.png)
CHANGELOG
The Latest Updates to Tour Amigo
Oct 7, 2026
Passenger Privacy & Consent Controls in the Customer Portal
Overview
By default, everyone on a shared booking can see every other passenger’s details in the Customer Portal, including sensitive personal information such as date of birth, medical & dietary requirements. For family bookings this is rarely a concern, but for bookings involving friends, colleagues or larger groups of otherwise unrelated travellers, this can raise privacy and compliance concerns, for example under GDPR.
This new Passenger Privacy & Consent Controls feature gives you three independent settings you can turn on or off to control how much passenger data is shared within a booking, and whether the lead passenger needs explicit consent before viewing another passenger’s details.
For existing partners, the new settings are configured on release to keep the Customer Portal working as it does today. Nothing changes for your customers until you choose to adjust them. |
How existing passenger access levels work
Each passenger who can log in to the Customer Portal has one of three access levels on the booking. The three new settings build on these levels rather than replacing them.
Access level | What the passenger can do |
Full Access | View and manage the booking, including the overview, itinerary and documents, plus the details and checklists of other passengers (subject to the new settings below). |
Restricted | Log in and view and manage their own details. Other passengers’ details are hidden. Only their names are shown. |
No Access | Cannot access the booking in the Customer Portal. |
The lead passenger is given Full Access when the booking is made. Other passengers have No Access by default, as they don’t have an email address at booking creation. Once an email address is added to a passenger, their access level can be set by the lead passenger in the portal (if enabled) or by your team in Hermes.
Although the settings refer to “lead passengers”, they apply to any passenger with Full Access. If you give another passenger Full Access, they have the same permissions the lead passenger has by default. |
The new settings described below are optional. If none of the settings are switched on, the Customer Portal behaves exactly as it does today, in line with the access level set for the passenger.
The three settings, explained
Each setting can be switched on or off independently and combined in any way that suits your bookings.
Setting | What happens when it’s on |
Travel Wallet – Restrict Non-Lead Passenger Access | Only the Booking Owner or passengers with Full Access can see and manage other passengers in the passenger list. Passengers with Restricted Access see only their own record, and can only view and edit their own checklists, meeting points and passport details. |
Travel Wallet – Lead Passengers Must Request Access | Full Access passengers can no longer automatically view or edit other passengers who have an email address. They see those passengers’ names with a Request Access button, and gain full access only once the passenger approves. Passengers without an email address (for example, children) can still be managed as before. |
Travel Wallet – Lead Passengers Can Set Access | This option shows an Access Level field on each passenger’s form in the portal, so the lead passenger can set No Access, Restricted or Full Access for each passenger. When off, the field is hidden and access levels are managed by your team in Hermes. |
Dependents without an email address (for example, children on a family booking) are unaffected by any of these settings. The lead passenger continues to manage their details in full, exactly as before. An access level cannot be set by the Lead Passenger for any passenger without a linked customer profile.
Default settings on release
Existing partners will have the following settings applied to preserve current behaviour:
Lead Passengers Can Set Access – On
Restrict Non-Lead Passenger Access – On
Lead Passengers Must Request Access – Off
Configuring the settings
The settings are managed at partner level.
As a logged in partner, go to Operations > System Settings > General Settings.
Find the three Travel Wallet settings. Each has help text explaining what it does.
Switch each setting on or off as required. They can be combined in any way.
Click Save. Changes apply to all of that partner’s bookings, including existing ones.
