We care about your privacy
Here you’ll find a complete breakdown of our policies. We want to ensure that you feel comfortable using our product at all times.
Privacy Policy
Last updated: 3 November 2026
C Teleport BV ("C Teleport", "we", "our", "us") respects your right to privacy. This Privacy Policy explains what personal data we collect, why we process it, who we share it with, how long we keep it, and what rights you have. It is provided in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR).
This policy applies to our website and blog, the C Teleport platform and mobile applications, our APIs, and any other means used to provide our Services.
On this page
- When this policy applies
- If you are a traveller
- How we use personal data as a controller
- What we do with data as a processor
- Automated processing and artificial intelligence
- Who we share personal data with
- International transfers
- How we protect personal data
- Your rights
- Legal demands
- Cookies
- Children
- Contact details for personal data requests
- Changes to this Privacy Policy
When this policy applies
C Teleport processes personal data in two distinct roles, and it matters which one applies to you.
Where we are the controller, we decide why and how personal data is processed and we are responsible for it. This covers visitors to our website and blog; prospects and marketing contacts; account holders, administrators, super users, billing contacts and other business contacts at our customers and invoiced entities; the technical telemetry generated by the operation of the platform; and our job applicants. The section How we use personal data as a controller sets out, for each of these activities, what we process, why, on what legal basis, and for how long.
Where we are a processor, a business customer decides why and how traveller, booking and itinerary data is processed. That customer is the controller. We act only on its documented instructions, under a Data Processing Agreement. The section If you are a traveller explains what this means for you in practice.
If you are a traveller
If you were booked through C Teleport by your employer, your vessel manager, your crewing agency or another organisation, this section is the part of the policy that concerns you.
We hold your details because that organisation asked us to arrange your travel. We use them to search for and book flights, hotels, rail, ground transport and related services; to pass what is needed to the airline, hotel or other provider so your ticket or reservation can be issued; to send you itineraries, travel alerts and notifications; and to help you or your travel coordinator when something needs changing.
What we typically hold is your name, date of birth, gender and nationality; your passport or identity document details and any visa data needed to travel; your contact details; your rank, function or crew reference; and your itineraries, tickets and boarding documents. Where your organisation has told us, we also hold assistance requirements or meal preferences so these can be passed to the provider.
We do not decide what happens to your data. Your employer or the organisation that booked you does. That means we cannot, on our own, give you a copy of your data, change it, or delete it, even if we would like to. If you ask us to do any of those things, we will pass your request to that organisation without undue delay and tell you who to contact. We will not confirm to you whether we hold data about you unless it authorises us in writing. That is not us being unhelpful: it stops someone else obtaining your travel details simply by writing to us and claiming to be you.
The fastest route is usually your travel coordinator, HR contact or crewing office. If you do not know who that is, write to us at privacy@cteleport.com and we will point you in the right direction.
Once your booking is passed to an airline, hotel or other travel provider, that provider decides for itself what it does with your details. We explain this under Travel providers below.
How we use personal data as a controller
What follows covers the personal data we are responsible for. For each activity we set out what we process, why, our legal basis under Article 6 GDPR, and how long we keep it.
Visiting our website
When you visit cteleport.com or our blog, we process your IP address, device and browser information, and details of the pages you view and the links you follow. We use this to operate the site, keep it secure, and understand how it is used so we can improve it.
Our legal basis is our legitimate interest in running a secure and effective website. Where analytics or marketing cookies are involved, we rely on your consent, as described under Cookies below.
We keep website analytics data and security logs for 12 months.
Marketing and prospective customers
If you work for an organisation that might use C Teleport, or you request a demo, download a resource or meet us at an event, we process your name, business contact details, job title and employer, together with a record of your interactions with our emails and website.
We use this to tell you about our services, to run and measure campaigns, and to keep a record of anyone who has asked not to hear from us, so that we do not contact them again.
Our legal basis is your consent where consent is required, and otherwise our legitimate interest in business-to-business marketing. You can opt out at any time using the unsubscribe link in any message, and we will act on it.
We keep marketing contact data for two years from our last contact with you, or until you opt out. Where you have opted out, we keep a minimal record of that indefinitely, purely so that we can honour it.
