Privacy policy

Last updated 10/07/2026

In short. We keep the details needed to arrange travel and run the business, and nothing more.

We never sell personal information. We do not take card numbers: clients pay their travel suppliers directly. We use one cookie, to keep people signed in, and no advertising or tracking tools.

Who this covers

This portal is provided by Trip Vara (“we”, “us”) to travel agencies and their advisors, and to the clients those advisors look after. It lives at tripvaratravel.com.

It covers three groups of people:

Advisors, who have an account in the portal.
Clients and travellers, whose details an advisor has entered to arrange a trip.
Anyone who uses a link an advisor sent them, such as a trip page, a request form or a sign-up page for a group.

Each travel agency using the portal decides what it records about its own clients and why, and is responsible for that information. We provide the system it is kept in, and look after it as described here. An agency's information is kept apart from every other agency's.

What we collect

About advisors: name, email address, phone number, agency name, a password (kept only in scrambled form, never readable), the commission arrangements agreed with the agency, and a record of what has been done in the account. If an advisor turns on notifications on a device, we keep the address of that device's notification service so we can reach it. Messages sent in the portal's chat are kept.

About clients and travellers: what an advisor needs to arrange a trip. That can include name, email address, phone number, home address, date of birth, birthday and anniversary, passport number, expiry date and country, travel preferences and notes, who is travelling together, the reservation itself (supplier, ship or hotel, dates, cabin or room, confirmation number), what is owed and when, and documents the advisor has attached, such as a supplier's confirmation.

From people using a link: whatever they type into it, such as a name, email address, phone number, the details of their party, answers on a form, or a message to their advisor.

What we do not collect: card or bank details. The portal records what a client owes a supplier and when it is due. The client pays the supplier, not us. Where an agency gives its clients a card authorization form for a deposit or payment, that form is run by a separate provider and the card details go to them and to the agency, not into this portal. Advisors' own membership fees to the agency, where charged, are taken by Stripe, which handles the card and shows us only whether the account is paid up.

How we use it

To make and manage travel reservations, and to keep track of payments owed to suppliers and deadlines.
To show a client their own trip page, itinerary and documents.
To let an advisor know when a client has opened a quote, an invoice or their trip page. We record the date and time of the visit and which link was followed, and nothing else about the visitor.
To send emails about a trip: confirmations, quotes, payment reminders and receipts.
To send promotional emails to people who have not asked us to stop. Every one carries an unsubscribe link.
To work out what advisors are owed in commission and to pay them.
To keep the portal secure, fix problems and prevent misuse.

Who we share it with

We do not sell personal information, and we do not share it for advertising.

Travel suppliers. To book a trip an advisor has to give the supplier the travellers' details: cruise lines, tour operators, hotels, airlines and the booking networks they work through. What they do with it is covered by their own privacy policies.
Services that run the portal. Cloudflare hosts the portal and stores its data and uploaded documents. Resend delivers our emails. Stripe takes advisors' membership fees. They handle information only to provide those services to us.
Notification services. If a device is signed up for notifications, the operating system's own service (Apple, Google or Mozilla) delivers a nudge. It carries no client information.
The law. We may disclose information if the law requires it, or to protect the rights and safety of our advisors, clients or others.

Who can see it inside the portal

An advisor sees their own clients and reservations. The agency's owners can see the whole agency's. Nobody can see another agency's information. A client sees only the page their advisor shared with them, reached through a private link.

Email and how to opt out

Emails about a trip someone already has, such as a payment reminder, are part of looking after that trip. Promotional emails always include an unsubscribe link, and we do not send them to anyone who has used it. Unsubscribing from promotional emails does not stop the emails a trip needs, such as a payment falling due. To stop those too, tell your advisor.

Cookies and similar tools

The portal uses one cookie to keep a person signed in, and it is removed when they sign out or it expires. It also stores a few small preferences in the browser, such as which menu was last open. There are no advertising cookies, no analytics or tracking scripts, and no social media plug-ins.

Keeping information safe, and for how long

Everything travels over encrypted connections. Passwords are stored in scrambled form. Access is limited to the people described above, and an advisor's actions on a record are logged.

We keep information for as long as it is needed to look after a client's travel and the advisor's account, and for as long as the law or our accounting records require. After that it is deleted or made anonymous. No system is perfectly secure, and we cannot promise it, but we work to protect what we hold.

Your choices

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Some information has to be kept for legal and accounting reasons, and we will tell you if so. Depending on where you live, you may have further rights under your local law, and we will respect them.

Clients can also ask their own advisor, who can change most of this directly. You can turn off notifications in your device's settings at any time.

Children

The portal is for adults. An advisor may record a child's name, date of birth and passport details when arranging family travel, and only for that purpose, with the permission of the child's parent or guardian.

Changes to this policy

If we change this policy we will update the date above. If a change is significant we will tell advisors in the portal.

Contact us

Questions or requests about privacy: brentb@cruisestoursandtravel.com