Privacy Policy

1. Who is responsible for your data

OTRO INNOVATIONS LLC (“OTRO”, “we”, “us”) is the controller of the personal data described in this policy. This policy covers OTRO Tours, our China travel-facilitation division. Questions, requests and complaints can be sent to travel@otro.bd.

2. What we collect

• Enquiry data: name, email address, phone number, trip type, dates, destination, traveller count, budget band and the requirements you describe.
• Booking data: passport details (name as printed, number, nationality, date of birth, expiry), date of birth, gender where a supplier requires it, frequent-flyer details where supplied, emergency contact, and arrival and departure details.
• Medical-travel data you choose to share: condition summary, medical reports, imaging summaries, medication lists, treating-doctor details and appointment preferences. We collect this only with your explicit consent and only to arrange care.
• Payment data: invoicing name, billing address, transaction references and the last digits of a card. Full card numbers are processed by our payment provider and are not stored by us.
• Technical data: IP address, browser type, pages viewed and referral source, collected through server logs and, where enabled, privacy-respecting analytics.

We do not knowingly collect data from children under 16 except as part of a family or student-group booking, where a parent, guardian or institution supplies the data on the child’s behalf.

3. Why we use it

• To answer enquiries and prepare itineraries, quotations and inclusion schedules.
• To book flights, hotels, rail tickets, transfers, interpreters, fair badges and hospital appointments with the relevant suppliers.
• To prepare visa-support documents, including invitation letters and appointment confirmations.
• To coordinate medical travel: translating records, sharing them with the treating facility on your instruction and interpreting consultations.
• To invoice, account for tax and comply with legal, accounting and anti-fraud obligations.
• To improve our service and, where you have opted in, to send occasional updates. You can unsubscribe at any time.

4. Legal bases

Where data-protection law requires a legal basis, we rely on: performance of a contract or steps taken at your request before a contract (most booking data); your consent (medical data, marketing); compliance with legal obligations (tax, accounting, safety); and our legitimate interests in operating and improving a travel business (service correspondence, fraud prevention, basic analytics).

5. Who we share it with

Travel and medical services are delivered by third parties. We share only the data each party needs, and only for the purpose of your trip:

• Airlines, hotels, rail operators, transport providers and licensed guides.
• Fair organisers and host entities for buyer badges and visa invitation letters.
• Hospitals, clinics and treating physicians you have agreed to consult, and translation providers working on your records under confidentiality obligations.
• Visa-application service providers and, where you instruct it, agents acting on your behalf.
• Payment processors, banks and invoicing partners.
• Professional advisers, insurers and authorities where required by law or a valid legal request.

We do not sell personal data, and we do not share your details with advertisers or data brokers.

6. International transfers

To arrange travel in China we routinely transfer booking data to suppliers located in mainland China, Hong Kong and other jurisdictions where your trip takes place. Those countries may not offer the same data protections as your home country. Where required, we use contractual safeguards with suppliers, and we limit transfers to what is necessary for the booking or the treatment you requested.

7. How long we keep it

• Enquiries that do not become bookings: up to 24 months, then deleted.
• Booking and invoice records: up to seven years, to meet accounting and tax obligations.
• Medical documents: deleted within 12 months of the end of your treatment-travel support, unless you ask us to keep them for follow-up or the law requires longer retention.
• Marketing preferences: kept until you unsubscribe, plus a suppression record so we do not contact you again in error.

8. Cookies and analytics

The site uses only the cookies needed for it to function and, where enabled, a privacy-respecting analytics tool that records aggregated page views without profiling you for advertising. We do not run third-party advertising pixels. You can block or delete cookies in your browser settings; essential functions will still work.

9. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive a portable copy, withdraw consent (including consent for medical-data processing) and complain to a supervisory authority. Requests are answered within 30 days. Withdrawing consent for medical data may mean we can no longer coordinate treatment for you.

Send requests to travel@otro.bd with the subject line “Privacy request”. We may ask for proof of identity before acting.

10. Security

Access to booking and medical files is limited to the coordinators working on your trip. Data is transmitted over encrypted connections, stored in access-controlled systems, and shared with suppliers through purpose-limited channels rather than open links. No system is perfectly secure; if a breach affects your rights, we will notify you and the relevant authority as required.

11. Changes to this policy

We update this policy when our services or the law change. The “last updated” date at the top always reflects the current version, and material changes affecting existing bookings will be communicated directly.