Managing our relationship with your organisation
If you are a user, administrator, super user, billing contact or other business contact at a customer or invoiced entity, we process your name, business contact details and job title or role, together with our correspondence with you and, where the law requires it, information needed to verify your identity.
We use this to administer the commercial relationship, to give you access to the platform, to notify you of changes or issues with the Services, to invoice and collect payment, and to handle support requests and disputes.
Our legal basis is performance of our contract with your organisation, or our legitimate interest in administering that relationship. Where we carry out identity verification because we are legally required to, our basis is compliance with a legal obligation.
We keep this data for the duration of the customer relationship, and afterwards for as long as Dutch tax and accounting law requires, which is seven years from the end of the relevant financial year for records with a financial or invoicing dimension.
Keeping the platform secure
We process technical telemetry generated by the operation of the platform: system and network activity logs, authentication events, IP addresses, error and performance data, and data used to detect and prevent abuse. We use it to protect the platform and its users, to detect and investigate fraud, security incidents and misuse, and to keep the service running reliably.
Our legal basis is our legitimate interest in operating a secure and reliable service, and, where an incident triggers a reporting obligation, compliance with a legal obligation.
We keep security and audit logs for 12 months. Where logs form part of an active investigation or an incident record, we isolate and keep them for as long as the investigation and any resulting obligations require.
Improving the platform
We use data derived from the operation of the platform to fix problems, measure how features perform, and decide what to build next. Where we do this for product improvement, analytics or statistical purposes, we use only aggregated or anonymised data that does not allow any individual to be identified.
Our legal basis is our legitimate interest in improving our services. Where we rely on legitimate interests anywhere in this policy, we have assessed that our interests are not overridden by your interests, rights and freedoms; you can ask us about that assessment, and you can object at any time.
Meeting our legal obligations
We process personal data to meet obligations that apply to us: accounting, audit and tax filing under Dutch law; statutory record-keeping; and responding to valid demands from courts and authorities, as described under Legal demands below.
Our legal basis is compliance with a legal obligation. Retention follows the applicable statutory period, which for tax and accounting records in the Netherlands is seven years.
Recruitment
If you apply for a role with us, whether directly, through our careers pages or through a recruitment agency, we process your contact details; your CV, cover letter, employment history, education and qualifications; your professional profile where you have made it public; our correspondence with you; interview notes, assessments and feedback; your availability and any adjustments you need for the process; your salary expectations; and references where you provide them. Where a role requires it by law, we verify your right to work.
If we make you an offer, it is conditional on background verification proportionate to the role. This may include confirming your qualifications, employment history and references and, where permitted by law, a criminal record check. In the Netherlands, this is a certificate of conduct (VOG) that you request yourself.
We use this to assess your application, arrange and conduct interviews, communicate with you about the role, and, if we make an offer, prepare your contract.
Our legal basis is taking steps at your request before entering into a contract, together with our legitimate interest in running a fair and effective recruitment process. Where we verify your right to work, or where the law requires a background check, our basis is compliance with a legal obligation; otherwise background verification rests on our legitimate interest in ensuring that candidates are suitable for roles with access to customer and company data. Any diversity information we collect is voluntary, is used only in aggregate, and is never part of a hiring decision.
Applications are assessed by people. We do not use automated tools to reject candidates, and no hiring decision is made by software.
If we do not offer you a role, we delete your data within four weeks of the end of the process, unless you agree that we may keep it for up to one year so that we can approach you about future openings.
What we do with data as a processor
When a business customer uses the platform, we process the personal data of their travellers and users on their instructions. This is the data described under If you are a traveller: identification data; identity documents, including passport or national identity document number, issuing country, expiry date and visa data; contact data; employment data such as job title, employer, crew or personnel reference, rank or function; and travel data including itineraries, bookings, tickets, boarding documents, travel history and frequent flyer numbers. We also process usernames and the IP addresses of devices used to access the platform.
We process this data to provide the platform: searching, comparing and booking travel, changing and cancelling bookings, transmitting what is needed to travel providers, supporting users, handling disputes, issuing invoices and expense reports, and sending travel alerts and notifications. We do not use it for anything else.
Identity document data is classified as confidential under our data classification scheme: it is encrypted at rest and in transit, restricted to staff who need it, and masked wherever it is displayed in the platform.
The legal basis for this processing is established by our customer as controller. Our customer is responsible for the accuracy and lawfulness of the data it gives us and for the instructions it issues.
