Privacy Policy

1. Information We Collect

We collect the following categories of personal data:

• Identity & Contact Data: Full name, email, phone number, address, date of birth, passport details, government ID (Aadhaar, PAN, Driving License) as required for travel bookings.
• Travel & Booking Data: Flight/train/coach details, hotel reservations, itinerary, special requests (dietary, medical, accessibility), visa information, and travel insurance details.
• Payment Data: Cardholder name, masked card number, UPI ID, transaction ID, and billing address. We never store full card numbers or CVV.
• Technical Data: IP address, browser type, device information, pages visited, time spent, and cookies (see Section 9).

2. Legal Basis for Processing (DPDP Act & GDPR)

We process your data only when we have a legal basis, including:

• Your Consent: Freely given, specific, informed, and unambiguous consent via affirmative action. You may withdraw consent anytime.
• Contractual Necessity: To process bookings, confirm reservations, and provide travel services you requested.
• Legal Obligations: To comply with KYC, tax, anti-fraud, and regulatory requirements.
• Legitimate Interests: To improve our services, prevent fraud, and ensure network security, where your rights do not override those interests.

3. How We Use Your Information

• Service Delivery: Booking flights, hotels, cabs, sightseeing, and issuing travel documents (tickets, vouchers).
• Communication: Sending booking confirmations, payment reminders, pre-travel alerts, and responding to inquiries.
• Marketing (with consent): Newsletters, special offers, and personalized travel recommendations. You can opt-out anytime.
• Legal & Security: Fraud detection, dispute resolution, and compliance with court orders or government requests.

4. Sharing Your Information

We share your data only when necessary and with strict confidentiality agreements:

• Travel Service Providers: Airlines, hotels, DMCs, local tour operators, transport companies, and insurance partners.
• Payment Gateways & Banks: To process transactions securely (Razorpay, PayPal, etc.).
• Legal Authorities: When required by law, court order, or regulatory body (e.g., DPDP Board, Income Tax).
• Third-Party Tools: Analytics (Google Analytics), CRM, and email platforms under data processing agreements.

We never sell or rent your personal data to third parties for marketing purposes.

5. International Data Transfers

Because we book international travel, your data may be transferred to countries outside India (e.g., airline systems in the US, EU, UAE). We take appropriate safeguards, including Standard Contractual Clauses (SCCs) or equivalent measures, to ensure your data is protected as per DPDP Act and GDPR requirements. You may request details of such safeguards.

6. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy or as required by law (e.g., 7 years for tax records under Indian law). After the retention period, your data is securely deleted or anonymized. You may request earlier deletion where legally permissible.

7. Data Security

We implement industry-standard security measures including SSL/TLS encryption, firewalls, access controls, regular vulnerability scans, and employee training. In the unlikely event of a data breach, we will notify the Data Protection Board of India and affected individuals within 72 hours as required by the DPDP Act.

8. Your Rights (Data Principal Rights)

Under the DPDP Act, 2023 and GDPR, you have the following rights:

• Right to Access: Obtain confirmation and a summary of your personal data processed.
• Right to Correction: Rectify inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): Request deletion when data is no longer necessary or consent is withdrawn.
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Restrict Processing: Limit processing in certain circumstances.
• Right to File a Complaint: Lodge a complaint with the Data Protection Board of India or your local supervisory authority.

We will respond to your requests within 30 days (extendable by 15 days in complex cases).

9. Cookies & Tracking Technologies

We use cookies to enhance user experience, analyze traffic, and personalize content. You can control cookies via browser settings. Essential cookies cannot be disabled as they are necessary for website functionality. For detailed cookie information, please see our Cookie Policy.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that we have inadvertently collected data from a child under 18, we will delete it immediately. For bookings involving minors, we require parental or guardian consent.

11. Changes to This Privacy Policy

We may update this policy periodically to reflect changes in laws or our practices. The "Last Updated" date at the top indicates the latest revision. Significant changes will be notified via email or website notice. Continued use of our services after changes constitutes acceptance.