Draft for Travdor's review. This wording isn't final and isn't yet a binding policy.

Travdor Services LLP ("Travdor", "we") plans and runs holidays and corporate trips. This policy explains what personal data we collect when you use travdor.com or travel with us, why, and the rights you have under India's Digital Personal Data Protection Act, 2023.

What we collect

• Enquiries: your name, email, phone, travel plans (destination, dates, number of travellers), your company and GSTIN if you give them, your message, and whether you agreed to receive offers.
• Your account: your email address and name. Passwords are stored only as a secure hash by our sign-in provider; we never see them.
• Quotes, bookings and payments: what you booked, amounts, invoices, and payment references. Card, UPI and net-banking details are entered on Razorpay's secure page and never reach us.
• Traveller lists for group bookings: each traveller's name, and if provided their phone, email, room or seat allocation and notes such as dietary needs.
• Reviews: your rating, review, the name you choose to sign it with, and any photos you upload.
• Technical data: to stop spam we keep a one-way scrambled code of your IP address, not the address itself. We use only the cookies needed to keep you signed in, and remember your light or dark theme choice in your browser. We don't use advertising or tracking cookies.

Why we use it

• To reply to your enquiry, prepare quotes, and arrange and run your trip.
• To send you service emails: quotes, invoices, receipts, trip reminders and a request for feedback after your trip.
• To send offers, only if you agreed to them. You can withdraw that consent at any time.
• To keep the accounting and tax records the law requires, and to prevent fraud and spam.

Who we share it with

We don't sell your data. We share only what's needed, with:

• Hotels, transport operators and guides delivering your trip, who receive the travellers' details they need.
• Supabase, which hosts our database, files and sign-in, in its Mumbai data centre.
• Vercel, which hosts the website and may serve pages from data centres outside India.
• Our email provider, to deliver service emails.
• Razorpay, to process online payments.
• Government authorities, when the law requires it.

How long we keep it

• Traveller lists: deleted 30 days after the trip ends, or after a cancellation.
• Feedback links stop working after 60 days.
• Invoices and payment records: 8 years, as tax law requires. For individuals these include your name.
• Enquiries, quotes and your account: until you ask us to delete them, or we no longer need them.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• ask for a summary of the personal data we hold about you and who we've shared it with;
• ask us to correct, complete or update it;
• ask us to delete it, except records the law requires us to keep;
• withdraw consent you've given, such as for offers;
• nominate someone to exercise these rights if you die or become unable to;
• complain to us, and if you're not satisfied with our answer, to the Data Protection Board of India.

To make a request, email info@travdor.com from the email address you used with us. We reply within 30 days.

Children

Bookings are made by adults. When a parent or guardian gives us a child's details for a trip, we use them only to run that trip.

Security

Data is encrypted in transit and at rest, access is limited to the staff who need it for their role, and every change is recorded in an audit log.

Changes

If we change this policy we'll update the date at the top, and tell you by email about any significant change.

Contact

Questions about your data: info@travdor.com or call +91 96672 77252.