We keep this data for the term of our agreement with that customer. Within 90 days of the end of that agreement we return it or securely delete it, at the customer's choice, except where the law requires us to keep it, in which case we tell the customer what has been retained and why, and block it from any further use.
Special categories of personal data
In limited circumstances, and only where our customer instructs us to, we process data concerning health in the form of standard special service request (SSR) codes relating to mobility and medical assistance, for example wheelchair, oxygen, stretcher, and visual or hearing assistance codes. We also process dietary and meal preference codes, which may reveal religious or philosophical beliefs.
We process this strictly as necessary to fulfil a booking and to transmit it to the relevant travel provider. We do not use it for any other purpose, and we do not subject it to analytics or profiling. The customer is responsible for establishing the condition under Article 9(2) GDPR and for telling the individuals concerned.
In our role as processor, we do not knowingly process any other special category data, including genetic or biometric data, data revealing racial or ethnic origin, political opinions or trade union membership, data concerning sex life or sexual orientation, or data relating to criminal convictions and offences.
Data you provide about other people
If you submit data about someone else (a traveller, a colleague, a billing contact), you confirm that you are entitled to disclose it to us and that we may process it as described in this policy. Where you do so on behalf of an organisation, that organisation is responsible for having a lawful basis and for informing the people concerned.
Some data is required in order to travel. Airlines and other providers will not issue a ticket without traveller identity data. Where it is not provided, we may be unable to complete a booking.
Automated processing and artificial intelligence
The platform uses automated logic to search, rank and recommend travel options against your organisation's policy and preferences. These are recommendations: a user chooses what to book. We do not currently make decisions based solely on automated processing that produce legal effects concerning you or that similarly significantly affect you. If we introduce a booking path that completes without a person deciding, we will assess it under Article 22 GDPR and update this policy before it goes live.
We do not use customer personal data to train, fine-tune or otherwise improve machine learning or artificial intelligence models. This applies to our own models and to any third-party model we use. Where we use data derived from the operation of the platform to improve the product, we use only aggregated or anonymised data from which no individual can be identified.
Where we use AI tooling to help our own staff (for example to summarise a support conversation or draft a reply), a person reviews and is responsible for the output. Any provider of such tooling is engaged as a sub-processor on terms that prohibit training on our customers' data, and appears on our sub-processor list.
International transfers
C Teleport's core platform infrastructure, including the databases in which booking and traveller data are stored, is located within the European Economic Area (EEA).
Some of our sub-processors are established outside the EEA and may process limited personal data while providing support, communication, monitoring and business operations services to us. Where a transfer is made to a country that does not benefit from a European Commission adequacy decision, we implement appropriate safeguards under Article 46 GDPR: the European Commission's Standard Contractual Clauses and, where UK data protection law applies, the UK International Data Transfer Addendum. Where a travel provider is located outside the EEA, transmitting traveller data to it is necessary for the performance of a contract concluded in the interest of the traveller, within the meaning of Article 49(1)(b) and (c) GDPR.
If a transfer mechanism we rely on ceases to be valid, we will work to put an alternative in place without undue delay. You can request a copy of the safeguards we rely on.
How we protect personal data
C Teleport operates an Information Security Management System certified to ISO/IEC 27001 and subject to annual surveillance audit. Core processing takes place in cloud data centres located within the EEA. Identity document data is encrypted, restricted to staff who need it and masked wherever it is displayed, and we maintain a documented incident response plan covering detection, containment, notification and post-incident review.
Our staff do not have general access to customer data. Access to personal data processed on behalf of a customer is granted strictly on a need-to-know basis, protected by multi-factor authentication, and limited to what is necessary to operate the platform and meet our obligations, for example to resolve a support request or investigate an incident. Everyone with access, employees and contractors alike, is bound by a written confidentiality obligation; privileged access is logged, and access rights are reviewed at least quarterly.
Our certifications, security practices, sub-processor list and answers to common security questions are published at our Trust Centre: https://trust.cteleport.com.
No system can be guaranteed to be completely secure, and any transmission of data over the internet carries some risk.
A few things that help keep your account safe. All C Teleport accounts are personal, so please do not share your password with anyone, including colleagues. We will never ask you for your password in an unsolicited call or email. And please log out when you have finished working.
