention rules, legal obligations, dispute-resolution needs, and the tour operator's instructions.

For requests relating specifically to Meta-related data, follow the instructions at:

https://tripzynx.com/data-deletion

Our use of information received through Meta is subject to applicable Meta platform terms and policies.

9. Cookies, Analytics, And Advertising Technologies

TripZynx may use cookies, server logs, analytics tools, and similar technologies to operate its website, understand usage, maintain security, and measure marketing performance.

9.1 Essential cookies

Essential cookies and similar technologies may be used to maintain sessions, support authentication, protect forms, and provide core website functionality.

Disabling essential cookies may prevent some features from working properly.

9.2 Analytics

We may use analytics tools to understand website visits, traffic sources, and general usage patterns. The tools used and the information collected depend on the configuration of the relevant website or service.

Where third-party analytics tools are used, information may be processed by the relevant provider under its applicable terms and privacy policies.

9.3 Meta Pixel and white-label websites

Meta Pixel is used on the TripZynx marketing website and may be present on white-label websites or booking pages, depending on the configuration.

Where enabled, Meta Pixel may transmit information such as page-view events, browser or device information, referring information, identifiers made available by Meta, and event or page information to Meta.

Meta may use information collected through its technologies in accordance with its own policies and the applicable configuration.

We will take reasonable steps to prevent passport details, visa documents, payment credentials, and other sensitive or confidential booking information from being transmitted to Meta through unnecessary or improperly configured tracking events, URLs, or parameters.

Not every white-label page necessarily uses the same tracking configuration. The actual pages, events, and information transmitted depend on the implementation.

Where a white-label customer controls its own tracking configuration, that customer is responsible for its own activities. TripZynx remains responsible for processing activities under its control and for the services it provides.

Where required by applicable law, appropriate notices, consent mechanisms, or other controls will be implemented for cookies and tracking technologies.

You may review Meta's privacy information at:

https://www.facebook.com/privacy/policy/

We do not sell personal information. We may disclose information where necessary for the purposes described in this policy, where authorized, or where required or permitted by law.

10.1 Authorized users and business partners

Information may be made available to the relevant tour operator, authorized managers and staff, travel agents, resellers, or other authorized users according to their roles and permissions.

For example, a tour operator may access traveller information associated with its inquiries and bookings, while a reseller may access information associated with bookings it is authorized to manage.

10.2 Service providers

We may use service providers to support:

Cloud hosting and file storage.
Real-time messaging.
Email delivery.
Maps and location services.
Subscription and booking payment processing.
Facebook Messenger integration.
Website analytics and advertising measurement.
Technical support, security, and other platform operations.

Providers may include Amazon Web Services, Pusher, Google Maps Platform, Maya, Meta, and other providers where actually used.

Service providers may process personal information as necessary to provide their services, subject to applicable contractual arrangements and legal requirements.

10.3 Legal and regulatory disclosures

We may disclose personal information where required by applicable law, a valid court order, or a lawful government request. We may also disclose information where reasonably necessary to establish, exercise, or defend legal claims or protect the rights and safety of users and others.

10.4 Business transfers

If the operating business undergoes a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of the transaction, subject to applicable law and appropriate safeguards.

11. International Data Transfers

Some service providers may store or process personal information outside the Philippines.

Where personal information is transferred internationally, we will take appropriate steps to ensure that the processing is lawful and that applicable contractual, organizational, and technical safeguards are in place.

We remain accountable for personal information under our control or custody, including information processed by service providers on our behalf, as required by applicable law.

12. Data Retention And Deletion

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal obligations and legitimate business requirements.

Retention depends on the nature of the information and the service involved.

Account and subscription information: retained while an account is active and for an appropriate period afterward to administer subscriptions, settle accounts, resolve disputes, and comply with legal requirements.
Inquiries, bookings, and messages: retained according to the applicable service arrangement, tour operator's instructions, operational needs, and legal requirements.
Visa applications and travel documents: retained only as necessary for the relevant application, authorized service, or lawful retention purpose, subject to the applicable arrangements and instructions.
Payment and transaction records: retained for the periods required by applicable accounting, tax, and other laws.
Messenger access tokens: retained while needed for the connected integration and revoked or deleted when the connection is terminated, subject to technical and security requirements.
Technical and security logs: retained for periods appropriate to security, troubleshooting, fraud prevention, and operational needs.
Backups: deleted or overwritten according to applicable backup and recovery processes.

