Privacy Policy

1. Who we are

This policy applies to https://xenevatravels.com and to the booking services provided through it. The data fiduciary is:

We handle personal data under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 with its associated rules.

2. What we collect

2.1 Information you give us

• Booking details: lead traveller name, email address, mobile number, and the billing address, city, state and PIN code required on a GST invoice.
• Journey details: which journeys you booked, traveller numbers, dates and any request you send us about a trip.
• Correspondence: whatever you write in the contact form, by email, or over the phone with us or your operator.

2.2 Information collected automatically

• Technical data: IP address, browser and device type, pages viewed and the time of your visit — used to keep the site working and secure.
• Analytics: if a Google Analytics property is configured, aggregated usage statistics. These do not identify you personally.

2.3 Payment information

We never see or store your payment credentials. UPI payments are processed by MMADPay. Your UPI PIN, card number and bank login are entered inside your own bank or UPI app and are never transmitted to us. We receive only a transaction reference, the amount and a success or failure result.

3. Why we use it

• To create your booking, take payment, and issue your travel voucher and GST invoice.
• To pass the minimum necessary details to the local operator running your journey, so they can meet you.
• To contact you about a booking — confirmations, pickup times, delays and changes.
• To answer enquiries and handle cancellations, refunds and grievances.
• To meet legal obligations, including GST records and statutory retention periods.
• To detect and prevent fraudulent or abusive bookings.

4. Who we share it with

We do not sell your personal data, and we do not share it for anyone else's advertising. We share only what is necessary, with:

• Local travel operators — your name, mobile number and journey details, so the driver or guide can find you. Nothing more.
• MMADPay, our payment gateway, to process the transaction and any refund.
• Hosting, email and analytics providers who operate the site on our behalf under confidentiality obligations.
• Government or law-enforcement authorities where we are legally required to disclose.

5. How long we keep it

Booking and invoice records are kept for eight years, as required by Indian tax law. Enquiry correspondence is kept for up to three years. Analytics data is retained in aggregate. When a retention period ends, data is deleted or irreversibly anonymised.

6. Your rights

As a data principal you may ask us to:

• Confirm what personal data of yours we hold, and give you a copy.
• Correct anything inaccurate or incomplete.
• Erase data we no longer have a legal reason to keep.
• Withdraw consent for optional processing, such as marketing email.
• Nominate someone to exercise these rights if you are unable to.

Write to grievance@xenevatravels.com and we will respond within 30 days. We may ask you to verify your identity first, so that nobody else can request your data.

7. Security

The site is served over HTTPS. Access to booking records is restricted to authorised staff, administrator passwords are stored as bcrypt hashes, and payment data never touches our systems. No system is perfectly secure, but if a breach affects your personal data we will notify you and the Data Protection Board as required.

8. Cookies

We use a session cookie to keep the site working, and your browser's local storage to remember your trip list between pages. If analytics is enabled, that provider sets its own cookies. You can clear or block cookies in your browser; the trip list will simply reset.

9. Children

This site is not directed at children under 18, and we do not knowingly collect their data. Children travel with us regularly, but the booking must be made by an adult. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy as our services or the law change. The revision date at the top always reflects the current version, and material changes will be notified by email to travellers with an active booking.

11. Grievance Officer

Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, you may contact our grievance officer:

12. Governing law

This policy is governed by the laws of India. The courts at Delhi have exclusive jurisdiction over any dispute arising from it.