TREOVANA Privacy Policy

This Policy explains how TREOVANA collects, uses, stores, shares, and protects personal data when you access the platform, create or use an account, make a Booking, make a payment, use an E-Ticket, register for or use TREOVANA services as a Partner, undergo verification processes, communicate with us, or use other TREOVANA features.

1. Scope and TREOVANA’s Role

This Policy applies to TREOVANA services used by Customers, Partner applicants, Individual Partners, Business Partners, Partner owners or representatives, Partner staff, and other parties whose data is lawfully processed in connection with operating the platform.

TREOVANA operates a digital platform that connects Customers with Partners offering activities, experiences, tours, and related services.

Partners are responsible for delivering activities within their control, while TREOVANA manages the platform experience, accounts, Bookings, payments, operational support, verification processes, settlement, payout, security, audit, and other records necessary to operate the service.

In certain circumstances, Partners receive limited data required to fulfill the Bookings for which they are responsible. Partners do not receive access to data belonging to other Partners and do not receive Customer data that is unnecessary for service delivery.

TREOVANA may also process Partner applicant and Partner data for registration, onboarding, identity verification, business verification, security, payment eligibility, payout, operations, support, and compliance.

2. Personal Data We Process

Depending on your relationship with TREOVANA and the features you use, TREOVANA may process the following categories of data:

Identity and contact data, such as full name, email address, phone number or WhatsApp number, country, and related authentication account information.
Customer and Booking data, including participant details, preferences or special requests, activity, date, time, number of participants, add-ons, location area, operational Meeting Point after the Partner approves the Booking, and Booking records.
Partner registration data, such as Partner type, owner or responsible person name, legal business name where applicable, displayed business name, email address, phone number, WhatsApp number, and application or onboarding status.
Partner KYC and identity verification data, which may include full legal name as shown on KTP, NIK, date of birth, KTP photo, selfie with KTP, verification status, and records or evidence relevant to the verification process.
Business Partner and representative data, such as legal business name, business type or identity, registration number or NIB where applicable, business address, registration documents, identity of the owner, director, manager, officer, or authorized representative, role or relationship to the business, and proof of authority where required.
Partner staff and access data, such as name, account identity, role, permissions, membership status, session activity, and actions performed within the Partner workspace.
Partner operational data, such as operational contact name, phone number or WhatsApp number, operational address, location information, parties assisting in activity delivery, operational readiness, and other information needed for fulfillment.
Payout account data, including bank name, account number, account holder name, verification status, Primary account designation, change history, and evidence required for verification. Account numbers may be protected through encryption and displayed in masked form.
Payment data, such as payment method, payment provider and channel, transaction reference number, amount, currency, status, time, reconciliation result, and provider technical metadata. TREOVANA does not store full card numbers (PAN) or CVV.
Refund data, including entitlement, status, handling history, and destination bank account where a bank-transfer refund is required.
Partner Funds, settlement, payout, and financial adjustment data, including relevant balances or amounts, settlement status, payout requests, payout history, refunds, Outstanding Adjustments, disputes, chargebacks, recoveries, and related financial records.
Communication and support data, such as messages, issue categories, Booking or transaction references, relevant device information, and attachments submitted through official channels.
Customer profile photo, where you choose to upload one.
E-Ticket and check-in data, including voucher number, protected QR token, issuance or usage status, check-in time, operational device, verification result, manual-process reason, and audit records.
Location evidence for check-in or operational verification, where the relevant feature is used and permitted.
Operational and dispute evidence, such as attendance evidence, location documentation, communication records, check-in records, activity completion records, documentation of staff or other service-delivery parties, and other information relevant to complaints, refunds, chargebacks, fraud reviews, or disputes.
Technical and security data, such as sessions, device identity, IP address, browser or device information, access time, authentication attempts, email or phone verification status, security logs, and audit records.
Notification and preference data, including viewed or read status, language choice, account preferences, and available service settings.
Reviews and content, such as ratings, titles, review content, moderation status, and Partner responses.
Legal acceptance data, including document, language, version, context, source, capacity of the accepting party, and the time at which Terms or Policies were accepted.
Risk, fraud, integrity, or security signals, where generated by TREOVANA’s official processes or service providers used to protect accounts, transactions, Partners, Customers, and services.

Location evidence is collected on a best-effort basis as operational and audit evidence. Location evidence is not the only mandatory condition that automatically prevents Customer check-in where location data is unavailable, inaccurate, has low confidence, or does not match the Meeting Point.

Check-in may still be completed using a QR code or a valid manual process where required under the applicable service rules.

TREOVANA may record the identity, name, and account or session context of Partner staff who perform or record check-in for audit, security, dispute resolution, or service-quality purposes.

