Privacy Policy
Website, B2B Booking Portal and Travel Services
- Applies to: Website visitors, B2B clients, authorised users, passengers, corporate contacts and service applicants
- Data Controller. Roman Voyages, Corso Vittorio Emanuele II 205, 84014 Nocera Inferiore (SA), Italy.
- Company identifiers. REA SA - 490133; VAT No. 06002560651.
- Privacy contact. info@romanvoyages.com; PEC: mathewjijo@pec.it; telephone: +39 081 365 7314.
About This Privacy Policy
This Privacy Policy explains how Roman Voyages collects, uses, shares, protects and retains personal data when individuals visit its website, use or support the B2B booking Portal, communicate with Roman Voyages, or receive travel-related services arranged through Roman Voyages.
It is intended to provide information under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”). Additional notices may be provided for a particular service, campaign, recruitment process, cookie or processing activity.
This Policy does not replace the privacy notices of airlines, hotels, insurers, visa-service providers, payment providers, global distribution systems, government authorities or other independent organisations that receive personal data.
Who Is Covered
This Policy applies to personal data relating to:- B2B clients, travel agencies, corporate travel agencies, sub-agents and their owners, directors, employees and authorised users;
- Passengers and travellers whose information is entered into the Portal or supplied for a booking, ticket, refund, visa, insurance, transfer, hotel or holiday service;
- Corporate customers, suppliers, commercial partners and professional contacts; Website visitors, people who submit enquiries and recipients of business communications; Job applicants and other individuals who provide information to Roman Voyages.
Where a B2B client provides another person’s data, that client must have a valid legal basis, provide any required notice, collect any required consent and ensure that the data is accurate and limited to what is necessary.
Roman Voyages' Privacy Role
About This Privacy Policy
Roman Voyages acts as a data controller where it determines why and how personal data is processed, including for account administration, service delivery, ticketing support, supplier coordination, invoicing, legal compliance, fraud prevention, security, customer service and its own business communications.
Processing for B2B clients
For some Passenger data submitted by a B2B client, Roman Voyages may process information on that client's documented instructions. The legal role depends on the actual service and decision-making responsibilities. Where Roman Voyages acts as a processor, the parties must enter into an appropriate data-processing agreement.
Other controllers
Airlines, hotels, insurers, payment providers, GDS/NDC providers, visa authorities and government bodies commonly determine their own purposes and means of processing and may therefore act as independent controllers. Their own privacy notices and legal duties apply.
Personal Data We Collect
Business account and identity data
- Name, business email, telephone number, job title, employer, branch and authorised-user details;
- Business registration, tax, licensing, accreditation, beneficial-ownership and identity-verification information;
- Portal username, role, permissions, account status and authentication records; Contracts, commercial preferences, credit information, bank details and billing contacts.
Passenger and booking data
- Full name, title, date of birth, gender marker, nationality and contact details;
- Passport, visa, residency, identity-document and travel-document details where required;
- PNR/order references, itinerary, origin and destination, fare, ticket, EMD, baggage, seat and ancillary-service information;
- Frequent-flyer, loyalty, corporate, student, seafarer, resident or other eligibility information;
- Travel companions, emergency contacts, disruption choices, refund and rebooking instructions;
- Special-service requests, including mobility, medical, dietary or accessibility information where necessary.
Payment and transaction data
- Payment amount, currency, method, status, reference, wallet or credit balance and reconciliation data;
- Bank-transfer and invoice information;
- Limited payment-card transaction details received from authorised payment providers. Roman Voyages should not store full card security codes;
- Refund, chargeback, fraud, ADM and dispute documentation.
Communications, support and technical data
- Emails, support tickets, call notes, chat messages, complaints, service requests and documents provided with them;
- IP address, browser and device information, timestamps, session identifiers, login history, audit trails, security events and Portal activity;
- Cookie identifiers, preferences and analytics information where permitted;
- Publicly available professional or business information used for due diligence or relationship management.
Special-category data
Some travel requests may reveal health, disability, religious or dietary information. Roman Voyages will process such data only where necessary, with an appropriate condition under Article 9 GDPR, and will limit access and disclosure. The Passenger should provide only information required for the service.
How We Collect Personal Data
Roman Voyages collects personal data:- Directly from an individual through the website, Portal, telephone, email, chat, forms or documents;
- From B2B clients, corporate travel desks, employers, travel companions, family members or authorised representatives;
- From airlines, GDS/NDC providers, hotels, insurers, payment providers, visa-service partners and other suppliers;
- From identity, fraud, sanctions, credit or business-verification providers where lawful;
- Automatically from devices and systems through logs, cookies and similar technologies;
- From public registers, professional websites or public business sources where relevant and lawful.
When data is obtained from another source, Roman Voyages will provide any information required by Article 14 GDPR unless an exception applies.
Purposes and Legal Bases
Contract and requested steps
Roman Voyages processes personal data where necessary to enter into or perform a contract or take requested pre-contractual steps, including to:
- Register and administer B2B accounts and authorised users;
- Search fares, create and manage reservations, issue tickets and EMDs, arrange hotels, transfers, insurance, visa support and other requested services;
- Process changes, cancellations, refunds, schedule changes and customer support;
- Process payments, invoices, credits and account reconciliation;
- Communicate operational information to clients and Passengers.
Legal obligations
Personal data may be processed to comply with tax, accounting, anti-fraud, sanctions, anti-money-laundering, aviation-security, immigration, court, regulatory and other legal obligations.
Legitimate interests
Where not overridden by individual rights, Roman Voyages may rely on legitimate interests to:
- Secure the Portal, authenticate users and prevent, detect or investigate fraud, abuse, malpractice and cyber incidents;
- Maintain audit trails, enforce agreements, recover debts and manage legal claims;
- Improve services, reliability, customer support and business operations using proportionate data;
- Manage supplier, client and professional relationships and send relevant B2B communications;
- Protect Roman Voyages, its clients, suppliers, Passengers and the public.
Consent
Roman Voyages will request consent where required, including for non-essential cookies, certain direct marketing and, where appropriate, special-category data. Consent can be withdrawn at any time without affecting processing already carried out lawfully.
Vital interests and public-interest grounds
In exceptional situations, Roman Voyages may process or disclose data to protect a person's vital interests or where another lawful public-interest ground applies, for example during a serious travel emergency.
When Providing Data Is Required
Some data is required to create an account, issue a ticket, satisfy airline or border requirements, make a payment or comply with law. If required data is not provided or is inaccurate, Roman Voyages or the supplier may be unable to provide the service, may cancel a transaction or may request additional verification.
Optional fields will be identified where practical. Individuals should not provide passport copies, health information or payment-card data unless Roman Voyages specifically requests it through an approved secure channel.
Who Receives Personal Data
Roman Voyages may disclose personal data, as necessary and proportionate, to:
- Validating, marketing and operating airlines, airline alliances and their service providers;
- GDS, NDC, reservation, ticketing, fare, payment, fraud-screening and travel-technology providers;
- Hotels, tour operators, ground handlers, transfer companies, insurers, assistance providers and visa-service partners;
- Airports, border, customs, immigration, police, security, health, tax, judicial and regulatory authorities where required;
- Banks, card schemes, payment processors, accountants, auditors, insurers, lawyers and debt-recovery advisers;
- Cloud hosting, email, communications, customer-support, security and IT providers acting under suitable terms;
- The relevant B2B client, corporate customer, employer, sub-agent, Passenger or authorised representative;
- A purchaser, investor or successor in a genuine corporate transaction, subject to confidentiality and legal safeguards.
Roman Voyages does not sell personal data. A provider may use data for its own purposes only where it has an independent legal basis and must provide its own privacy information.
International Data Transfers
International travel commonly requires personal data to be sent to Airlines, hotels, service providers or authorities outside the European Economic Area, including the Passenger's destination or transit countries. The privacy laws and government-access rules in those countries may differ from those in the EEA.
Where the GDPR's international-transfer rules apply, Roman Voyages will use an available lawful mechanism, such as an adequacy decision, approved standard contractual clauses with appropriate supplementary measures, or a specific derogation permitted by Article 49 GDPR where the transfer is necessary for the requested travel contract or another condition applies.
Individuals may contact Roman Voyages for available information about the relevant transfer safeguards. Certain confidential or commercially sensitive details may be summarised rather than disclosed in full.
Cookies and Similar Technologies
The website and Portal may use technical cookies that are necessary for authentication, security, load balancing, session continuity and user preferences. Where analytics, advertising or other non-essential technologies are used, Roman Voyages will provide a cookie-management tool and obtain consent where required before activating them.
Users must be able to accept, reject and later change choices with comparable ease. Cookie names, providers, purposes, durations and categories must be shown in an up-to-date Cookie Policy or preference panel.
Before publication, Roman Voyages must perform a technical cookie scan and replace this general section with an accurate inventory. Browser settings may also allow users to block or delete cookies, although essential Portal functions may then be unavailable.
Direct Marketing and Business Communications
Roman Voyages may send service messages that are necessary for Bookings, account administration, security, payment or support. These are not marketing communications.
Marketing emails, messages or calls will be sent only where a valid legal basis exists. Recipients may unsubscribe using the message link or contact Roman Voyages. Roman Voyages may retain a minimal suppression record to respect the opt-out.
A B2B client must not upload marketing lists or ask Roman Voyages to contact individuals unless it has complied with applicable notice, consent and electronic-communications rules.
Automated Decision-Making and Profiling
Roman Voyages may use rules-based fraud, payment, account-security or booking-compliance checks. These checks may flag or temporarily hold a transaction for human review.
Roman Voyages does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless a lawful basis and the safeguards required by Article 22 GDPR apply. If such processing is introduced, this Policy and the relevant notice must be updated.