When information is no longer necessary, we will delete, destroy, or anonymize it as appropriate, subject to lawful retention requirements and technical limitations.

A subscription's expiration or account restriction does not itself guarantee immediate deletion of stored information.

Where TripZynx processes information on behalf of a tour operator, deletion requests may need to be handled in accordance with that operator's instructions and applicable legal obligations.

13. Data Security And Incident Response

We use organizational, physical, and technical safeguards appropriate to the nature of the information processed and the risks involved.

Depending on the service and implementation, safeguards may include:

Secure connections.
Password protection and secure password hashing.
Access controls based on user roles and company permissions.
Protection of integration credentials and access tokens.
Security monitoring and logging.
Verification of incoming integration or webhook requests.
Procedures for responding to suspected security incidents.

No information system can be guaranteed to be completely secure.

If a personal data breach occurs, we will investigate, take appropriate corrective measures, and notify the National Privacy Commission and affected individuals when required by applicable law.

Users must protect their own login credentials, restrict unauthorized access to their accounts, and notify TripZynx promptly if they suspect unauthorized access or a security incident involving the platform.

14. Your Privacy Rights

Subject to applicable law and the circumstances of processing, you may have the right to:

Be informed about how your personal information is processed.
Access personal information held about you.
Request correction of inaccurate or incomplete information.
Object to processing where applicable.
Withdraw consent where processing relies on consent.
Request blocking, erasure, or destruction where legally justified.
Request data portability where applicable.
Seek indemnification for damages caused by unlawful or inaccurate processing, as provided by law.
Lodge a complaint with the National Privacy Commission.

You may update certain account details through your TripZynx profile where the relevant functionality is available.

For other requests, contact [email protected].

We may request information reasonably necessary to verify your identity and protect your account. We will respond within the period required by applicable law.

Where information is controlled by a tour operator or another customer, we may refer your request to that party or assist with the request as appropriate.

National Privacy Commission: https://privacy.gov.ph/

15. Marketing Communications

We may send service-related communications necessary to administer your account, subscription, bookings, security, or use of the platform.

Where permitted by law and supported by an appropriate legal basis, we may also send marketing communications about TripZynx services, platform features, demonstrations, updates, or relevant offers.

Where consent is required, we will obtain it through an appropriate mechanism. Requesting a demo, downloading a resource, or creating an account will not automatically be treated as consent to every type of marketing communication.

You may unsubscribe from marketing emails using the unsubscribe link provided or by contacting [email protected].

Unsubscribing from marketing communications does not prevent us from sending essential service messages where necessary and lawful.

We do not share your contact information with third parties for their independent marketing unless the arrangement has been appropriately disclosed and a lawful basis exists.

16. Children's Information

TripZynx accounts and business subscriptions are intended for adults and businesses. Individuals must meet the applicable age and legal capacity requirements to register for an account.

Our platform may nevertheless contain information about minors travelling with a parent, guardian, or other authorized booking party. Visa management features may also involve documents relating to minors.

Such information must be provided by an appropriate authorized person and processed only for legitimate, disclosed purposes connected with the relevant booking, travel, or application.

Where required, appropriate authorization, safeguards, and consent must be obtained before processing a minor's personal information.

If you believe personal information has been submitted to TripZynx unlawfully or without appropriate authorization, contact [email protected] so that we can review the concern.

17. Third-Party Websites And Services

TripZynx may link to third-party websites or integrate services provided by other organizations, including payment providers, social media platforms, maps, and other travel-related services.

These third parties may have their own privacy policies, terms, and data practices.

Our Privacy Policy does not govern independent processing by third parties acting under their own policies. We encourage you to review the relevant policies before using their services.

This does not remove any responsibilities TripZynx has under applicable law for processing activities under its control or for services it provides.

18. Changes To This Privacy Policy

We may update this Privacy Policy to reflect changes to our services, platform features, integrations, processing practices, or legal obligations.

The updated version will be published on our website with a revised effective date.

Where required by law, or where a material change warrants notice, we will notify affected users through appropriate channels before or when the change takes effect.

We encourage you to review this policy periodically.

19. Contact Us

For questions about this Privacy Policy, requests concerning personal information, or concerns about how information is handled, contact:

TripZynx Co.

Business address: Baguio City, Philippines

General support: [email protected]

Privacy requests: [email protected]

If your request concerns information collected and controlled by a particular tour operator, please also contact that operator.