Such records do not provide Customers with access to the private credentials of Partner staff.

3. How We Obtain Data

We obtain data directly from you when you complete forms, create or manage an account, register as a Partner, select a Partner type, undergo onboarding or KYC, upload documents, verify an email address or phone number, add a payout account, book an activity, make a payment, request a refund, contact support, use an E-Ticket, perform check-in, or submit a review.

We may also obtain data from:

Partners handling Bookings;
authorized Partner owners, staff, or representatives;
banks or payment service providers;
authentication or communication service providers;
verification service providers;
devices, browsers, or systems used to access TREOVANA; and
other official sources where necessary and permitted for verification, security, compliance, or operational purposes.

We do not purchase Customer or Partner personal data from data brokers and currently do not use personal data for third-party advertising networks.

4. Purposes of Processing

TREOVANA processes data for purposes relevant to the service, including:

creating, verifying, and securing accounts or sessions;
receiving and reviewing Partner applications;
distinguishing Individual Partners from Business Partners;
conducting KYC, identity verification, business verification, and document review;
verifying email addresses, phone numbers, and payout accounts;
determining onboarding readiness, Active status, or Payment Eligible status;
managing Owner, staff, role, and permission access;
creating and managing activities;
preparing payment processing, processing payments, creating Bookings, and requesting Partner approval;
providing Partners with information necessary to deliver activities;
handling rescheduling, cancellations, refunds, check-in, support, complaints, and disputes;
managing Partner Funds, settlement, payout, financial adjustments, disputes, and chargebacks;
helping collect or use relevant evidence for dispute or chargeback resolution;
sending OTPs and notifications relating to accounts, verification, Bookings, payments, security, onboarding, or services;
maintaining the accuracy and integrity of pricing, fees, payments, settlement, payout, and Bookings;
preventing fraud, abuse, unauthorized access, manipulation, duplicate transactions, and security incidents;
complying with legal, accounting, audit, enforcement, or lawful authority requirements; and
improving service reliability and experience through proportionate operational analysis and, where possible, aggregated or minimized data.

5. Payments, Payouts, and Refunds

Payments are processed through secure components provided by third-party payment service providers enabled by TREOVANA.

Payment service providers may process sensitive payment data in accordance with their respective roles, policies, and obligations.

TREOVANA receives and stores transaction metadata necessary for status recording, reconciliation, Bookings, refunds, settlement, payout, financial adjustments, duplicate-prevention, security, and audit.

TREOVANA does not store full card numbers (PAN) or CVV.

Where a refund must be made by bank transfer, we may request the necessary destination account information.

For Partner payouts, TREOVANA may process the bank name, account number, account holder name, verification status, Primary account designation, and other information necessary to ensure payout is made to an account that meets applicable requirements.

Account numbers may be protected through encryption, masked display, role-based access controls, and audit trails.

For Individual Partners, TREOVANA may compare payout-account information with the verified identity.

For Business Partners, TREOVANA may compare payout-account information with the business identity or with another account mechanism permitted under TREOVANA policy and the applicable payment-provider rules.

6. Parties That May Receive Data

TREOVANA only shares data where necessary to operate the service, perform verification, comply with legal obligations, maintain security, or carry out the processing purposes described in this Policy.

Parties that may receive data include:

Partners or parties involved in activity delivery, who receive Booking and participant data required for approval, preparation, fulfillment, check-in, coordination, and operational support.
Authentication, database, and storage service providers, which support accounts, access control, data storage, and TREOVANA systems.
Hosting, infrastructure, and technology service providers, which support applications, networks, system processing, monitoring, and reliability.
Payment service providers, banks, or payout service providers, which process payments, refunds, settlement, payout, account verification, disputes, or other payment functions.
Identity, business, or security verification providers, where TREOVANA uses such providers for KYC, document review, account validation, fraud prevention, or compliance functions.
Communication service providers, including email, OTP, or transactional communication services.
Map, location, routing, or translation service providers, where the relevant features are used.
Artificial intelligence technology providers or automated assistance tools, where TREOVANA uses such technology for specific functions, subject to appropriate purpose and data-minimization controls.
Security, audit, technical-analysis, or professional-support providers, where required.
Professional advisers, auditors, government agencies, law enforcement, courts, or competent authorities, where disclosure is required by law or lawful official process.

TREOVANA limits shared data according to the recipient’s needs and purpose.

Partners do not receive access to Bookings belonging to other Partners and do not receive Customer data that is unnecessary for service delivery.

Partner staff receive data only according to the roles and permissions assigned within the Partner workspace.

Third-party service providers act according to their respective roles, contracts, policies, and legal obligations.