If something goes wrong
If you believe your account has been compromised, or you suspect a personal data breach, please tell us immediately using the contact details below.
We investigate every report. Where we are the controller, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) where the law requires it, and we will inform affected individuals where a breach is likely to result in a high risk to their rights and freedoms.
Where we process data on behalf of a customer, we notify that customer without undue delay and in any case within 48 hours of becoming aware, and support it in meeting its own obligations; it is then for the customer, as controller, to notify its supervisory authority and, where required, the individuals concerned.
Your rights
Where C Teleport is the controller of your personal data, you have the right to:
- find out whether we process your personal data, and obtain a copy of it (access);
- have inaccurate data corrected (rectification);
- have data erased in certain circumstances (erasure, or the "right to be forgotten");
- obtain restriction of processing in certain circumstances;
- receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller (portability);
- object to processing carried out on the basis of our legitimate interests, and at any time to processing for direct marketing;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before you withdrew it;
- not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
If you are a resident of a US state with a comprehensive consumer privacy law, you may also have the right to know what categories of personal information we have collected and who we share them with, to opt out of the sale or sharing of personal information and of targeted advertising, and not to be treated differently for exercising any of these rights. C Teleport does not sell or share personal information as those terms are defined under those laws.
To exercise any of these rights, use the contact details at the end of this policy. If your data relates to a booking made by your employer or another organisation, see If you are a traveller above: that organisation is the controller and we will route your request to it.
How we will respond
We will acknowledge your request within five working days and respond substantively within one month of receiving it. We may extend that by up to two further months where the request is complex or where we have received a number of requests; if we do, we will tell you within one month and explain why.
If we have reasonable doubts about your identity, we may ask for additional information to confirm it. We keep that verification proportionate, and we will not ask for identity documents where something lighter, such as verifying your email address, is enough.
There is no charge for making a request, though we may charge a reasonable fee based on our administrative costs for further copies of the same data. Where we correct, erase or restrict your data, we will tell each recipient we disclosed it to, unless that proves impossible or would involve disproportionate effort.
Data held in our encrypted backup systems is isolated from active processing and is not individually searchable; it remains protected by the measures described above and is deleted in line with our ordinary backup retention cycle. In limited circumstances the law allows us to withhold information, for example to protect the rights of others. If that applies, we will tell you.
Complaints
You have the right to lodge a complaint with a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You can also complain to the supervisory authority in the EU or EEA country where you live or work. We would appreciate the chance to address your concern first.
Legal demands
We may receive demands for personal data from courts, law enforcement or government authorities: court orders, search warrants, subpoenas, investigations and similar. When we receive one, we assess whether it is valid and what it actually covers. If it is valid, we disclose only the information specifically demanded that we are reasonably able to locate. We do not act on overly broad or vague demands, and we do not disclose information that has not been specifically demanded.
We do not voluntarily disclose personal data to law enforcement or government authorities.
Where a demand concerns personal data we process for a customer, we will notify that customer before disclosing anything, unless we are legally prohibited from doing so, and we will allow a reasonable opportunity for it to seek a protective order. Where notification is prohibited, we will use reasonable efforts to obtain a waiver and will notify the customer as soon as we are permitted to.
Where a demand comes from an authority outside the EEA, we will not transfer personal data in response unless the demand is based on an international agreement recognised under Article 48 GDPR, or another ground under Chapter V GDPR applies.
We maintain a record of the legal demands we receive and how we responded.
Children
Our website and platform are intended for business use and are not directed at children. We do not knowingly collect personal data directly from children. Where a customer books travel for a traveller under 18, we process that traveller's data as a processor, on the customer's instructions, and strictly as necessary to fulfil the booking.
Contact details for personal data requests
For any request relating to your personal data, including exercising the rights described above, objecting to processing, withdrawing consent, or reporting a suspected data breach, contact us at privacy@cteleport.com.
Please tell us which right you want to exercise. If someone is making a request on your behalf, the request needs to identify you and to evidence their authority to act for you.
C Teleport's Data Protection Contact has responsibility for oversight of our data protection programme and can be reached at the same address.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The date of the most recent version is shown at the top of this page. Where a change materially affects how we process your personal data, we will bring it to your attention in an appropriate way before it takes effect.