Privacy Policy for Travel Service Providers

1. Introduction

This Privacy Policy for Travel Service Providers ("Supplier Policy") explains how UnlockYourTravel.com ("UnlockYourTravel," "we," "our," or "us"), operated by BillStreet LLC, collects, uses, discloses, and protects the personal data of employees, agents, and representatives ("Supplier Personnel") of our partner hotels, resorts, tour operators, transportation providers, and other travel service providers ("Suppliers").

This policy applies to the processing of personal data in the context of our business-to-business ("B2B") relationships. Our customer-facing Traveler Privacy Policy, which governs traveler data, is available at: Customer Privacy Policy.

2. Data Controller

The data controller for the personal data of Supplier Personnel is:

Where required by law (e.g., GDPR), we may also act as a joint controller with certain third-party service providers.

3. Data We Collect About You

We collect personal data from:

• Direct interactions (you provide it to us)
• Your company (the Supplier you represent)
• Automated systems (via our partner portal)

A. Data You Provide to Us

• Business Contact Information: Full name, email address, phone number, job title.
• Account Credentials: Username and password for our partner portal.
• Company Information: Supplier company's name, registration/tax ID, address.
• Financial Information: Bank account details, SWIFT/BIC codes, billing preferences.
• Communications: Email exchanges, chat history, call logs.
• Profile & Listing Data: Information about your services (descriptions, images, pricing, terms, availability).

B. Data Collected Automatically

• Portal Usage Data: Login times, IP address, device type, browser, pages visited, and activity logs.
• Cookies & Similar Technologies: Used for authentication, analytics, and customization (see Section 10).

C. Data From Third Parties

• From Partner Organizations: Such as booking confirmations, service updates, and payment-related information.
• From Public Sources and Business Directories: Openly available information such as your company's official name, address, and contact details.
• From Social Media Platforms: If you connect or interact with our social media accounts, we may receive certain information in accordance with that platform's privacy policy.

4. How We Use Your Data (Purposes & Legal Bases)

5. How We Share Your Data

We may share personal data with:

• Internal Teams: Sales, support, finance, IT.
• Service Providers / Sub-Processors (under contract):
  • Cloud hosting (Hetzner)
  • Payment services (local banks for transferring net revenue)
  • CRM and analytics tools
  • Communication systems
• Professional Advisors: Lawyers, auditors, insurers.
• Authorities: Government agencies, regulators, courts (where legally required).

6. International Data Transfers

Your data may be transferred outside of Mongolia, including to countries with different data protection standards. Safeguards include:

• EU Standard Contractual Clauses (SCCs)
• Binding Corporate Rules (BCRs)
• Other approved mechanisms under applicable laws

7. Data Security

We apply technical and organizational measures to safeguard Supplier Personnel data, including:

• Encryption (in transit and at rest)
• Role-based access controls
• Secure server and network infrastructure
• Multi-factor authentication for portal access
• Regular security monitoring and audits

8. Data Retention

We retain personal data only as long as necessary:

• Business contact & financial data: Duration of our partnership + 5–7 years (per Mongolian commercial/tax law).
• Portal activity logs: Typically 12–24 months.
• Marketing records: Until you unsubscribe or object.

After retention periods, data is securely deleted or anonymized.

9. Your Data Protection Rights

Depending on your jurisdiction, you may have the following rights:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate or incomplete data
• Erasure — Request deletion (subject to legal limits)
• Restriction — Limit processing in certain situations
• Portability — Receive data in a structured format
• Objection — Stop processing based on legitimate interests

10. Cookie Notice (Partner Portal)

Our portal uses cookies and trackers:

• Strictly Necessary (Required) — Login/session management
• Analytics — Portal usage insights
• Functionality (Optional) — Language preferences, saved filters

11. Third-Party Links

Our partner portal may contain links to third-party systems (e.g., payment gateways, industry resources). We are not responsible for their privacy practices. Please review their privacy policies before sharing personal data.

12. Policy Updates

We may amend this Supplier Policy from time to time.

• Last Updated date will reflect changes.
• Material changes will be communicated via email or portal notifications.

13. Dispute Resolution & Governing Law

• This Supplier Policy is governed by the laws of Mongolia.
• Any disputes will first be attempted to be resolved amicably.
• If unresolved, disputes shall be subject to the exclusive jurisdiction of the courts of Ulaanbaatar, Mongolia.

14. Contact Us

For questions, concerns, or to exercise your rights, please contact: