This policy explains how Innaun Private Limited, 94/1 Galle Road, Colombo 06, Sri Lanka (“Innaun”, “we”) handles personal data in connection with the website itravelerp.com and the iTravel ERP service. We follow the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (as amended) as its provisions come into operation.
1. Two roles: please read this first
- Innaun as controller. For the personal data described in Section 2 (website visitors, people who contact us, agency contacts, account users and billing contacts), Innaun decides how and why the data is used and is the controller.
- Innaun as processor. Travel agencies use iTravel ERP to manage their own customers, passengers, sub-agents, vendors and staff. For that data, the agency is the controller and Innaun only processes it on the agency’s instructions under our Data Processing Agreement. If you are a passenger or customer of a travel agency, please contact that agency about your data; we will pass on any request we receive to the agency concerned.
2. Data we collect as controller
| Who | Data | Source |
|---|---|---|
| Website visitors | Technical data needed to deliver and secure the website (IP address, browser type, pages requested, time) | Your browser |
| Website visitors who accept analytics or marketing cookies | Pages viewed, device and browser, approximate location, how you arrived (for example from an advert), and whether you sent an inquiry | Google Analytics and Meta cookies, only with your consent (see our Cookie Policy) |
| People who contact us or book a demo | Name, agency name, email, phone, the topic of your inquiry, your message | You, via forms or email |
| Agencies that apply to join | Company legal and trading name, address, telephone, email, contact person, chosen plan and billing cycle, acceptance of our terms (with document versions, date, time and IP address) | You, via the onboarding form |
| Account users | Name, email, phone, role, sign-in records, two-factor settings, actions recorded in the audit log | You and your agency |
| Billing contacts | Name, email, phone, invoices, payments and correspondence | You and your agency |
| Support contacts | Messages, tickets and call notes | You |
We do not knowingly collect personal data from children through the website.
3. Why we use it
- To provide the service and perform our contract — create and run your account, deliver features, send service and security emails and SMS, provide support.
- To bill and keep records — proformas, invoices, receipts, payment reminders, and accounting and tax records required by law.
- To respond to inquiries and demo requests.
- To protect the service — prevent spam and abuse (including a bot check on our forms), detect and investigate security incidents, keep audit logs.
- To improve the service — using aggregated and anonymised statistics.
- To measure and improve our marketing — with your consent, using Google Analytics and the Meta Pixel on itravelerp.com to see how visitors find us and whether our adverts lead to inquiries. We never send the contents of your inquiry (name, email, phone or message) to Google or Meta.
- To meet legal obligations and respond to lawful requests from authorities.
We send product news or offers only to business contacts who have not opted out; every such message includes a way to opt out. We do not sell personal data.
4. Who we share it with
We share personal data only with:
- the service providers listed on our Sub-processors page (hosting, security, email and SMS delivery), under contracts that require them to protect it;
- Google and Meta, for website visitors who accept analytics or marketing cookies; they use this information under their own privacy policies;
- our professional advisers (accountants, auditors, lawyers) where needed;
- authorities, where the law requires; and
- a buyer or successor of the iTravel ERP business, under the same protections.
5. Where data is stored and transfers outside Sri Lanka
iTravel ERP is hosted on Amazon Web Services in the Asia Pacific (Mumbai), India region. Some providers we use (for example for email delivery, website security and off-site backup) process data in other countries. Where data is transferred outside Sri Lanka, we take steps required by law to ensure it remains protected, including contractual safeguards with those providers.
6. How long we keep it
| Data | Retention |
|---|---|
| Inquiries and demo requests | Up to 24 months after our last contact |
| Website analytics (Google Analytics, with consent) | 14 months |
| Onboarding requests that do not become a subscription | Up to 12 months |
| Account and user data | For the life of the account, then as described below |
| Invoices, receipts and payment records | As long as required by Sri Lankan tax and company law (typically at least 6 years) |
| Audit and security logs | Up to 24 months |
| Backups | Daily backups up to about 65 days; monthly archives up to 14 months; then deleted |
When a subscription ends, the account is deactivated and its data is kept (not deleted automatically). The agency may ask for an export within 90 days, or for deletion at any time. If an account stays deactivated, we may delete its data after giving the account owner at least 30 days’ written notice. Deleted data is removed from the live system within 30 days and from backups as they expire, within 14 months at most. Invoices and payment records are kept as long as the law requires.
7. Security
We protect data with measures including encryption in transit (HTTPS) and at rest, separation of each agency’s data at database level, two-factor authentication, role-based access, audit logging, monitored infrastructure, daily backups with an off-site copy, and limited, logged access by Innaun staff. Innaun support views an agency’s account only when needed to help that agency: access is read-only, limited to 30-minute sessions, can be switched off by the agency, and is recorded in a support access log the agency can see.
No system is perfectly secure. If a personal data breach affects you, we will notify you and the authorities as the law requires.
8. Your choices and rights
You may ask us to:
- give you access to or a copy of your personal data;
- correct inaccurate data;
- delete data we no longer need or have no lawful reason to keep;
- stop or restrict certain processing, including direct marketing; and
- withdraw consent where we rely on it.
Email support@itravelerp.com with the subject “Privacy request”. We may need to verify your identity, and we respond within 21 working days. Some rights may be limited where we must keep data by law. You may also contact the Data Protection Authority of Sri Lanka.
9. Cookies
See our Cookie Policy. The website uses analytics and marketing cookies only if you accept them, and you can change your choice at any time with the “Cookie settings” link at the bottom of every page. The iTravel ERP application uses no analytics or marketing cookies.
10. Changes
We may update this policy and will publish the new version here with its effective date. For material changes affecting account holders we will also notify the account owner by email.
11. Contact
Data Protection Officer: Rajendhan Pranavan Innaun Private Limited, 94/1 Galle Road, Colombo 06, Sri Lanka Email: support@itravelerp.com (subject “Privacy”) · Phone: +94 77 690 9457