Data Retention
Roman Voyages retains data only for as long as necessary for the stated purpose, legal obligations, dispute management and security. Retention is based on data type, legal requirements, supplier processes, limitation periods, account status, sensitivity and risk.
-
Data or record
Draft retention approach
-
B2B account and contract records
For the relationship and ordinarily up to 10 years afterward where required for accounting, contractual or legal-claim purposes.
-
Booking, ticket, invoice and transaction records
For service delivery and then for the applicable accounting, tax, supplier-audit and legal-claim period, ordinarily up to 10 years where justified.
-
Passport, visa and identity-document copies
Only for the service and a short secure completion period; delete or irreversibly redact when no longer needed unless law, fraud review or a dispute requires retention.
-
Health, disability and other special-category details
Only for the request and travel-support period, followed by prompt deletion or minimisation unless further retention is legally required.
-
Payment-card data
According to payment-provider and PCI DSS requirements; do not retain card verification values after authorisation.
-
Support communications and complaints
Ordinarily 24 months after closure, or longer where connected to a Booking, legal claim, ADM, chargeback or regulatory matter.
-
Security, authentication and audit logs
A proportionate security period, commonly 6-12 months, unless an incident or legal requirement justifies longer retention.
-
Marketing preferences
Until consent is withdrawn, an objection is received or the approved inactivity period expires; retain a minimal suppression record afterward.
-
Unsuccessful B2B applications and due-diligence records
Ordinarily 12 months, unless a legal, fraud, sanctions or dispute reason requires a different period.
The periods above are proposed operational ranges, not a final retention schedule. Roman Voyages must approve a documented retention schedule that maps each system, record and legal requirement before publication.
Security
Roman Voyages uses proportionate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, role separation, logging, encryption where appropriate, backups, supplier due diligence, incident response and staff confidentiality obligations.
No internet or storage system is completely secure. B2B clients must protect their own devices and credentials, restrict authorised users and notify Roman Voyages immediately of suspected compromise or misdirected Passenger data.
Personal data and travel documents should not be sent through unapproved or insecure channels. Roman Voyages may provide a secure upload or verification method where sensitive documents are required.
Personal-Data Breaches
Roman Voyages maintains procedures to assess and respond to suspected personal-data breaches. Where required, Roman Voyages will notify the competent supervisory authority and affected individuals within the legally applicable timeframe.
Processors, B2B clients and service providers must notify Roman Voyages without undue delay of an incident affecting data connected with Roman Voyages and must preserve evidence and cooperate with investigation and remediation.
Individual Rights
Subject to the GDPR and applicable exceptions, an individual may request:
- Access to personal data and information about its processing;
- Correction of inaccurate or incomplete data;
- Erasure of personal data;
- Restriction of processing;
- Data portability for eligible data;
- Objection to processing based on legitimate interests and objection at any time to direct marketing;
- Withdrawal of consent at any time;
- Human intervention and other safeguards where Article 22 applies;
- Information about relevant international-transfer safeguards.
Requests may be sent to info@romanvoyages.com or by PEC to mathewjijo@pec.it. Roman Voyages may request proportionate information to verify identity and authority. Responses will be provided within the period required by law, normally one month, subject to lawful extension for complex or numerous requests.
If Roman Voyages processes data only on behalf of a B2B client, Roman Voyages may direct the request to that client or assist it in responding.
Complaints to the Supervisory Authority
Individuals have the right to lodge a complaint with the Garante per la protezione dei dati personali or another competent EEA supervisory authority, particularly in the country of habitual residence, workplace or alleged infringement.
Italian authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy; telephone +39 06 696771; email protocollo@gpdp.it; PEC protocollo@pec.gpdp.it. Roman Voyages encourages individuals to contact it first so that concerns can be addressed promptly.
Children and Minors
The B2B Portal is intended for authorised adult business users. Roman Voyages may process a minor Passenger's data where a parent, guardian, authorised agency or other lawful representative arranges travel.
Only information necessary for the travel service should be provided. The person submitting the data must have authority and must provide any required notice or consent. Roman Voyages does not knowingly use minor Passenger data for behavioural advertising.
External Websites and Third-Party Services
The website or Portal may link to an Airline, hotel, insurer, payment provider, visa authority or other third party. Roman Voyages is not responsible for that organisation's independent privacy practices. Users should read the applicable privacy notice before providing data.
Changes to This Policy
Roman Voyages may update this Policy to reflect legal, technical, supplier or operational changes. The current version and effective date will be published on the website or Portal. Material changes may also be notified through the Portal, registered email or another appropriate channel.
Contact Roman Voyages
-
Contact point
Details
-
Data Controller
Roman Voyages
-
Registered office
Corso Vittorio Emanuele II 205, 84014 Nocera Inferiore (SA), Italy
-
General privacy email
info@romanvoyages.com
-
Certified email (PEC)
mathewjijo@pec.it
-
Telephone
+39 081 365 7314
-
Company identifiers
REA SA - 490133; VAT No. 06002560651