Privacy Policy

This Privacy Policy applies to the flight booking platform Jowla (the "Platform").

Jowla is a commercial brand operated by Skytours Voyages, a travel and tourism agency licensed in Algeria. Skytours Voyages is the data controller for the personal data processed through the Platform.

Operator registration number: 15/00-5510429أ17.

Operator tax identifier (NIF): 174150105484169.

Operator registered address: Skytours Voyages, Local A1, Tikoubaine, Ouaguenoun, Tizi-Ouzou, Algérie.

This policy explains what personal data we collect, why we process it, who it is shared with, how long it is kept and what rights you have.

'Personal Data': Any information relating to an identified or identifiable natural person.

'User': Any individual who accesses or uses the Platform.

'Processing': Any operation performed on personal data.

'Data Controller': the entity that determines the purposes and means of processing. For this Platform, the data controller is Skytours Voyages.

The Platform collects personal information necessary for booking flights and providing related services. This includes:

Basic Personal Information:

• Full name as per passport/travel document

• Email address and phone number

• Date of birth and nationality

• Passport details (number, issue/expiry dates, issuing country)

Flight Booking Information:

• Travel preferences and booking history

• Payment information (processed through secure payment gateways)

• Frequent flyer program details (if provided)

• Special assistance requirements (dietary, mobility, medical)

Visa Application Information:

• Complete passport biodata and validity information

• Biometric photographs meeting embassy specifications

• Supporting documents (financial statements, invitation letters, employment verification)

• Travel itineraries and accommodation reservations

• Previous visa history and travel records

• Purpose of visit documentation

Technical Information:

• Device and browser information when accessing the Platform

• IP address and approximate location (for security purposes)

• Access logs and usage patterns (for service improvement)

All sensitive document data is handled with secure procedures upon upload and stored in secure, access-controlled systems.

Personal data is processed for the following purposes:

Facilitating flight bookings and related services

Improving user experience and Platform functionality

Complying with legal obligations

Marketing and communications (with user consent)

The legal bases for processing include contract performance, legal obligations, legitimate interests, and user consent where applicable.

Personal data may be shared with the following categories of recipients under strict contractual safeguards:

Essential Service Providers:

• Airlines and Global Distribution Systems (Amadeus GDS) for flight bookings and PNR management

• Payment processors for secure transaction handling (encrypted payment data only)

• Travel insurance providers for optional coverage services

Visa Processing Partners:

• Embassies, consulates, and diplomatic missions for visa application processing

• Authorised visa application centres, where a consulate requires an application to be filed through one

• Immigration authorities as required by law for visa processing

• Document translation and authentication services (when required)

Legal and Regulatory Compliance:

• Government authorities when required by Algerian or international law

• Law enforcement agencies for fraud prevention and investigation

• Regulatory bodies for travel agency compliance verification

Data Protection Safeguards:

• All third-party processors are contractually bound to maintain equivalent data protection standards

• Cross-border transfers for visa applications include additional encryption and diplomatic safeguards

• Regular audits ensure third-party compliance with our data protection requirements

• Data minimization principles ensure only necessary information is shared for specific purposes

• Sensitive visa documents are transmitted through embassy-approved secure channels only

The Platform implements comprehensive technical and organizational measures to protect personal data:

Encryption and Data Protection:

• Secure platform infrastructure with authentication systems and comprehensive security protocols

• Transport encryption (TLS/HTTPS) for data exchanged with the Platform, our payment provider and our booking partners

• Secure data transmission using TLS for all communications with embassies and partners

• Separate secure storage systems for visa documents with enhanced access controls

• Database security measures with regular security assessments and updates

Access Controls and Authentication:

• Multi-factor authentication (MFA) required for all staff accessing sensitive documents

• Role-based access controls ensuring staff can only access data necessary for their duties

• Comprehensive audit trails logging all access to personal and document data

• Regular access reviews and immediate deactivation of unused accounts

System Security and Monitoring:

• Periodic reviews of our platform and hosting configuration, and prompt application of security updates

• Monitoring of infrastructure and application errors, with alerting on abnormal activity

• Automated vulnerability scanning and patch management

• Disaster recovery and business continuity plans with encrypted backups

Staff Training and Compliance:

