Privacy Policy

1. About this policy

This policy explains how BEVA Direct Services CC (trading as TravelFlow, registration number 2002/004277/23) collects, uses, shares, stores and protects personal information when you use the TravelFlow website and platform, book travel through us, or deal with us in any other way. It is our notice to you under section 18 of the Protection of Personal Information Act, 2013 (“POPIA”).

For the personal information described here we are the “responsible party”: we decide why and how it is processed. If your employer or another organisation uses TravelFlow, that organisation decides what it records about you (for example travel requests, approvals and, in the accounting module, payroll information); please read its privacy notice as well. Questions about that information can go to your organisation or to us.

2. Who we are and how to reach our Information Officer

3. The personal information we collect

4. Why we use it, and what happens if you do not provide it

• To arrange and manage your travel (search, quote, book, change and cancel, and send you your travel documents). This is necessary to carry out the contract with you or with the organisation you travel for (POPIA s11(1)(b)).
• To take payment, issue invoices and keep accounting records. Tax law requires us to issue tax invoices and keep records: the Value-Added Tax Act, 1991 and the Tax Administration Act, 2011 (POPIA s11(1)(c)).
• To run your organisation's travel programme: travel requests, approvals, policies, budgets and reports, on your organisation's behalf.
• To keep the platform and your account secure, prevent fraud, and keep records that let us resolve disputes. This is in our legitimate interest and yours (POPIA s11(1)(d) and (f)).
• To communicate with you about your bookings, payments, account and support requests.
• To send you travel deals, only if you have agreed to receive them (section 8).

Mandatory and voluntary information. Your name, contact details and travel dates are needed to make a booking, and suppliers or border authorities require identity or passport details for some trips; without them we cannot make that booking. Special requests, frequent-traveller numbers and marketing preferences are voluntary.

5. Special personal information and children

Telling us about a religious meal preference or a need for assistance is voluntary. If you do, you consent to us using it, and sharing it with the travel supplier concerned, only to arrange that service. If you book for someone else, you confirm that they have agreed to this. You may withdraw your consent at any time by contacting us; we will then stop passing the request on.

Accounts are for adults (18 or older). Children's details are given to us by a parent, guardian or other person authorised to act for the child, who consents on the child's behalf to their use for the booking. We use them only to arrange that travel.

6. Who we share it with

We share personal information only as far as needed for the purposes above. We do not sell it.

• RateHawk (Emerging Travel Group), our accommodation supplier, and through it the hotel: guests' names, country of residence, the stay, and the IP address of the person completing the booking.
• Other travel suppliers your consultant arranges services with (hotels, airlines, transfer and car-hire companies): the details that service needs.
• PayU, which processes card payments and refunds.
• Google: Firebase (our database, file storage and sign-in), Google Maps (when you search for an address or ask for directions, it receives what you type and, if you allow it, your location) and reCAPTCHA (which checks sign-in, sign-up, password checks and two-step sign-in by SMS for automated abuse).
• OpenStreetMap, whose servers draw the map on the hotel search: your browser fetches the map pictures from them, so they receive your IP address and the area of the map you look at.
• Vercel, which hosts the website and application.
• Twilio SendGrid, which delivers our e-mails, including your travel documents as attachments.
• Your organisation, if it manages your travel: its administrators and approvers see your travel requests and bookings. If your organisation connects Slack, Microsoft Teams or its own systems to TravelFlow, its operational notifications (such as bookings, approvals and invoices) are sent there. Chat messages, and notices about your own account (sign-in and security changes, support tickets, a request to delete your account), are never sent there.
• Authorities, such as the South African Revenue Service, where the law requires it.

Our service providers (operators) may use the information only to provide their service to us, and must keep it secure.

7. Where it is stored, and transfers outside South Africa

Our database and file storage are located in South Africa (Google Cloud, Johannesburg), and the application runs on servers in Cape Town. Some information does leave South Africa:

• to the hotels and other suppliers that provide your travel, wherever they are, which is necessary to carry out your booking (POPIA s72(1)(c) and (d));
• to service providers that operate internationally: Google (sign-in and maps), Vercel (website delivery), Twilio SendGrid (e-mail, in the United States), OpenStreetMap (the hotel map, in the United Kingdom), PayU and RateHawk;
• where your organisation, or we, connect Slack, Microsoft Teams or other systems to TravelFlow: the operational notifications described in section 4, which those services may store outside South Africa.

We rely on these providers' data protection terms and their own legal obligations to protect the information to a standard comparable to POPIA.

8. Marketing

We send electronic marketing only to people who have agreed to receive it themselves; agency staff do not record it for you. You can give or withdraw that consent at any time on the Preferences tab of your profile, on the Deals page if you travel privately, or by e-mailing admin@travelflow.co.za. Messages about your bookings, payments and account are not marketing and are sent regardless.

