Privacy Policy
Last updated: September 17, 2026
TORVESS ("TORVESS," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect when you visit torvess.com (the "Site") or use our booking services, how we use and share that information, and the rights available to you. Please read it carefully.
This Policy applies to all personal information we process in our capacity as a data controller. When we process personal information on behalf of Suppliers as their processor, their own privacy policies apply to that processing.
1. Information We Collect
Information You Provide Directly
- Account & contact information: Name, email address, phone number, and password when you create an account.
- Booking & traveler information: Full names of all travelers, dates of birth, passport or national ID numbers and expiry dates, nationality, gender, and frequent flyer or loyalty numbers as required for the Travel Service.
- Payment information: Billing address and payment details submitted at checkout. We do not store your card number, CVV, or other sensitive payment credentials. These are handled exclusively by Stripe, Inc. in accordance with PCI DSS standards. We retain only a tokenized reference and the last four digits of your card for transaction records.
- Communications: Messages and correspondence you send to our support team via email, live chat, phone, or Telegram.
- Preferences: Currency preference, language setting, and any marketing communication preferences you set.
Information We Collect Automatically
- Usage data: Pages visited, search queries, links clicked, session duration, and navigation paths.
- Device & browser data: IP address, browser type and version, operating system, device type, screen resolution, and referring URLs.
- Cookies and similar technologies: As described in our Cookie Policy and Section 7 below.
- Transaction data: Records of bookings, including confirmation numbers, travel dates, Supplier names, and amounts charged.
Information We Receive from Third Parties
- Suppliers: Booking confirmation data, booking status updates, and, where relevant, information about changes to your travel arrangements.
- Payment processors: Transaction status, fraud signals, and payment tokenization data from Stripe.
- Analytics providers: Aggregated or pseudonymous usage data from Google Analytics 4 where you have consented.
2. How We Use Your Information
We use the personal information we collect for the following purposes:
Providing and Managing Bookings
- Processing, confirming, and managing your bookings and payments;
- Transmitting required traveler information to Suppliers to fulfill your booking;
- Sending booking confirmations, itineraries, and booking-related updates by email or SMS;
- Handling changes, cancellations, and refund requests.
Customer Support
- Responding to your inquiries, requests, and complaints via chat, email, phone, or Telegram;
- Resolving disputes and investigating alleged violations of our Terms of Service.
Site Operation & Improvement
- Operating, maintaining, and improving the Site and our services;
- Conducting analytics to understand how users interact with the Site (with consent where required);
- Personalizing your experience, including displaying relevant search results and offers.
Marketing (with Consent or Legitimate Interest Where Applicable)
- Sending promotional emails and newsletters about our services if you have opted in;
- Serving targeted advertising through Google Ads and Meta Pixel where you have given consent.
Legal & Compliance
- Complying with applicable laws and regulations, including Seller of Travel requirements;
- Detecting, preventing, and responding to fraud, security incidents, and other harmful activities;
- Enforcing our Terms of Service and other legal rights;
- Responding to lawful requests from government authorities.
3. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information under the following legal bases as defined in the General Data Protection Regulation (GDPR) and the UK GDPR:
| Processing Purpose | Legal Basis |
|---|---|
| Booking and payment processing; fulfillment of your travel reservation | Performance of a contract (Art. 6(1)(b)) |
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Customer support and dispute resolution | Performance of a contract / Legitimate interests (Art. 6(1)(b)/(f)) |
| Fraud prevention, security, and compliance | Legitimate interests / Legal obligation (Art. 6(1)(c)/(f)) |
| Analytics (Google Analytics 4) | Consent (Art. 6(1)(a)) |
| Advertising (Google Ads, Meta Pixel) | Consent (Art. 6(1)(a)) |
| Marketing emails (opted-in) | Consent (Art. 6(1)(a)) |
| Record keeping and legal compliance | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and interests. You have the right to object to processing based on legitimate interests; see Section 9 for how to exercise this right.
Where we rely on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
4. When We Share Your Information
We do not sell your personal information. We share your information only as described below:
With Suppliers
We transmit traveler information (names, passport data, contact details, and booking preferences) to the airline, hotel, car rental company, or other Supplier necessary to fulfill your booking. Suppliers process this data as independent data controllers or processors subject to their own privacy policies.
With Service Providers (Processors)
We engage third-party service providers who process personal information on our behalf, under written agreements that restrict their use of the data to providing services to us. These include:
- Stripe, Inc. — Payment processing (PCI DSS compliant).
- Google LLC — Google Analytics 4 (analytics, with consent) and Google Ads (advertising, with consent); operating under Google Consent Mode to restrict data use before consent is given.
- Meta Platforms, Inc. — Meta Pixel (advertising, with consent).
- Cloud hosting, email delivery, and customer support platform providers as necessary to operate the Site.
For Legal Compliance
We may disclose your information if required by applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of TORVESS, our users, or the public.
Business Transfers
If TORVESS is involved in a merger, acquisition, financing, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction, subject to standard confidentiality obligations. We will notify you via email or a prominent Site notice before your information is transferred and becomes subject to a different privacy policy.
5. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, subject to longer retention where required by applicable law. Our general retention periods are:
- Account data: Retained for the life of your account, plus three years after account closure, unless a longer period is required by law.
- Booking and transaction records: Retained for seven years from the date of the transaction, to satisfy financial, tax, and legal record-keeping obligations.
- Support communications: Retained for three years from the date of the communication.
- Analytics data: Retained in accordance with the retention settings of our analytics providers; currently set to 14 months for Google Analytics 4.
- Marketing preferences and consent records: Retained for three years from the last recorded consent or opt-out event.
When retention periods expire, we securely delete or anonymize the relevant personal information. You may request earlier deletion in accordance with your rights described in Sections 8 and 9.
6. Security Measures
We implement and maintain appropriate technical and organizational measures designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:
- Encryption of data in transit using TLS (Transport Layer Security);
- Encryption of sensitive data at rest;
- Access controls limiting personal data access to authorized personnel on a need-to-know basis;
- Use of PCI DSS-compliant payment processing through Stripe (we do not handle raw payment card data);
- Regular security assessments and vulnerability management;
- Incident response procedures for detecting and responding to security breaches.
No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and applicable regulators as required by law.
7. Cookies & Tracking Technologies
We use cookies and similar technologies to operate the Site, remember your preferences, and (with your consent) measure usage and serve relevant advertising. For full details on the specific cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.
Analytics & Advertising (Consent Required)
We use Google Analytics 4 to understand how visitors use the Site, and Google Ads and Meta Pixel to measure the effectiveness of our advertising campaigns. These tools are activated only after you give your explicit consent through our cookie consent banner. We operate Google services under Google Consent Mode, which restricts data collection and use when consent has not been granted.
Consent Banner & Google Consent Mode
When you first visit the Site, a consent banner gives you the option to accept or decline non-essential cookies. Your preference is saved in a first-party cookie. You may change your preference at any time using the "Cookie settings" link in the Site footer. If you decline or have not yet made a choice, analytics and advertising cookies are not set and Google Consent Mode operates in a consent-denied state, limiting data processing.
8. Your Rights — U.S. Residents (CCPA/CPRA)
If you are a resident of California, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Residents of other US states with applicable privacy laws (including Virginia, Colorado, Connecticut, Texas, and others) may have similar rights under their respective state laws.
We do not sell your personal information. We do not sell or share personal information for cross-context behavioral advertising in exchange for monetary consideration. We share data with advertising partners (Google, Meta) only with your consent, as described in Section 7.
Rights Available to California Residents
- Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it was collected, and the categories of third parties with whom it was shared.
- Right to Delete: You may request that we delete personal information we have collected about you, subject to certain exceptions (e.g., information required to complete a transaction, comply with a legal obligation, or detect fraud).
- Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
- Right to Opt Out of Sale/Sharing: You may direct us not to sell or share your personal information. While we do not sell personal information, you may exercise this right by contacting us using the "Do Not Sell or Share My Personal Information" method below.
- Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information (such as passport numbers or financial account numbers), you may request that we limit our use to what is necessary to perform services requested by you.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
How to Submit a Request
To exercise any of the above rights, or to submit a "Do Not Sell or Share My Personal Information" request, please contact us:
- Email: support@torvess.com (subject line: "CCPA/CPRA Privacy Request")
- Phone: support@torvess.com
We will verify your identity before processing your request. We aim to respond within 45 days, with a possible extension of an additional 45 days where reasonably necessary. We do not charge a fee for processing your request unless it is manifestly unfounded or excessive.
You may designate an authorized agent to submit requests on your behalf; we may require written proof of the agent's authority and direct verification from you.
9. Your Rights — EEA/UK Residents (GDPR)
If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR / UK GDPR:
- Right of Access (Art. 15): Request a copy of the personal information we hold about you.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal information.
- Right to Erasure (Art. 17): Request deletion of your personal information where there is no compelling reason for its continued processing.
- Right to Restrict Processing (Art. 18): Request that we limit processing of your personal information in certain circumstances.
- Right to Data Portability (Art. 20): Receive personal information you provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller.
- Right to Object (Art. 21): Object to processing based on our legitimate interests or for direct marketing purposes. We will stop processing unless we demonstrate compelling legitimate grounds.
- Rights related to automated decision-making (Art. 22): We do not make solely automated decisions that produce significant legal effects concerning you.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us at support@torvess.com. We will respond within 30 days. You also have the right to lodge a complaint with the relevant supervisory authority in your country of residence if you believe we have not complied with applicable data protection law.
10. Children's Privacy
The Site and our booking services are intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under the age of 16. If you believe we have inadvertently collected personal information from a child under 16, please contact us immediately at support@torvess.com and we will take prompt steps to delete such information.
Travelers under 18 may be named as passengers in a booking made by an adult, but the booking must be made by and under the account of an adult.
11. International Data Transfers
TORVESS is based in the United States. When you access our Site from outside the United States, your personal information is transferred to, stored, and processed in the United States and potentially other countries where our Suppliers and service providers operate.
If you are located in the EEA, UK, or Switzerland, we rely on the following transfer mechanisms to ensure adequate protection for your personal information:
- Standard Contractual Clauses (SCCs): We incorporate EU Standard Contractual Clauses (and UK IDTA/Addendum where required) into our agreements with processors located outside the EEA/UK.
- Adequacy decisions: Where the European Commission or UK government has issued an adequacy decision for the destination country, we rely on that decision.
- Supplier transfers: When we transmit traveler data to Suppliers (airlines, hotels, etc.) located in third countries, this is necessary for the performance of your travel contract (Art. 49(1)(b) GDPR).
You may request a copy of the relevant transfer safeguards by contacting us at support@torvess.com.
12. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we offer. When we make material changes, we will notify you by email (if you have an account with us) or by posting a prominent notice on the Site before the changes take effect. The "Last updated" date at the top of this page indicates when the current version was last revised.
We encourage you to review this Policy periodically. Your continued use of the Site after an updated Policy has been posted and you have been notified constitutes your acceptance of the updated Policy, to the extent permitted by applicable law.
13. How to Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a concern about how we handle your personal information, please contact us:
- Email: support@torvess.com
- Phone: support@torvess.com (24/7)
- Mail: TORVESS, Business address — published before bookings open
- Live Chat & Telegram: Available 24/7 at torvess.com
For data access, deletion, correction, or "Do Not Sell or Share" requests, please include "Privacy Request" in the subject line of your email, along with your name and the email address associated with your account so we can verify your identity.
We aim to respond to all privacy-related inquiries within 30 days. Complex or high-volume requests may require additional time; we will notify you of any expected delay.