Privacy policy

Wisepassenger is a service operated by Bookit Labz LLC, a limited liability company established in the State of Wyoming, United States, with its address at 30 N Gould St, Ste N, Sheridan, WY 82801, United States. Bookit Labz LLC is the controller of the personal data described in this policy, except where it states that we act on behalf of an agency.

Bookit Labz LLC has no establishment in the European Union. Because we offer our services to travel agencies in the European Union, our processing of their personal data and of the people who work for them is subject to Regulation (EU) 2016/679 (GDPR), and this policy is written to meet it.

For any question about your personal data, or to exercise your rights, write to admin@wisepassenger.com.

This policy covers the public website wisepassenger.com, the contact form, and the Wisepassenger dashboard: the signed-in area at wisepassenger.com/app where agencies upload their BSP reports, follow sales, ADMs and refunds, and request our services, including the PCI DSS service.

When you write to us through the contact form, by email or by WhatsApp, we process what you send: your name, agency name, IATA code if you give it, country, email address and the content of your message. We use it to answer you and, if the enquiry leads to an engagement, to prepare and perform it. The legal basis is our legitimate interest in answering enquiries addressed to us (Art. 6(1)(f) GDPR) and, where you ask us for a proposal, steps taken at your request before a contract (Art. 6(1)(b) GDPR).

To protect the form from abuse, your IP address is checked against a short-term request counter held in memory on the server. It is not written to our database and is discarded when the counter expires.

Messages sent over WhatsApp are also subject to WhatsApp's own terms and privacy policy. Please do not send card data or other sensitive information over that channel.

On the public website we use Google Analytics to count visits and understand which pages are read; its cookies are only set if you accept them in the cookie banner and, until you do, the tag only sends Google cookieless pings; the legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from Cookie settings. We do not use advertising cookies and we do not profile visitors. The cookie policy lists the cookies and storage the site uses.

To open an account we store your email address, a password (held only as a one-way hash by our authentication provider), your full name and your preferred language. When you create or join an agency we store the agency's name, IATA code, country, BSP market and currency, and your membership and role in it. When an owner invites a colleague we store the invited email address with the invitation.

When you request one of our services from the dashboard, we store the request, the messages exchanged on it and any files attached. We also keep your progress through the training materials, the notifications shown to you, and an activity log of significant actions (for example an upload, an invitation, a request or a deletion request), each with the user and agency it concerns and the time. Our authentication and hosting providers record technical logs, such as IP address, browser and time of sign-in, to keep accounts secure.

The legal basis for account and agency data is the performance of the contract under which we provide the dashboard (Art. 6(1)(b) GDPR). The activity log and security logs rely on our legitimate interest in keeping the service secure and being able to show who did what in an agency's workspace (Art. 6(1)(f) GDPR). We send you emails about your account, your requests and your uploads; we do not send marketing.

Agencies upload reports they export from BSPlink: sales, ADMs and refund applications. We store the original file and the rows read from it. Those rows include ticket and document numbers, airline codes, PNR references, dates, amounts, forms of payment, ADM and refund details and, where the report contains them, the names of passengers. Passenger names are personal data of third parties who have no relationship with us.

We process this data only to provide the dashboard to the agency that uploaded it: to show it, filter it, calculate the figures on screen and produce the exports the agency asks for. We do not use it for any purpose of our own, we do not combine it across agencies and we do not sell or share it.

For this data the agency is the controller and Bookit Labz LLC acts as its processor under Article 28 GDPR, on the agency's instructions. The agency is responsible for what it uploads: it must have a lawful basis for processing its passengers' data, must have informed them as the GDPR requires, and must upload only what it needs to manage its BSP account. Agencies that need a data processing agreement can request one at admin@wisepassenger.com.

Each agency's data is isolated at database level, so members of one agency cannot read another agency's data. Passengers who want to exercise their rights over data in an agency's reports should contact that agency; if a request reaches us, we pass it to the agency and assist it.

When an agency requests the PCI DSS service we store the request: legal name, trading name, IATA number, address, the name, phone and email of the contact person, how the agency takes card payments, how it stores card data, its website address and any notes. To prepare the Self-Assessment Questionnaire we also store the answers given in it, including the name and title of the officer who signs it, and the finished document.

We use this data to determine which questionnaire applies, complete it, deliver it to the agency and invoice the service. The legal basis is the performance of the contract the agency asks us for (Art. 6(1)(b) GDPR) and, for invoicing, our legal obligations under tax and accounting law (Art. 6(1)(c) GDPR). The request form never asks for card numbers, and none should be entered in it.

We do not sell personal data and we do not share it with third parties for their own purposes. It is handled only by the providers we use to run the service, acting on our instructions, and by public authorities where the law requires it.

Supabase, Inc. provides our database, file storage and user authentication: account data, agency data, uploaded reports, PCI requests and generated documents are stored with Supabase. Vercel, Inc. hosts the website and the dashboard. Resend, Inc. delivers the emails we send. Each of these providers processes data under a data processing agreement.

Bookit Labz LLC is established in the United States, so personal data you provide to us, and data agencies upload to the dashboard, is transferred to the United States. Our providers may also process it in the United States.

Where a transfer requires a safeguard under Chapter V of the GDPR, we rely on the EU-U.S. Data Privacy Framework where the recipient is certified under it, or on the Standard Contractual Clauses approved by the European Commission. You can ask for information about these safeguards at admin@wisepassenger.com.

Account and agency data is kept while the account is open. When you ask us to delete your account, which you can do from Settings in the dashboard or by email, we delete it and confirm within one month, unless the law requires us to keep part of it.

Uploaded reports and the rows read from them are kept while the agency's workspace exists, so the agency can see its history. Deleting a document in the dashboard removes it from view; the original file and its rows are erased when the agency asks us to erase its data or closes its workspace.

PCI DSS requests and the documents delivered are kept while the agency's workspace exists. Invoicing records are kept for the period required by applicable tax and accounting law. Enquiries that do not lead to an engagement are deleted after two years at most.

Data deleted from the live service can remain in our database provider's backups for the limited time those backups are kept, after which it is overwritten.

You have the right to access your personal data, to have it rectified if it is wrong, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. To exercise any of them, write to admin@wisepassenger.com from the email address linked to your data. We will answer within one month and may ask you to confirm your identity first.

If you consider that we have not handled your data correctly, you can lodge a complaint with the data protection authority of the EU member state where you live or work, or where the issue arose. In Spain that is the Agencia Española de Protección de Datos (www.aepd.es).

Traffic to the website and the dashboard is encrypted. Access to an agency's data requires a signed-in member of that agency and is enforced by the database itself, uploaded files are kept in private storage, and documents are downloaded through links that expire. No system is free of risk; if a breach affecting your data occurs, we will notify the competent authority and, where required, you.

If we change how we process personal data, we will update this page and the date at the top.