These settings are independent of, and sit alongside, the existing Passenger Permissions setting (No Access / Restricted / Full Access). You don't need to change Passenger Permissions for this feature to work. |
Example scenarios
If you want… | Then… | And… |
The lead passenger to manage everyone, as today | Enable Restrict Non-Lead Passenger Access and Lead Passengers Can Set Access | The lead passenger continues to see and manage every dependent’s details and checklists. They see an access-level dropdown (No access / restricted / full access) next to each passenger with an email address, and can set this individually per person |
Each adult traveller to control who sees their details | Enable Restrict Non-Lead Passenger Access and Lead Passengers Must Request Access | Each passenger (with an email) logs in and sees only their own details (depending on their individual access level). They see other passengers’ names on the booking, but nothing else. The lead passenger sees a Request Access button next to each passenger. |
Your team to control all access levels from Hermes | Disable Lead Passengers Can Set Access | Each passenger (with an email) logs in and sees only their own details (depending on their individual access level). They see other passengers’ names on the booking, but nothing else. |
Requesting and granting access
When Lead Passengers Must Request Access is enabled, the consent flow works as follows:
In the Customer Portal, the lead passenger clicks Request Access next to a passenger’s name and confirms the request.
The passenger receives an email explaining the request, with a Manage Access link. The email contains no sensitive booking or passenger information.
The passenger opens the link, logs in with the email address the request was sent to, and chooses Approve or Deny.
If approved, the lead passenger can view and edit that passenger’s details and checklists. If denied, they continue to see the passenger’s name only. In both cases, the lead passenger receives a notification that the other passenger has responded to the access request
Good to know
The Manage Access link is valid for 7 days and can only be responded to once.
The link can only be used by the passenger the request was sent to. Anyone else logged in, including the person who sent the request, cannot open it.
Once granted, consent doesn’t expire. Passengers can’t currently withdraw consent themselves in the portal, but your team can change their access in Hermes.
Managing access and audit history
Your team can review and change each passenger’s access from the booking’s Customer Profiles in Hermes. See the update on our change log for more details of how to manage customer profiles in Hermes.
Change Access – set the profile to Full Access, Restricted or No Access.
Remove Access – removes access. For a profile that isn’t attached to a passenger on the booking, this also removes it from the booking’s customer profiles list, whereas Change Access to No Access keeps it listed.
Every access request is recorded in the customer profile’s access history, accessed via a button in the top-right. This shows who requested access, whether it was approved or denied, and when.
Things to be aware of
These settings apply to the Customer Portal only. They don’t change what your team sees in Hermes, and passenger details retrieved via the API are unaffected.
If the lead passenger on a booking is changed, the previous lead immediately loses access to other passengers’ details. The new lead’s access follows your settings.
To give a passenger their own login, an email address must be added to them, as additional passengers don’t have one at booking creation.
Key terms
Term | Meaning |
Customer Portal | Also known as Travel Wallet. The self-service area where your customers log in to manage their booking |
Lead passenger | The first passenger entered on the booking |
Non-lead passenger | Any other passenger on the same booking |
Passenger permissions | The existing, separate setting that controls what a logged-in passenger can see of their own booking: No Access, Restricted or Full Access |
Access request | A request sent by the lead passenger asking a non-lead passenger for permission to view their details |
Consent | The non-lead passenger’s approval (or denial) of an access request, given via a secure emailed link |
FAQ's
Can I use more than one setting at a time?
Yes. All three settings are independent and can be combined in any way that suits
What happens if I turn all three settings off?
The Customer Portal behaves exactly as it did before this feature existed - every logged-in passenger can see all other passengers' details, with respect to their access level (Full, Restricted or None).
Will this affect existing bookings?
Yes, changes apply immediately to all bookings under that partner, including existing ones.
Does this replace Passenger Permissions?
No. Passenger Permissions (No Access / Restricted / Full Access) continues to control what a passenger can see of their own booking. These new settings control what passengers can see of each other.
What if a passenger doesn't have an email address?
They're treated as a dependent of the lead passenger, who continues to manage their details in full - none of these settings restrict that relationship.
Can access be removed once granted?
Yes, access can be reviewed and changed in Hermes if needed.
Need help? Contact your Tour Amigo support team or account manager .
CUSTOMER PORTAL, BOOKING MANAGEMENT