Privacy Policy
1. Introduction
Travespert Tours and Travels (“we,” “us,” or “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, share, and protect the personal information you provide when using our travel website and services as a travel Company and tour operator.
This policy complies with major international privacy laws including the General Data Protection Regulation (GDPR) in the European Union, California Consumer Privacy Act (CCPA) in the United States, Digital Personal Data Protection Act (DPDPA) 2023 of India, Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, Lei Geral de Proteo de Dados (LGPD) in Brazil, Act on the Protection of Personal Information (APPI) in Japan, Australian Privacy Principles (APPs) under the Privacy Act 1988 in Australia, Personal Data Protection Act (PDPA) in Singapore, Personal Information Protection Act (PIPA) in South Korea, Privacy Act 2020 in New Zealand, Personal Data Protection Law (PDPL) in the UAE, Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) in Mexico, and Payment Card Industry Data Security Standards (PCI DSS).
2. Information We Collect
Personal Information for Travel Bookings and Services
As a Travel Company, we collect the following personal information necessary for travel arrangements:
Basic Personal Information:
- Full name as it appears on government-issued identification documents
- Contact information (home address, email address, phone numbers)
- Date of birth and nationality
- Gender (where required for travel arrangements)
Travel Documentation:
- Passport details, including passport number, expiry date, and issuing country
- Visa information and requirements
- Travel insurance information
Payment and Financial Information:
- Credit card details and payment information
- Billing address
- Transaction history and booking confirmations
- Invoicing and receipt information
Travel Preferences and Special Requirements:
- Accommodation preferences (room type, bedding preferences)
- Dietary restrictions and meal preferences
- Accessibility requirements and special assistance needs
- Medical information relevant to travel (allergies, medical conditions affecting travel)
Trip-Specific Information:
- Travel itinerary and destination preferences
- Emergency contact information
- Travel companion details
- Purpose of travel (business or leisure)
Newsletter and Marketing Information
- Email address collected when you voluntarily subscribe to our newsletter for travel updates and promotional offers
Analytics and Advertising Data
We automatically collect certain information through third-party services:
- Google Analytics Data: Website usage patterns, page views, session duration, and user behavior to improve our website functionality
- Facebook and Instagram Advertising Data: Information about your interactions with our social media advertisements, including clicks, views, and engagement metrics
3. How We Use Your Information
Travel Booking and Service Provision
- Process and manage your travel reservations and bookings
- Arrange and coordinate travel service, accommodations, transportation, and tours
- Communicate booking confirmations, changes, cancellations, and travel updates
- Provide 24/7 customer support and emergency assistance during travel
- Handle travel insurance claims and assistance
- Manage group bookings and corporate travel arrangements
Third-Party Service Provider Coordination
Share necessary booking details with travel service providers including hotels and accommodation providers for reservations, tour operators and activity providers, travel insurance companies, and ground transportation providers.
Marketing and Communication
- Send newsletters about travel deals, destinations, and company updates (with your consent)
- Provide personalized travel recommendations based on your preferences
- Improve our website and services based on usage analytics
- Display relevant advertisements on social media platforms
Legal and Business Purposes
- Comply with legal obligations and regulations including anti-money laundering and counter-terrorism financing requirements
- Prevent fraud and ensure transaction security
- Resolve disputes and enforce our terms of service
- Maintain records for accounting and tax purposes
- Assist law enforcement agencies when legally required
4. Legal Basis for Processing
Depending on your jurisdiction, we process your personal data on the following legal grounds, as applicable: Contract Performance (processing booking information to fulfil our travel services contract with you); Consent (newsletter subscriptions, marketing communications and special categories of personal data, processed with your explicit consent); Legitimate Interest (using analytics data to improve our website and services while protecting your privacy rights); and Legal Obligation (processing required to comply with legal requirements, including travel documentation and safety regulations). These grounds are applied in accordance with the GDPR (EU/UK), PIPEDA (Canada), LGPD (Brazil), APPI (Japan), the Privacy Act and APPs (Australia), PDPA (Singapore), PIPA (South Korea), the Privacy Act 2020 (New Zealand), PDPL (UAE), LFPDPPP (Mexico) and the DPDPA 2023 (India).
5. Information Sharing and Disclosure
Travel Service Providers and Suppliers
As a travel Company, we share your booking information with relevant travel service providers to complete your reservations, including but not limited to hotels, resorts, and accommodation providers; local guides and activity providers; and ground transportation services.
Payment Processing
- Payment Processors: secure, PCI DSS compliant payment processors to handle credit card transactions
- Banking Partners: for processing payments and handling refunds
- Fraud Prevention Services: to verify transactions and prevent fraudulent activities
Technology Service Providers
- Google Analytics: website performance and user behavior analysis
- Facebook/Instagram: advertising campaign management and audience targeting
- Email Marketing Platform: newsletter distribution and management
- Customer Relationship Management (CRM) Systems: for managing customer interactions and bookings
- Cloud Storage Providers: for secure data storage and backup
Legal and Regulatory Requirements
We may disclose your information when required by law, court order, or to protect our legal rights and interests, including compliance with travel industry regulations, anti-money laundering and counter-terrorism financing requirements, customs and immigration authorities, and law enforcement agencies when legally obligated.
We do not sell your personal information to third parties for marketing purposes.
6. Data Retention
We retain your personal information for the following periods, in accordance with legal requirements and industry standards:
- Booking records: 10 years from the date of travel completion for potential claims and legal requirements
- Payment and financial information: 7 years for accounting, tax compliance, and fraud prevention purposes
- Passport and visa information: 7 years from travel completion or as required by immigration authorities
- Travel insurance records: 7 years from policy expiration
- Newsletter subscriptions: until you unsubscribe or withdraw consent
- Marketing preferences: 3 years from last interaction or until consent is withdrawn
- Website analytics: as per Google Analytics retention settings (typically 26 months)
- Customer service interactions: 3 years from last communication
- Legal correspondence and compliance records: as required by applicable law and regulatory authorities
7. Your Privacy Rights
Depending on your jurisdiction, you may have the right to access the personal information we hold about you; request correction of inaccurate or incomplete data; request erasure/deletion of your personal data (subject to legal retention requirements); restrict or object to certain processing; request data portability; unsubscribe from marketing communications at any time; and withdraw consent. Additional jurisdiction-specific rights apply under the GDPR (EU/UK), CCPA (California), PIPEDA (Canada), LGPD (Brazil), APPI (Japan), the APPs (Australia), PDPA (Singapore), PIPA (South Korea), the Privacy Act 2020 (New Zealand), PDPL (UAE), LFPDPPP/ARCO rights (Mexico) and the DPDPA (India), including the right to grievance redressal and the right to nominate under India’s DPDPA.
Note: Some rights may be limited where we have legal obligations to retain certain information for travel industry compliance, safety, or security purposes.
9. Travel Industry Specific Privacy Considerations
Passport and Government ID Processing
We collect and process passport and government-issued identification details solely for the purpose of facilitating travel bookings and meeting legal requirements. This information is shared only with authorized travel service providers and government authorities as required, and we implement enhanced security measures for the protection of identity documents.
Group Travel and Corporate Accounts
For group bookings, we may collect information about all travelers in the group. Corporate travel accounts may involve sharing information with designated corporate administrators, and we ensure appropriate consent mechanisms are in place for group and corporate bookings.
Emergency Contact and Assistance
Emergency contact information is maintained for traveler safety and assistance purposes. This information may be shared with local authorities, medical services, or family members in case of emergencies, and we maintain 24/7 access to emergency contact information for traveler assistance.
10. Data Security Measures
Technical Safeguards: encryption of sensitive data in transit and at rest using industry-standard protocols; PCI DSS compliant secure payment processing; multi-factor authentication and role-based access controls; regular security audits and penetration testing; and secure, certified data centers with physical access controls.
Organizational Safeguards: regular data protection training for all staff; strict procedures for handling sensitive travel documentation; due diligence and data protection agreements with all third-party providers; and comprehensive incident response and data breach notification procedures.
11. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies for essential website functionality and security, Google Analytics performance measurement, social media advertising and remarketing, personalized travel recommendations, and booking process optimization. You can manage cookie preferences through your browser settings or our cookie consent banner. For users in jurisdictions with specific cookie consent requirements (EU, UK, Brazil, etc.), we obtain appropriate consent before deploying non-essential cookies.
12. Children’s Privacy
Our travel services are not directed to children under the applicable age limits, which vary by jurisdiction: 13 years (United States, Canada); 16 years (European Union, or lower age set by member states); 18 years (India as per DPDPA, UAE); 14 years (South Korea); 12 years (Brazil, with parental consent). When processing information for family travel that includes minors, we ensure appropriate parental or guardian consent is obtained. Special procedures apply for unaccompanied minor travel arrangements.
13. Data Breach Notification
We are committed to notifying relevant authorities and affected individuals of data breaches in accordance with applicable laws, including within 72 hours to supervisory authorities for EU users; as soon as feasible for Canadian users; within a reasonable timeframe to the ANPD for Brazilian users; to the PPC for Japanese users (breaches affecting 1,000+ individuals); to the OAIC for Australian users; within 72 hours to the PIPC for South Korean users; to the Privacy Commissioner for New Zealand users where serious harm may result; to the UAE Data Office without undue delay; and to relevant authorities and the Data Protection Board for Mexican and Indian users as required.
14. Third-Party Links and Services
Our website may contain links to third-party websites, including airline websites, hotel booking platforms, and activity providers. This Privacy Policy does not apply to these external sites. We encourage you to review the privacy policies of any third-party sites you visit through our platform.
15. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable laws. We will notify you of material changes by posting the updated policy on our website with an updated effective date, sending email notifications for significant changes affecting your rights, and providing additional notice as required by applicable law.
16. Contact Information
For questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:
Travespert Tours and Travels
Email: connect@travespert.com
Phone: +91 80998 02044
Address: Link Road, Gandhinagar, Dibrugarh, Assam, 786001, India
Privacy Officer / Data Protection Contact: connect@travespert.com
24/7 Emergency Travel Assistance: +91 80998 02044
17. Regulatory Authorities and Complaints
If you believe we have not adequately addressed your privacy concerns, you have the right to file a complaint with the relevant data protection authority, such as your local Data Protection Authority (EU), the Information Commissioner’s Office (UK), the California Attorney General’s Office (US-California), the Office of the Privacy Commissioner of Canada, the ANPD (Brazil), the PPC (Japan), the OAIC (Australia), the PDPC (Singapore), the PIPC (South Korea), the Office of the Privacy Commissioner (New Zealand), the UAE Data Office, the relevant authority in Mexico, or the Data Protection Board of India. These authorities have the power to investigate complaints, issue penalties, and provide remedies for data protection violations under their respective jurisdictions.
18. Travel Industry Compliance Certifications
We maintain compliance with relevant travel industry standards and certifications, including IATA accreditation where applicable, PCI DSS compliance for payment processing, ISO 27001 information security management certification, and regular compliance audits and assessments.
19. Automated Decision-Making and Profiling
Where we engage in automated decision-making or profiling that produces significant effects (such as pricing algorithms or fraud detection), we will inform you about such processing, provide meaningful information about the logic involved, offer you the right to request human intervention (where required by applicable law), and allow you to contest the decision. This applies particularly to users in jurisdictions with specific automated decision-making protections such as the EU, Brazil, South Korea, and Mexico.