Privacy Policy

1. Introduction

Teresa Travels (“we,” “us,” or “our”) is a travel services company headquartered in Agartala, West Tripura, India, offering curated tour packages, destination bookings, travel planning, and related services across Northeast India and international destinations.

We are committed to safeguarding your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you interact with our website www.teresatravels.com, mobile applications (if any), or engage with our services through bookings, inquiries, phone calls, emails, or WhatsApp.

This policy is prepared in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 of India, the Information Technology Act, 2000 (as amended in 2008), and incorporates transparency principles consistent with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) for international visitors.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy. Where required by law, we will obtain your explicit consent before processing your personal data.

2. Information We Collect

We may collect the following categories of personal data:

a) Information You Provide Directly

• Full name, email address, phone number, and postal address
• Travel dates, destination preferences, number of travelers
• Passport or government-issued ID details (for booking confirmations, visa processing)
• Payment information (processed securely via third-party gateways — we do not store full card numbers, CVVs, or bank PINs on our servers)
• Special requests, dietary requirements, accessibility needs
• Messages, feedback, and reviews you provide

b) Information Collected Automatically

• IP address, browser type, device identifiers, operating system
• Pages visited, time spent, referral URLs, click patterns
• Cookies, local storage tokens, and session identifiers
• Approximate geographic location (derived from IP)

c) Information from Third Parties

• Analytics data from Google Analytics
• Payment confirmation from Razorpay, Stripe, or other gateways
• Social media profile information (if you log in via social accounts)

3. How We Collect Information

• Website forms: Enquiry forms, booking forms, newsletter sign-up, grievance forms
• Direct communication: Phone calls, emails, WhatsApp messages
• Cookies and analytics: Automatically via browser cookies, Google Analytics, Firebase Analytics
• Third-party integrations: Payment gateways upon transaction completion
• Bookings: When you or your travel agent makes a reservation through us

4. Purpose of Processing

We process your personal data for the following purposes:

• Service delivery: To process bookings, arrange tours, coordinate with hotels and transport providers, and fulfill your travel itinerary
• Communication: To respond to inquiries, send booking confirmations, provide travel updates, and offer customer support
• Website improvement: To analyse usage patterns, optimise performance, fix issues, and personalise your experience
• Legal compliance: To comply with tax laws, visa regulations, anti-money laundering requirements, and court orders
• Marketing: To send promotional offers, newsletters, and travel inspiration — only with your explicit consent, which you can withdraw at any time
• Security: To protect our website and systems from fraud, unauthorized access, and abuse

5. Legal Basis for Processing

Under the DPDP Act 2023 and applicable laws, we process your data based on:

• Consent: Where you have given clear, informed, and voluntary consent (e.g., submitting an enquiry form, subscribing to newsletters). You may withdraw consent at any time.
• Contractual necessity: Where processing is required to fulfill a booking contract or pre-contractual steps (e.g., processing your tour reservation)
• Legitimate interest: For website security, fraud prevention, and improving our services — balanced against your rights
• Legal obligation: Where we are required by Indian law to retain or disclose certain information (e.g., financial records under the Income Tax Act)

6. Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share information with:

• Service providers: Airlines, hotels, transport operators, local guides, and tour operators — only the information necessary to fulfill your booking
• Payment processors: Razorpay, Stripe, or other gateways for secure transaction processing
• Analytics providers: Google Analytics and Firebase (anonymised/aggregated data)
• Legal authorities: Government agencies, courts, or regulatory bodies when required by law, subpoena, or to protect rights and safety
• Professional advisors: Lawyers, auditors, or insurers as needed for business operations

All third-party service providers are contractually required to protect your data and use it only for the purposes specified.

7. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Booking records: 7 years from the date of travel (as required under Indian tax and commercial laws)
• Enquiry data: Up to 2 years from your last interaction, unless you request earlier deletion
• Marketing preferences: Until you withdraw consent or unsubscribe
• Analytics data: Retained in anonymised/aggregated form; identifiable data purged within 26 months
• Legal hold: Data may be retained longer if required for ongoing legal proceedings or regulatory audits

After the retention period, data is securely deleted or anonymised so it can no longer be associated with you.

8. Your Rights

Under the DPDP Act 2023 and applicable data protection laws, you have the following rights:

• Right to Access: Request a summary of the personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
• Right to Withdraw Consent: Withdraw previously given consent at any time; this will not affect the lawfulness of processing done before withdrawal
• Right to Grievance Redressal: File a complaint with our Grievance Officer or, if unresolved, with the Data Protection Board of India
• Right to Nominate: Under the DPDP Act, you may nominate another person to exercise your rights in the event of your death or incapacity

How to exercise your rights: Email us at teresatravels01@gmail.com with the subject line “Privacy Request” or use the form below. We will respond within 30 days as required under the DPDP Act.

9. Data Security

We implement reasonable technical and organisational safeguards to protect your personal data, including:

• HTTPS/TLS encryption for all data transmitted between your browser and our servers
• Firebase Security Rules restricting database access to authorised operations
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security reviews and software updates
• Secure, PCI-DSS-compliant payment processing through third-party gateways

While we strive to protect your data using commercially reasonable measures, no system is completely secure. We cannot guarantee absolute security of data transmitted over the internet or stored electronically.

10. Cookies & Tracking Technologies

Our website uses the following types of cookies:

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect site functionality.

11. International Data Transfers

Our website is hosted on Firebase/Google Cloud infrastructure, which may process data in servers located outside India. Where such transfers occur, we ensure adequate protections are in place, including:

• Google Cloud's compliance with international data protection standards
• Standard Contractual Clauses (SCCs) where applicable
• Any transfer mechanisms prescribed by the DPDP Act Rules

For international bookings (e.g., Bhutan, Dubai, Thailand), we share only the minimum necessary data with foreign service providers to fulfill your itinerary.

12. Children's Data

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from minors without verifiable parental or guardian consent.

If a booking includes minor travelers, we collect only the information necessary for the booking (name, age, ID details) with the consent of the accompanying parent or legal guardian. Under the DPDP Act, processing of children's data requires verifiable parental consent, and we do not engage in tracking or behavioural monitoring of minors.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make material changes:

• We will update the “Last Updated” date at the top of this page
• For significant changes, we will notify you via email (if you are a registered user) or by a prominent notice on our website
• Continued use of our services after changes constitutes acceptance of the updated policy

We encourage you to review this page periodically to stay informed about how we protect your data.

14. Contact & Grievance Officer

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

15. Disclaimer

This Privacy Policy is provided for informational purposes and does not constitute legal advice. Teresa Travels does not guarantee the approval of any visa, booking confirmation, or travel arrangement — such outcomes depend on third-party providers, government authorities, and other factors beyond our control.

Data usage is limited strictly to the purposes stated in this policy. For specific legal concerns regarding your personal data rights, please consult a qualified legal professional.

This policy is governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts in Agartala, Tripura.