How DOCTRAVIA processes personal data on doctravia.com and DOCTRAVIA checkout pages
Effective date: 26 October 2026. Operator: DOCTRAVIA FOR ECOMMERCE W.L.L., CR No. 194877-1, Kingdom of Bahrain.
1.1 The controller of personal data described in this Policy is DOCTRAVIA FOR ECOMMERCE W.L.L., CR No. 194877-1, registered office at Bldg. 1418, Rd. 1030, Block 1010, Al Hamalah, Kingdom of Bahrain (“DOCTRAVIA”, “we”). Contact for privacy matters: compliance@doctravia.com.
1.2 This Policy is drawn up in line with the Bahrain Personal Data Protection Law No. 30 of 2018 (the “PDPL”) and, for customers in the European Economic Area and the United Kingdom, the GDPR and the UK GDPR.
2.1 This Policy applies to visitors of our websites, to buyers, payers (including third parties paying on behalf of a buyer or beneficiary) and beneficiaries of the service packages we sell, and to representatives of partner institutions using the Supplier Account.
3.1 Identity and contact data: name, email address, phone number, country of residence.
3.2 Order data: the service and partner institution, applicant or student references, order amount and currency, order history and correspondence.
3.3 Beneficiary data provided by the buyer: name, date of birth where required for enrolment, applicant or student ID. A buyer or Payer who provides beneficiary data confirms that they are entitled to do so and that the beneficiary has been informed of this Policy.
3.4 Payment confirmation data: payment status, method, masked card number (last four digits). Full card numbers are collected and processed by our payment partners, not by us.
3.5 Partner onboarding data: company details, licences and accreditations, details of officers and beneficial owners, verification documents.
3.6 Technical data: IP address, device and browser information, log records, and cookie data described in section 13.
3.7 Payer data. Where a payment is made by a person other than the buyer or beneficiary (a “Payer”), we process the Payer’s name, contact details if provided, the country from which the payment is initiated, payment confirmation data under section 3.4 and technical data under section 3.6.
4.1 Performing the contract of sale and delivering the service package: processing is necessary for the performance of a contract to which the data subject is party (PDPL Article 4; GDPR Article 6(1)(b)).
4.2 Compliance with legal obligations, including accounting, consumer protection and sanctions screening (PDPL Article 4; GDPR Article 6(1)(c)).
4.3 Our legitimate interests: preventing fraud and abuse, securing the websites, improving our services, establishing and defending legal claims (PDPL Article 4; GDPR Article 6(1)(f)).
4.4 Consent: marketing communications and non-essential cookies (PDPL Articles 4 and 24; GDPR Article 6(1)(a)). Consent can be withdrawn at any time with effect for the future.
4.5 We process Payer data to execute and reconcile the payment, process refunds and chargebacks, prevent fraud and carry out sanctions and anti-money laundering screening, on the basis of our legitimate interests and compliance with legal obligations (PDPL Article 4; GDPR Article 6(1)(c) and (f)).
5.1 Checkout payments are processed by licensed payment service providers on PCI DSS certified infrastructure. We receive confirmation of the payment and masked data only and do not store full card numbers.
6.1 The partner institution named in your order, to deliver the underlying service; it processes this data as an independent controller under its own privacy terms. Payer data is not shared with the partner institution, except confirmation that the order has been paid.
6.2 Payment service providers and acquiring partners, to process your payment and prevent fraud.
6.3 Screening, verification and fraud-prevention providers; IT, hosting and support providers acting on our instructions; professional advisers; and public authorities where disclosure is required by law.
6.4 We do not sell personal data.
7.1 We may transfer personal data to countries included in the adequacy list adopted under the PDPL (Ministerial Order No. 42 of 2022); such transfers do not require further authorisation.
7.2 Other transfers are made under the conditions of Articles 12 and 13 of the PDPL, including your consent, necessity for the performance of your contract, or safeguards approved by the Personal Data Protection Authority.
7.3 For data subject to the GDPR or the UK GDPR, transfers outside the EEA or the UK rely on adequacy decisions or on standard contractual clauses (and the UK addendum or IDTA, as applicable).
8.1 Order, invoicing, payment and accounting records: up to 10 years from the date of the transaction, as required by law. Partner onboarding records: the duration of the relationship plus 5 years. Technical logs: up to 12 months. Marketing data: until consent is withdrawn.
9.1 You may request access to your personal data, correction of inaccurate data, blocking or erasure of data processed in breach of the PDPL, and you may object to processing for direct marketing and withdraw consent.
9.2 To exercise your rights, write to compliance@doctravia.com. We respond within the periods required by the PDPL. You may also lodge a complaint with the Personal Data Protection Authority of the Kingdom of Bahrain.
10.1 If the GDPR or the UK GDPR applies to you, you also have the rights of rectification, erasure, restriction of processing, data portability and objection, and the right to complain to your local supervisory authority.
11.1 We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration and unauthorised access, including encryption in transit, access controls, logging and staff confidentiality undertakings.
12.1 Purchases on our websites may be made only by persons of at least 18 years. Data of beneficiaries under 18 is provided by their parents, guardians or authorised representatives and is processed only as needed to deliver the service package.
13.1 We use: (a) essential cookies, required for the operation and security of the websites (no consent needed); (b) analytics cookies, used with your consent to understand how the websites are used; and (c) preference cookies, used with your consent to remember your settings.
13.2 You can manage non-essential cookies through the cookie banner and your browser settings. Blocking essential cookies may affect the operation of the checkout.
13.3 The current list of cookies, providers and storage periods is available in the Cookie Table.
14.1 We may update this Policy by publishing a new version with a new effective date on the websites.
15.1 DOCTRAVIA FOR ECOMMERCE W.L.L., CR No. 194877-1, Bldg. 1418, Rd. 1030, Block 1010, Al Hamalah, Kingdom of Bahrain. Privacy contact: compliance@doctravia.com.