1. Responsibilities for personal data
XO Travel processes agency representatives’ contact details to respond to enquiries, arrange cooperation and provide support. The responsible company’s details are shown on this page once confirmed.
The agency determines the purposes and lawful grounds for processing its travellers’ data. Where an XO service processes that data on the agency’s instructions, separate data processing terms define the scope, safeguards, subcontractors and return or deletion of data. This policy does not replace the agency’s own notice to its customers.
2. Data processed
Enquiries and forms may include your name, phone number, email, agency name, role, country, selected product and message. During cooperation, account details, team users, correspondence, orders, contracts and payment status are processed to the extent needed for the relevant service.
The website also processes technical data: IP address, browser, device, pages visited, event times, referral sources and advertising identifiers. Do not submit travellers’ passport, health or payment details through general contact forms. Use the designated secure channels for bookings.
3. Purposes and lawful grounds
Data is used to answer requests, prepare and perform contracts, provide access, training and support, record payments and meet legal obligations. The lawful ground depends on the operation: steps requested before a contract, contract performance, a legal obligation, legitimate interests or consent where required.
Security, abuse prevention and service improvement may rely on legitimate interests balanced against individuals’ rights. Consent for optional marketing or tracking, where required, must be separate. Submitting an enquiry does not mean agreeing to all advertising.
6. Retention and security
Retention depends on purpose: enquiries are kept while being handled and for justified follow-up; account data for service delivery and the completion of the relationship; contractual and accounting records for mandatory legal periods. Data needed for disputes may be retained until they are resolved. You can ask for the period applicable to a specific data category.
Access should be limited to business need. The agency is responsible for staff permissions, protecting credentials and revoking access promptly. Report suspected leaks or unauthorised access to support.
7. Your rights and requests
Depending on applicable law, you may obtain information and a copy of your data, request correction, erasure or restriction, object to processing and exercise data portability rights. You may withdraw consent without affecting the lawfulness of earlier processing. You may object to direct marketing at any time.
Use the contacts below and identify the service and your request. Proportionate identity verification may be needed to protect data. Responses are provided within the period required by applicable law. You may also complain to the competent data protection authority. Changes to this policy are published here with a new version date.