Privacy Policy

1. Introduction

DutyBoost is committed to protecting your personal information. This Privacy Policy explains how we collect, use, and safeguard the data you provide when using our platform. DutyBoost operates a Performance-based Customer Acquisition Infrastructure for Global Travel — a shared, performance-based commercial ecosystem connecting Travel Partners, Airport Retailers, POS Partners, and travelers through booking-linked DutyCredits. We process data in accordance with GDPR (EU) 2016/679 and applicable travel industry data standards. DutyBoost does not send emails to travelers; we send emails only to Airport Retailers, Travel Partners, and POS Partners that decide to work with, integrate, or join the ecosystem.

2. Data We Collect

• Account data: full name, email address, company name, role, and business registration details (collected from Travel Partners, Airport Retailers, and POS Partners).
• Booking data: Passenger Name Record (PNR) reference, departure airport (IATA code), travel date, number of travelers, ticket value, travel type, and booking confirmation number (provided by Travel Partners to generate DutyCredits).
• Transaction data: DutyCredit codes issued and redeemed, discount amounts, point-of-sale retailer identifiers, POS partner identifiers, and purchase values.
• Payment data: bank account details (for commission payouts to Travel Partners and POS Partners, and invoicing of Airport Retailers). We do not store full card numbers.
• POS integration data: technical configuration data, API credentials, and redemption event logs provided by POS Partners.
• Usage data: page views, feature interactions, browser type, device type, and IP address.
• Communication data: emails sent to and received from Airport Retailers, Travel Partners, and POS Partners in connection with platform activity.

3. How We Use Your Data

• To generate, validate, and manage DutyCredits linked to confirmed travel bookings.
• To process and track redemption transactions at airport points of sale, including through POS Partner infrastructure.
• To calculate and distribute Revenue Shares and commissions to Travel Partners and POS Partners, and to invoice Airport Retailers for the Platform Fee.
• To process partial and full refunds where a traveler is lawfully entitled to a refund, and to adjust Platform Fees and Revenue Shares accordingly.
• To send operational, onboarding, and transactional emails to Airport Retailers, Travel Partners, and POS Partners. DutyBoost does not send emails to travelers.
• To conduct Know Your Customer (KYC) and anti-money laundering (AML) checks on business partners.
• To comply with legal obligations, including responding to requests from airport authorities or regulatory bodies where required by applicable law.
• To improve platform performance, analytics, and user experience.

4. Data Sharing

We do not sell your personal data. We may share data in the following circumstances: with participating Airport Retailers (limited to DutyCredit validation data required at the point of sale); with POS Partners (limited to redemption validation and transaction data required to process DutyCredits through their infrastructure); with our infrastructure and payment service providers under data processing agreements; with airport authorities or government agencies where legally required (e.g. in connection with security or customs obligations); and with regulatory authorities where required by law, including in connection with AML obligations.

5. International Data Transfers

Some of our sub-processors are based outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission. A full list of sub-processors is available in our Data Processing Agreement.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide services. Booking and transaction records are retained for a minimum of 7 years in accordance with financial record-keeping obligations. KYC verification records are retained as required by applicable AML regulations. POS integration logs are retained for the duration of the partnership plus the applicable statutory period.

7. Your Rights (GDPR)

If you are based in the EU/EEA, you have the right to: access your personal data; request correction of inaccurate data; request deletion of your data (subject to legal retention obligations); object to or restrict processing; and request data portability. To exercise your rights, contact us at privacy@dutyboost.com. You also have the right to lodge a complaint with your national data protection authority.

8. Security

We use industry-standard encryption (TLS 1.2+ in transit, AES-256 at rest), role-based access control, and multi-factor authentication for internal systems. DutyCredit codes are cryptographically unique and single-use. POS Partner integrations are secured using authenticated API channels. We conduct regular security assessments and maintain a documented incident response procedure.

9. Traveler Data Notice

DutyBoost processes limited traveler data (name, email, booking reference, departure airport, travel date) provided by Travel Partners for the sole purpose of generating and validating DutyCredits. DutyBoost does not send marketing or transactional emails to travelers. Travel Partners are the data controllers for their travelers' data and are responsible for their own privacy obligations toward their customers. Airport Retailers and POS Partners receive only the minimum data needed to validate a DutyCredit at the point of sale.

10. Contact

For privacy-related enquiries: privacy@dutyboost.com · DutyBoost B.V., a legal entity registered at the Dutch Chamber of Commerce (Kamer van Koophandel) under number 42053181, Amsterdam, the Netherlands.