Privacy Policy

This Privacy Policy is published in compliance with Section 43A of the Information Technology Act, 2000, Rule 4 of the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and the Digital Personal Data Protection (DPDP) Act, 2023.

Tripdhara Travel & Rentals India operates as a registered Data Fiduciary in Dehradun, Uttarakhand. We determine the purpose and means of processing personal data provided by users ("Data Principals") seeking mountain transport, vehicle rentals, homestay reservations, and Himalayan adventure itineraries across Uttarakhand, Himachal Pradesh, and border regions.

In accordance with the statutory principle of Data Minimization, Tripdhara collects only personal data strictly necessary to fulfill travel itineraries and satisfy statutory requirements:

• Identity & Contact Details: Full Legal Name, Mobile / WhatsApp Phone Number, Email Address, and Emergency Contact numbers.
• Government Identity Proofs (Statutory Mandatory): Copies of Aadhaar Card, Passport, Indian Tourist Visa (for foreign nationals), or Driving License. These are collected strictly for Inner Line Permits (ILP), SDM border passes, Army checkpost verifications, or Bureau of Immigration (Form-C) compliance.
• Trip Specifications & Preferences: Booking dates, duration, passenger count, pickup locations, vehicle preferences, and medical self-declarations for outdoor adventure sports.
• Technical & Device Data: IP address, device type, browser specifications, and user interaction metrics collected anonymously for web performance optimization.

Tripdhara processes personal data strictly under valid statutory grounds established under Indian law:

• Specified Consent (Section 5, DPDP Act): Consent freely given by the Data Principal when submitting web inquiry forms or initiating WhatsApp conversations with our itinerary planners.
• Certain Legitimate Uses (Section 7, DPDP Act): Processing necessary to fulfill statutory obligations under the Motor Vehicles Act 1988 (vehicle permits), Police Verification rules, and Tourism Board registration mandates.
• Emergency Medical Response: Processing necessary to respond to medical emergencies or severe weather evacuations in high-altitude zones.

Tripdhara implements reasonable security practices and procedures as mandated under Rule 8 of the IT SPDI Rules 2011:

• Encryption & Access Controls: All digital communications are secured via TLS 1.3 encryption. Internal access to customer identity documents is restricted to authorized compliance personnel only.
• Purging Schedule: Government identity documents submitted for Inner Line Permits or Form-C filing are permanently deleted from active servers within 30 days after trip completion.
• Tax Audit Archives: Booking invoices containing contact data are retained for 6 years strictly to comply with Central GST (CGST) and Income Tax Act statutory audit requirements.

Tripdhara enforces a strict zero-monetization data protection policy:

Personal data is shared strictly on a need-to-know basis with:

• Fulfillment Partners: Verified local homestay hosts, assigned mountain chauffeurs, and adventure instructors to facilitate trip logistics.
• Government Authorities: Sub-Divisional Magistrates (SDM), Regional Transport Offices (RTO), State Police, or Indian Army checkposts upon statutory demand or emergency safety orders.

Under Chapter III of the Digital Personal Data Protection Act, 2023, you enjoy enforceable statutory rights:

• Right to Access Summary (Section 11): Request a complete summary of personal data processed by Tripdhara along with identities of processing entities.
• Right to Correction & Erasure (Section 12): Request correction of inaccurate personal data or complete deletion ("Right to be Forgotten") once booking purposes are satisfied.
• Right to Grievance Redressal (Section 13): Access ready means of grievance redressal provided by our Data Protection Officer.
• Right to Nominate (Section 14): Nominate any individual to exercise data principal rights on your behalf in the event of death or incapacity.
• Right to Withdraw Consent: Revoke consent at any time without affecting the lawfulness of processing prior to withdrawal.

In compliance with the Telecom Commercial Communications Customer Preference Regulations (TCCCPR, 2018) issued by TRAI:

• Explicit Opt-In: Messaging via WhatsApp is initiated voluntarily by clicking pre-formatted trip inquiry links.
• Opt-Out Mechanism: You can opt out of non-essential transactional updates at any time by replying "STOP" or notifying our helpline.

Our platform utilizes Google Tag Manager (`GTM-5JKHT2T3`) and Google Analytics (`G-QPMEDXNFDK`) for aggregated telemetry:

• No Personally Identifiable Information (PII) is captured via analytics cookies.
• Users can configure browser settings to block analytical cookies without affecting core booking form functionality.

In compliance with Section 10 of the DPDP Act 2023 and Rule 5(9) of the Consumer Protection (E-Commerce) Rules 2020, the contact details of our Data Protection Officer / Grievance Redressal Officer are published below: