Data Processing Agreement

Travelyaan acts as both a Data Controller (for our own customer data) and a Data Processor (when processing data on behalf of travel agency partners). This agreement establishes the framework for how personal data is collected, processed, stored, and deleted.

By using Travelyaan services, you acknowledge and consent to the data processing activities described in this document and our Privacy Policy.

Data Controller

Travelyaan (operating as a travel agency, currently unregistered as a formal legal entity) is the Data Controller for all personal data collected directly from customers through the Travelyaan website and services. Our operational addresses are located at 44, Tonk Rd, Sanganer, Pratap Nagar, Jaipur, Rajasthan 302033, India, and Madhu Kunj Nagar, Baswariya, Bettiah, West Champaran, Bihar 845438, India.

Technology Platform

Travelyaan uses Traveally.com as its CRM, booking management, and API platform. Traveally processes certain customer data on behalf of Travelyaan as a data sub-processor. Traveally's own privacy terms apply to their platform operations.

We process personal data under the following legal bases:

• Contractual Necessity: Processing required to fulfil your booking and travel services
• Legitimate Interests: Fraud prevention, platform security, and service improvement
• Consent: Marketing communications, cookies, and optional profiling
• Legal Obligation: Tax records, financial reporting, and regulatory compliance
• Vital Interests: Emergency contact processing during travel incidents

Standard Personal Data

• Identity data: Name, date of birth, nationality
• Contact data: Email address, phone number, postal address
• Financial data: Payment card details (tokenized), transaction history
• Technical data: IP address, device identifiers, browser information
• Usage data: Booking history, search queries, page interactions

Special Category Data (where required)

• Passport and identification documents (for visa processing)
• Health information (dietary requirements, medical conditions relevant to travel)

We engage trusted third-party sub-processors to operate our platform. All sub-processors are bound by data processing agreements and comply with applicable data protection regulations:

• Amazon Web Services (AWS): Cloud infrastructure and data storage
• Razorpay / Stripe: Payment processing
• MSG91: OTP and SMS communication services
• Google Analytics: Website analytics
• Cloudflare: CDN, DDoS protection, and performance
• SendGrid / SMTP2GO: Transactional email delivery

Some of our sub-processors operate outside India. When transferring personal data internationally, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by data protection authorities
• Adequacy decisions by relevant regulatory bodies
• Data transfer impact assessments as required

You have the right to exercise the following data subject rights at any time:

• Right to access your personal data (within 30 days of request)
• Right to correct inaccurate personal data
• Right to erasure ("right to be forgotten") where legally permissible
• Right to restrict or object to processing
• Right to data portability in a machine-readable format
• Right to withdraw consent without affecting previous lawful processing

Submit data requests to: dpo@travelyaan.com

In the event of a personal data breach, Travelyaan will:

• Contain the breach and begin an internal investigation immediately
• Notify the relevant data protection authority within 72 hours if required
• Notify affected individuals without undue delay if the breach poses a high risk to their rights
• Document the breach, its effects, and remedial actions taken

We retain personal data only for as long as necessary:

• Active customer accounts: Duration of account plus 2 years
• Booking and transaction records: 7 years (tax and legal compliance)
• Marketing consents: Until withdrawn or 3 years from last interaction
• Security logs: 12 months rolling

Upon account deletion, personal data is anonymized or permanently deleted within 30 days, except where retention is required by law.