• Mandatory data protection training for all employees handling personal data

• Specific training programs for visa document handling procedures

• Confidentiality commitments for every member of staff who can access personal data

• Regular compliance audits and security awareness programs

Incident Response:

• Established incident response procedures for potential data breaches

• Immediate notification protocols for users and authorities in case of security incidents

• Investigation of any security incident and, where required, notification to the persons and authorities concerned

Users have comprehensive rights regarding their personal data and can exercise these rights through our support channels:

Fundamental Data Rights:

• Right to access: Obtain a complete copy of your personal data and processing information

• Right to rectification: Correct inaccurate or incomplete data in our systems

• Right to erasure ('right to be forgotten'): Request deletion of your data subject to legal retention requirements

• Right to restrict processing: Limit how we process your data while disputes are resolved

• Right to data portability: Receive your data in a structured, machine-readable format

• Right to object: Object to processing based on legitimate interests or for marketing purposes

Enhanced Rights for Visa Services:

• Right to withdraw consent for document processing at any time (subject to ongoing visa applications)

• Right to request immediate secure deletion of biometric photographs after visa decision

• Right to receive confirmation of document destruction after retention periods expire

• Right to access logs of who has viewed your visa documents and when

Consent Management:

• Granular consent options: Separate consent for flight booking, visa services, and marketing communications

• Just-in-time consent requests: Clear explanations when additional data processing is needed

• Easy consent withdrawal: Simple processes to withdraw consent without affecting ongoing services

• Consent refresh: Regular notifications to review and update your consent preferences

Automated Decision-Making:

• Right to explanation: Understand any automated decision-making that affects you

• Right to human review: Request human intervention in automated processes

• Right to challenge: Contest automated decisions and request manual review

Response Timeframes:

• Standard requests: Processed within 30 days of receipt

• Urgent requests (security concerns): Processed within 72 hours

• Complex requests: May require up to 60 days with progress updates provided

We keep personal data only for as long as it is needed for the purpose it was collected for, and for the period required by the laws applicable to a licensed travel agency in Algeria. We do not publish fixed retention durations in this policy, because they are set by those legal obligations and by the airline or partner concerned.

Criteria we use to determine retention periods:

• Booking and ticketing records: kept for the duration of the trip and afterwards for the accounting, tax and dispute-handling periods imposed by Algerian law

• Payment records: kept for the period required by Algerian banking and accounting rules; we never store full card numbers, which stay with the payment provider

• Account and profile data: kept while your account is open; deleted or anonymised after account closure, except where a legal obligation requires otherwise

• Travel documents you upload for a specific request: kept for the time needed to complete that request, then deleted

• Marketing data: kept until you withdraw your consent or object

• Cookie and analytics data: kept for the lifetime of the cookie concerned, which is listed on the Cookie Settings page, or until you withdraw consent

• Technical and security logs: kept for a limited period for security monitoring and fraud prevention

Deletion:

• When a retention period ends, data is deleted or anonymised

• You can ask us at any time to delete data we are not legally obliged to keep, by writing to [email protected] or using our data deletion page

• If a legal obligation, an ongoing booking or a dispute requires us to keep a record, we will tell you which data is affected and why

The Platform may transfer data internationally to provide visa and flight booking services. We ensure comprehensive protection for all cross-border data transfers:

Transfer Safeguards and Legal Frameworks:

• EU GDPR compliance for Schengen visa applications with adequacy decisions and appropriate safeguards

• Standard Contractual Clauses (SCCs) for transfers to countries without adequacy decisions

• Additional security measures beyond legal minimums for sensitive visa document transfers

• Regular review of international transfer arrangements and updating safeguards as regulations evolve

Destination-Specific Protections:

• Schengen Area (EU): Full GDPR compliance with enhanced protection for biometric data

• Turkey: Compliance with Turkish Personal Data Protection Law (KVKK) for e-visa applications

• United States: transfers rely on the Standard Contractual Clauses or on the EU-US Data Privacy Framework where the provider is certified under it

• Other destinations: Individual assessment and implementation of appropriate safeguards

Embassy and Diplomatic Transfer Security:

• Documents are sent to consular services only through the channels those services officially require

