Privacy Policy

This page is the structural home for TravelScan ZA's Privacy Policy and describes the data the platform actually processes today. Final wording, the responsible legal entity and data protection contact details must be supplied by TravelScan ZA.

What we process

• Account details: name, work email, role and company membership.
• Uploaded documents and their metadata, stored in private storage.
• Mobile number, when verified, together with the time verification succeeded.
• Abuse-prevention signals: a one-way hash of the mobile number, device identifier and IP address. These are stored as hashes and cannot be read back as contact details.
• Audit records of important actions, including who performed them and when.

What we do not store

• Card numbers, CVV codes or payment passwords — payment data never reaches TravelScan ZA.
• One-time PINs in plaintext, in logs, or anywhere a client can read them.

Access

Data access is restricted by database row level security to the company that owns it. Documents are held in a private bucket and are only reachable through short-lived signed links issued to authorised users.

Retention and your rights

Retention periods and the process for access, correction and deletion requests are still to be finalised by TravelScan ZA and are not yet stated here.