TREOVANA may replace or add service providers over time provided that their use remains consistent with the purposes described in this Policy and applicable data-protection obligations.

7. Cookies, Sessions, Devices, and Preferences

TREOVANA uses cookies or similar storage mechanisms necessary for authentication, sessions, security, language selection, and functional preferences.

We may record device identity, IP address, browser or device information, time, and session activity to prevent unauthorized access, display security history, and operate the service reliably.

For Partners and Partner applicants, session data may also be used to restrict access according to onboarding status, role, lifecycle, and applicable authorization.

TREOVANA currently does not use cookies for third-party advertising networks.

If this practice changes, this Policy and relevant consent choices will be updated before such use begins.

8. Storage and Retention

We retain data for as long as necessary to provide services, conduct onboarding and verification, preserve the security and integrity of transactions, comply with legal or accounting obligations, resolve disputes, conduct audits, and enforce legitimate rights.

Retention periods may differ depending on the type of data, your relationship with TREOVANA, account status, KYC, documents, Bookings, transactions, settlement, payout, disputes, or applicable obligations.

Identity documents, verification evidence, and sensitive financial data are not retained longer than necessary for lawful purposes and applicable obligations.

Where data is no longer required and there is no lawful basis or other legitimate reason to retain it, the data may be deleted, anonymized, or made inactive in accordance with system capabilities and applicable procedures.

Certain legal-acceptance, audit, financial, KYC, fraud, chargeback, dispute, or security records may need to be retained after an account is closed where required for evidence, resolution of obligations, or compliance.

9. Data Security

TREOVANA applies proportionate technical and organizational safeguards, including:

access restrictions based on user, organization, role, and job need;
private storage for sensitive documents or evidence;
access controls for KTP, selfies with KTP, and verification documents;
protection of sensitive identity data such as NIK;
encryption and masking of bank account numbers;
signed or otherwise controlled access to private documents;
security or malware checks for certain files;
audit records;
separation of credentials between environments;
secure payment components; and
other relevant security mechanisms.

Internal TREOVANA or Admin access to personal data is restricted according to role and operational need.

Staff handling payments do not automatically receive access to all identity documents where such access is not required.

Access to sensitive data may be recorded in audit logs.

No system is completely free from risk.

TREOVANA continues to evaluate safeguards and respond to incidents based on evidence and applicable obligations without promising absolute security.

10. Your Rights and Choices

Subject to applicable law and after your identity can be verified, you may request:

access to your personal data;
correction of inaccurate data;
deletion of data where there is no longer a lawful basis for retaining it;
withdrawal of consent where processing depends on consent; and
objection to or restriction of processing in relevant circumstances.

You may also submit questions or complaints through TREOVANA’s official support channels.

Requests to change verified KYC, identity, business, or bank-account data may require re-verification to preserve service integrity and security.

Certain rights may be limited by legal obligations, the rights of others, the need to retain transaction, KYC, payout, or audit records, fraud prevention, disputes, chargebacks, or other legitimate reasons.

Withdrawal of consent does not invalidate processing that was lawfully carried out before withdrawal and may affect the availability of features that require the relevant data.

11. Cross-Border Processing

Infrastructure or service providers used by TREOVANA may process data in countries or regions other than your location.

In such circumstances, TREOVANA applies provider-selection, purpose and access limitations, and relevant safeguards according to the nature of the data and applicable legal obligations.

Technical locations and supporting service providers may change according to service configuration.

TREOVANA will seek to keep the explanation of such processing accurate when this Policy is published or updated.

12. Use by Children

TREOVANA services are not designed to be used independently by children who, under applicable law, do not have the legal capacity to provide consent or enter into transactions.

Where processing of a child’s data requires the consent of a parent, guardian, or another lawful authority, the service must be used with that authority.

TREOVANA may restrict or stop processing where the required authority cannot be demonstrated.

13. Changes to This Policy, Consent, and Related Documents

Each version of this Policy is managed as a document with its own identity, language, version number, status, publication date, and effective date.

Where a change requires renewed consent, TREOVANA will request consent to the version of the Policy that has been published and is effective.

Consent history is linked to the document, version, language, context, source, accepting party, and recorded time and is not silently replaced by a later version.

For Customers, this Policy should be read together with the TREOVANA Terms and Conditions

For Partner applicants and Partners, this Policy should also be read together with the TREOVANA Partner Terms and Conditions

14. Contact

For questions, requests relating to personal-data rights, or complaints regarding this Privacy Policy, contact TREOVANA by email at support@treovana.com or through the official support channels available on the platform.

For operational questions specifically relating to a Partner account or Partner services, you may also use partners@treovana.com