Xplore Holiday (“we”, “us”, “our”, or “the Company”) values your privacy and is committed to protecting the personal information you share with us through our website, enquiry forms, email, telephone, WhatsApp, social media, or any other communication channel.
This Privacy Policy explains how we collect, use, store, share, and safeguard your personal data when you visit our website or use our travel-related services. As Xplore Holiday operates from India, this Policy is framed in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000, together with the rules framed thereunder.
By providing your personal data to us, you confirm that you have read and understood this Policy. Where the law requires your consent, we will obtain it before processing your personal data.
1. Who We Are (Data Fiduciary)
For the purposes of the DPDP Act, Xplore Holiday is the “Data Fiduciary” that determines the purpose and means of processing your personal data. You, as the individual whose personal data is processed, are the “Data Principal”. Our contact details are provided in the “Grievance Redressal & Contact” section below.
2. Information We Collect
We collect only the information reasonably required to respond to your enquiries and deliver travel services. This may include:
- Full name
- Email address
- Phone or WhatsApp number
- City and country of residence
- Travel destination preferences, travel dates and number of travellers
- Passport, visa, or government-issued identity details, where required for bookings, permits, or ticketing
- Payment and billing details (processed through authorised payment channels)
- Special requests relating to travel, hotels, meals, health, accessibility, or group arrangements
We may also automatically collect limited technical information when you visit our website, such as browser type, device information, IP address, pages viewed, and enquiry activity, in order to improve our website and services.
Where you provide us with personal data relating to any other person (for example, co-travellers or family members), you confirm that you are authorised to share their information and to agree to this Policy on their behalf.
3. Lawful Basis and Consent
We process your personal data on the basis of your consent and/or for the legitimate purposes permitted under the DPDP Act, including the performance of services you request from us. Where processing is based on consent, that consent is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and limited to the purposes notified to you.
You may withdraw your consent at any time by contacting us using the details below. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal. Please note that withdrawing consent may limit or prevent our ability to provide certain travel services.
4. How We Use Your Information
- Respond to your travel enquiries
- Prepare tour packages, itineraries, and quotations
- Book hotels, flights, transport, permits, and other travel services
- Coordinate with destination partners, hotels, airlines, transport providers, and local operators
- Provide customer support before, during, and after travel
- Send booking confirmations, trip updates, and important travel information
- Improve our website, services, and customer experience
- Send promotional offers or newsletters, only where permitted by law or with your consent
- Comply with legal, regulatory, accounting, and audit obligations
5. Sharing of Information
We share your personal data only to the extent necessary to arrange your travel services. Such recipients may include hotels, airlines, transport companies, local guides, visa and permit partners, insurance providers, event venues, destination management partners, payment service providers, and government or regulatory authorities where required by law.
Where third parties process personal data on our behalf, we engage them under appropriate contractual arrangements requiring suitable security and confidentiality safeguards, consistent with the DPDP Act.
We do not sell your personal data to any third party.
6. Cross-Border Transfers
Some of your travel services may be delivered outside India (for example, Nepal, Bhutan, or South East Asia). Where the delivery of services requires it, your personal data may be shared with service providers located outside India. Any such transfer is made only as necessary to provide the services you have requested and subject to applicable restrictions under the DPDP Act and any notifications issued by the Government of India.
7. Children’s Data
We do not knowingly process the personal data of a child (a person below eighteen years of age) without the verifiable consent of a parent or lawful guardian. We do not undertake any tracking, behavioural monitoring, or targeted advertising directed at children. Where a booking involves a minor, the responsible adult must provide the relevant information and consent on the child’s behalf.
8. Data Security
We implement reasonable security practices and procedures to protect your personal data from unauthorised access, misuse, alteration, loss, or disclosure. However, no online platform, email communication, or digital system can be guaranteed to be completely secure, and you share information with us at your own risk to that extent. In the event of a personal data breach, we will take appropriate action and provide notifications as required under applicable law.
9. Data Retention
We retain your personal data only for as long as necessary to deliver travel services and to meet legal, regulatory, accounting, dispute-resolution, customer-support, and business-record requirements. When personal data is no longer required for these purposes, we will erase it, unless retention is required or permitted by law.
10. Cookies
Our website may use cookies or similar technologies to improve your browsing experience, understand visitor behaviour, and enhance website performance. You may disable cookies through your browser settings; however, some website features may not function properly as a result.
11. Your Rights as a Data Principal
Subject to applicable law and to legal, operational, and booking-related requirements, you have the right to:
- Access information about the personal data we process about you
- Request correction, completion, or updating of inaccurate or incomplete personal data
- Request erasure of your personal data where it is no longer required
- Withdraw consent previously given
- Nominate another individual to exercise your rights in the event of death or incapacity
- Raise a grievance regarding the processing of your personal data
To exercise any of these rights, please contact us using the details in the “Grievance Redressal & Contact” section. We may need to verify your identity before acting on your request.
12. Your Duties as a Data Principal
Under the DPDP Act, you are expected to provide accurate and complete information, not to impersonate another person, and not to raise false or frivolous grievances or complaints. Providing incorrect documentation for bookings, permits, or ticketing may result in service failure for which Xplore Holiday is not responsible.
13. Third-Party Links
Our website may contain links to third-party websites. Xplore Holiday is not responsible for the content, policies, or practices of any third-party websites. We encourage you to read the privacy policies of any external site you visit.
14. Updates to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The current version is published on our website with the “Last Updated” date shown above.
15. Grievance Redressal & Contact
If you have any questions, requests, or grievances regarding this Policy or the processing of your personal data, please contact our Grievance Officer / Data Protection Contact:
Xplore Holiday
Grievance Officer
Siliguri, Darjeeling District, West Bengal, India
Email: hello@xploreholidays.com
We endeavour to acknowledge and respond to grievances within the timelines prescribed under applicable law.