GDPR & International Transfers

Our primary regulatory framework is Indian — the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, covered in our Privacy Policy.

Many of our customers are DMCs and operators handling European travellers, which brings the GDPR into play. This notice sets out the additional commitments we make in that context. Where it conflicts with the Privacy Policy in respect of personal data protected by the GDPR, this notice prevails.

We are a processor for traveller data, itineraries, booking records and communications that you upload or generate in your workspace. You are the controller. We act only on your documented instructions.

We are a controller for our own business data: your account contacts, billing records, support correspondence and website analytics. Our lawful bases are contract, legal obligation, consent for marketing, and legitimate interests for security and product improvement.

We offer a Data Processing Addendum meeting Article 28 GDPR, which on execution forms part of your agreement. It covers subject matter and duration, nature and purpose, categories of data and data subjects, confidentiality of personnel, security measures, sub-processor terms, assistance with data subject rights and impact assessments, breach notification, deletion or return on termination, and audit rights.

Request a copy at care@touringtour.com with DPA REQUEST in the subject line.

India has not received an adequacy decision from the European Commission. Where personal data protected by the GDPR is transferred to us in India, or onward to a supplier or sub-processor outside the EEA, we rely on:

• the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, incorporating Module Two (controller to processor) or Module Three (processor to processor) as applicable;
• the UK International Data Transfer Addendumissued by the Information Commissioner's Office, for data subject to the UK GDPR;
• a documented transfer impact assessment, reviewed periodically and on any material change in law; and
• where a booking requires it, the Article 49(1)(b) derogation for transfers necessary to perform a contract with the data subject — for example, sending passenger details to an airline or hotel to issue a reservation.

• Encryption in transit (TLS 1.2+) and at rest, with keys managed separately from the encrypted data.
• Least-privilege access, mandatory multi-factor authentication for staff, and audit logging of access to customer data.
• Data minimisation — we ask customers to store only the traveller data a trip actually requires.
• A documented policy of challenging any overbroad or unlawful government request for data, disclosing only what is legally compelled.
• A transparency commitment to notify affected customers of any government access request, unless legally prohibited from doing so.

Data subjects have the right of access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions producing legal effects.

Where we act as processor, requests should go to the travel company that controls the data. If a data subject contacts us directly, we will not respond substantively but will forward the request to the relevant customer without undue delay and assist them in answering it — including through self-service export, correction and deletion tools in the product.

Where we act as controller, write to care@touringtour.com and we will respond within one month, extendable by two further months for complex requests, as Article 12(3) permits.

As processor, we notify the affected controller without undue delay after becoming aware of a personal data breach, with the information Article 33(3) requires so far as it is available to us, and we supplement it as the investigation progresses.

As controller, we notify the competent supervisory authority within 72 hours where the breach is likely to result in a risk to individuals, and notify individuals directly where the risk is high. In parallel we meet our Indian obligations to the Data Protection Board of India and CERT-In.

We engage sub-processors for hosting, messaging delivery, error monitoring, analytics and payments. Each is bound by written terms imposing data protection obligations no less protective than our own, and we remain fully liable to you for their performance.

The current list is available at care@touringtour.com. Customers with an executed DPA receive at least 30 days' notice of any new or replacement sub-processor and may object on reasonable data protection grounds; if we cannot accommodate the objection, you may terminate the affected service and receive a refund of the unused prepaid portion.

The default hosting region is India. Customers on eligible plans may request hosting in the European Union, which keeps workspace data at rest within the EEA and reduces the volume of transfers requiring Standard Contractual Clauses.

Residency cannot eliminate transfers entirely: booking a trip with a supplier outside the region necessarily sends traveller details to that supplier, on the basis described in section 4.

Our Data Protection Officer is Arun, reachable at care@touringtour.com or +91-9739-752-752.

We have not appointed an Article 27 representative in the EU or UK. If your contract requires one, tell us and we will arrange an appointment before processing begins.

Data subjects in the EEA or UK may also lodge a complaint with their local supervisory authority.