1. Glossary
- Legal basis: contract, legitimate interests, consent, legal obligation.
- Support channels: website chat, WhatsApp, email.
- Dapita customer/user: person who contracts or uses our services.
- Personal data: information identifying an individual.
- Commercial profile: basic recommendations based on usage unless you object.
- Dapita Web/App: Dapita Travel online environments.
2. Principles
- Lawfulness, fairness, transparency.
- Purpose limitation.
- Data minimisation and accuracy.
- Storage limitation.
- Integrity and confidentiality.
- Accountability.
3. Who processes your data
Controller: DAPITA LTD.
Privacy contact: support@dapita.travel
We appoint processors (vendors) under data processing agreements with appropriate safeguards.
4. What data we process
- Data you provide: email, mobile number, credentials, preferences, billing details when a full invoice is requested.
- Advanced identification (optional): biometric template for verification if you enable it.
- Interactions: support requests and related metadata.
- Usage and plans: plan status, remaining days, incidents.
- Web/App technical data: IP, language, device info, usage events, cookies if accepted.
- Network location: only when required to provide the contracted connectivity.
- Minors: under 14 not allowed without guardian authorisation.
5. Why we process your data
- Service delivery and contract management: onboarding, activation, support, charging, invoicing. Basis: contract.
- Service improvement and security, fraud and abuse prevention. Basis: legitimate interests.
- Recommendations and basic profiling for Dapita offers unless you object. Basis: legitimate interests.
- Third-party marketing only with your prior, revocable consent.
- Compliance: legal obligations (tax, consumer, telecom, data protection).
6. How we process your data
Security: technical and organisational measures for confidentiality, integrity, availability. We will notify breaches when required by law.
Indicative retention:
- Contract and support: while you are a customer and up to 10 years for legal obligations.
- Billing: up to 10 years.
- Technical logs and usage: up to 12 months unless longer is legally required.
International transfers: where applicable, safeguarded by Standard Contractual Clauses or equivalent mechanisms.
7. Your rights
- Access, rectification, erasure.
- Restriction and objection (incl. marketing and profiling).
- Portability.
- Withdraw consent.
Exercise: support@dapita.travel. Response time: up to 1 month.
Supervisory authority: your local data protection authority (e.g., ICO in the UK or AEPD in Spain).
8. Sharing: recipients
- Processors: customer support, payments, hosting, analytics, security.
- Financial and payment entities: to process charges and refunds.
- Public and judicial authorities: where required by law.
- Third parties with your consent: occasional partnerships relevant to travel.
9. Scope and updates
This policy applies to Dapita Travel services and complements service-specific terms. We may update it; we will notify material changes via your contact channels before they take effect. Continued use after notice implies acceptance.
Additional information 1: Profiling
We use data you provide, usage data, and derived data to build a basic profile for Dapita product recommendations. You can object at any time.
Additional information 2: Advertising media
We may contact you by email, messaging, or notifications unless you object; advertising cookies operate only with your consent via our cookie banner.
Additional information 3: Recipient categories
- Telecom/connectivity and customer care.
- Audit, quality, consulting.
- Hosting/cloud, business continuity, security.
- Payments/banking, tax and accounting.
- Postal and courier services.
- Advertising and communications, only if you consent.
Additional information 4: International transfers
If a vendor is outside the UK/EEA, we require appropriate safeguards (Standard Contractual Clauses or other mechanisms). A current list is available on request at support@dapita.travel.