9. How we protect it

• All connections to the website and application are encrypted (HTTPS).
• Bank account details are encrypted (AES-256) before they are stored.
• Each person sees only what their role allows, and each organisation's records are kept apart from every other organisation's; database rules enforce this as well as the application.
• Two-step sign-in is available, passwords must meet a strength policy and expire, repeated failed sign-ins lock an account, and sessions end when an account is deactivated and, unless an administrator has exempted the account, after a period of inactivity.
• Important actions are recorded in an audit trail.

No system is completely secure. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA s22 requires, and tell you what happened and what you can do.

10. How long we keep it

• Invoices, payments and accounting records, and the bookings they relate to: at least five years, as tax law requires.
• Your account and profile: while your account is open. When an account is deleted, its sign-in and contact details are removed, and so are the notifications, preferences, saved travel documents, saved hotels and trips, booking drafts and profile photo kept for it. The person's name stays on the bookings, documents and records we must keep, and the contact details on those records stay with them.
• Messages and support tickets: while your account is open, unless you ask us to delete them sooner and we are not required to keep them. When the account is deleted, the booking chats in which you are the client and the support tickets you raised are deleted with it.
• Passport details for a flight request: deleted seven days after the trip, or 90 days after they were given when the request has no travel dates, and within a day once the request is cancelled.
• Hotels and trips you save with the heart: in your account until you remove them or the account is deleted. We keep what finds the item again, not a price.
• Booking drafts a consultant saves, with the traveller details in them: in the consultant's account until the consultant deletes them, or the consultant's account is deleted.
• Session records: deleted 30 days after the session's last activity.
• Records of failed sign-in attempts, with the IP addresses they came from: deleted 90 days after the last attempt.
• Security and audit logs: sign-in and sign-out entries are deleted one year after they were made. Other entries are kept to protect the platform and resolve disputes, normally for at least one year.

Information that has no period above is deleted or de-identified when you ask, unless we are required or entitled to keep it.

11. Cookies and storage in your browser

We do not use advertising or tracking cookies. The platform stores the following in your browser so that it works:

• your sign-in session (kept by Google Firebase in your browser's storage, so you stay signed in until you sign out);
• your booking basket, recent searches, light or dark display setting, and forms you have not finished, so that you do not lose your work, which can include traveller details you typed into them;
• one security cookie, set when you sign in, so that a password reset you ask for from that browser still reaches you when other people have asked for reset e-mails to your address. It holds no name, e-mail address or account number. Your browser sends it only to the part of TravelFlow that handles password resets, and only a password reset request uses it. It lasts 90 days from your last sign-in in that browser, ends sooner if your password changes, and stays after you sign out. Clearing your browser's cookies removes it;
• one short-lived cookie, used only while an administrator connects Slack.

When you sign out, the platform clears your booking basket, recent searches and unfinished forms from your browser. It does so too when you sign out in another tab or your session ends. Booking drafts a consultant saves are kept in the consultant's account, not in the browser, so nothing personal stays in the browser after sign-out. The security cookie above stays, but it names nobody.

PayU's payment pages and Google reCAPTCHA may set their own cookies under their own policies. You can clear your browser's storage or block cookies at any time; parts of the platform, such as staying signed in, then stop working. On a shared computer, always sign out.

12. Your rights

• Access: ask whether we hold personal information about you (free of charge) and for a copy of it (POPIA s23). Our PAIA Manual explains the procedure and any fee.
• Correction and deletion: ask us to correct or delete information that is inaccurate, out of date, incomplete, misleading or that we are no longer entitled to keep (POPIA s24). You can correct much of your profile yourself in your account, and ask for your account to be deleted from the Security tab of your profile.
• Objection: object, on reasonable grounds, to processing based on legitimate interests, and object at any time to direct marketing (POPIA s11(3)).
• Withdraw consent where we rely on it; this does not affect processing before the withdrawal.
• Complain to the Information Regulator (details below).

Send requests to our Information Officer at admin@travelflow.co.za. You may use the Information Regulator's Form 1 (objection) or Form 2 (correction or deletion), available on the Regulator's website, but a clear e-mail is enough. We may ask you to confirm your identity first. We respond to correction, deletion and objection requests within 30 days, and to access requests within a reasonable time and no later than 30 days (extendable once, by up to 30 days, as the Promotion of Access to Information Act, 2000 allows).

13. Changes to this policy

We update this policy when our practices or the law change. The date at the top shows the latest version. We will tell users about material changes, by e-mail or through the platform, before they take effect.

14. Contact us or the Information Regulator