• Embassy-approved secure channels for official visa application submissions

• Encrypted diplomatic communication protocols where available

• Verification of embassy data protection standards before document transmission

Technical Transfer Safeguards:

• Encryption in transit for all international data transfers

• Secure API connections with certificate pinning for automated transfers

• Multi-layer authentication for access to internationally transferred data

• Real-time monitoring of cross-border data flow for security incidents

Compliance Monitoring:

• Regular audits of international transfer practices and security measures

• Impact assessments for new international transfer relationships

• Immediate suspension protocols if transfer safeguards are compromised

• Annual review of adequacy decisions and regulatory changes affecting transfers

For visa services, we implement enhanced security measures for document handling:

Digital copies are securely stored in access-controlled systems with comprehensive security measures

Biometric photographs are processed according to embassy specifications and securely stored

Document transmission to embassies uses encrypted channels and secure protocols

Access to visa documents is limited to authorized personnel only

Regular audits ensure compliance with document handling procedures

Document destruction follows secure protocols after retention periods expire

Our privacy practices comply with applicable Algerian and international data protection laws:

Algerian Legal Compliance:

• Compliance with Algerian legislation on personal data protection and privacy rights

• Bank of Algeria regulations for payment data handling and cross-border transfers

• Ministry of Tourism licensing requirements for travel agency data processing

• Telecommunications regulatory authority guidelines for digital service providers

International Regulatory Compliance:

• EU General Data Protection Regulation (GDPR) for Schengen visa applications and EU-based partners

• Turkish Personal Data Protection Law (KVKK) for Turkey visa and travel services

• Various embassy-specific data protection requirements for visa processing

• International aviation regulations for passenger data protection and transmission

Professional Standards and Certifications:

• We follow recognised information-security practices; we do not currently hold an ISO 27001 certification

• Card payments are handled by our licensed payment provider, which is responsible for PCI DSS compliance; we never receive or store full card numbers

• Regular third-party security audits and compliance assessments

• Staff certification in data protection and privacy management

Regulatory Oversight and Reporting:

• Regular compliance reports to relevant Algerian regulatory authorities

• Cooperation with international data protection authorities when required

• Incident reporting procedures for data breaches or security incidents

• Transparency reports on government data requests and legal compliance

Continuous Compliance Monitoring:

• Legal technology updates to track regulatory changes affecting our operations

• Regular policy reviews to ensure continued compliance with evolving regulations

• Legal counsel consultation for complex cross-border compliance matters

• User notification procedures for significant regulatory changes affecting privacy rights

Transparency notice: the Platform uses cookies and similar technologies (browser storage, tags). Apart from strictly necessary ones, they are only activated after you have given consent.

Categories we use:

• Strictly necessary: session and authentication data, language and currency preferences, security and anti-fraud. Stored with server-side sessions and browser storage. These do not require consent.

• Audience measurement: Google Analytics 4, which sets cookies (for example _ga, _gid) to measure how the site is used.

• Marketing: Google Ads conversion tags, used to measure which ads lead to a paid booking. The ad click id in the ad link stays in this browser and is sent to Google only after you agree.

• Error monitoring: Sentry, which collects technical diagnostic data so we can detect and fix faults.

Consent and legal basis:

• Strictly necessary technologies are required for the Platform to work and are used on the basis of our legitimate interest in delivering the service you requested

• Audience measurement, marketing and error monitoring are loaded only after you accept them in the consent banner

• Until you make a choice, these technologies stay disabled and advertising signals are sent as "denied"

• You can change or withdraw your choice at any time from the Cookie Settings page; withdrawal is as easy as giving consent

Managing cookies:

• Your choice is stored on the device you used, so you may be asked again on another device or browser

• You can also block or delete cookies through your browser settings; blocking strictly necessary ones may prevent parts of the Platform from working

Third-party services:

• Cookies set by our partners are governed by their own privacy policies

• We ask our partners to limit their collection to what is necessary for the purpose we use them for

This privacy policy may be updated periodically to reflect changes in our data practices or legal requirements:

Change Notification Process:

• Significant changes will be communicated via email to registered users at least 30 days before implementation

• Policy version history is maintained and accessible for transparency

• Clear summaries of changes will be provided to help users understand modifications

• Users will have the opportunity to review changes before they take effect

Types of Changes That Trigger Notification:

• New categories of personal data collection or processing purposes

• Changes to data retention periods or deletion procedures

• New third-party data sharing arrangements or international transfers

• Changes to user rights or consent withdrawal procedures

• Modifications to security measures or data protection safeguards

User Choices for Policy Changes:

• Continued use of the Platform after notification period constitutes acceptance of updated policy

• Users may request account deletion if they disagree with policy changes

• Granular consent options allow users to opt out of specific new processing activities

• Service-specific policies allow users to continue some services while opting out of others

Version Control and Documentation:

• All policy versions are archived and available for user reference

• Change logs document the rationale and legal basis for each modification

• Legal review documentation maintained for significant policy changes

• User feedback and questions about changes are tracked and addressed

For any question about this policy, or to exercise your rights over your personal data, contact the data controller Skytours Voyages:

Contact details:

• Email: [email protected] (support and privacy requests)

• Phone: +213 753 86 78 08 (mention "privacy request" so it is routed correctly)

• WhatsApp: +213 753 86 78 08 (privacy requests accepted)

• Postal address: Skytours Voyages, Local A1, Tikoubaine, Ouaguenoun, Tizi-Ouzou, Algérie

• Contact form: available on the Platform

• Website: https://jowla.io

Privacy referent:

• Email: [email protected]

• Handles access, rectification, deletion, objection and consent-withdrawal requests

• We have not appointed a statutory Data Protection Officer; privacy requests are handled by this contact

Controller identity:

• Skytours Voyages — licensed travel and tourism agency

• Registration number: 15/00-5510429أ17

• Tax identifier (NIF): 174150105484169

• Operating licence: Licence d'exploitation d'agence de tourisme et de voyages n° 86 (Arrêté du Ministère du Tourisme du 14 avril 2018)

Response times:

• Acknowledgement of receipt as soon as we can process your message

• Substantive answer within the time limit set by the applicable law

• If a request is complex we will tell you and explain the delay

Supervisory authority:

• If you are not satisfied with our answer, you may refer the matter to the competent Algerian personal data protection authority

• Where the GDPR applies to the processing concerned, you may also contact the supervisory authority of your country of residence

When you communicate with us through WhatsApp or other Meta messaging platforms, the following policies apply:

Data Collection through WhatsApp:

• Phone number and WhatsApp profile name

• Message content related to booking inquiries, support requests, and travel arrangements

• Attachments shared for booking purposes (travel documents, receipts, etc.)

• Communication timestamps and history for service continuity

Purpose of WhatsApp Communications:

• Responding to booking inquiries and travel questions

• Providing real-time flight updates and booking confirmations

• Sending important travel alerts and notifications

• Customer support and issue resolution

Data Handling:

• WhatsApp messages are stored securely on our customer support systems

• Sensitive data shared via WhatsApp is processed according to this privacy policy

• Business communications may be logged for quality assurance and training purposes

• Automated messages may be sent for booking confirmations and updates

Your Rights Regarding WhatsApp Data:

• You can request access to your WhatsApp communication history with us

• You can request deletion of your WhatsApp data through our data deletion page

• You can opt out of WhatsApp communications at any time by messaging 'STOP'

• Your data will not be shared with third parties except as necessary for travel services

Meta Platform Compliance:

• Our use of WhatsApp Business complies with Meta's Platform Terms and Policies

• Our use of WhatsApp Business is subject to Meta's platform terms and policies

• Data processing through WhatsApp adheres to applicable data protection regulations

Data Deletion:

• To request deletion of your data, visit https://jowla.io/data-deletion

• Deletion requests will be processed within 30 days

• Some data may be retained for legal compliance purposes as outlined in Section 7

The Platform is intended for adults. We do not knowingly create accounts for people under the age of majority applicable in their country of residence.

• A booking that includes a child or an infant must be made by an adult, who provides the minor's details and is responsible for them

• We only collect the data about a minor that is required to issue the ticket and meet airline and border-control requirements

• We do not use a minor's data for marketing or profiling

• If you believe a minor has created an account or sent us personal data directly, contact [email protected] and we will delete it unless a legal obligation requires us to keep it