Privacy Policy

TouringTour is a travel operating system for tour operators, travel agencies and destination management companies. It is operated by TouringTour Technologies Private Limited, a company incorporated in India with its registered office at:

You can reach us at care@touringtour.com or +91-9739-752-752.

In this policy, “we”, “us” and “our” mean TouringTour Technologies Private Limited. “You” means the person whose personal data we process — whether you are a visitor to our website, a user of the platform, or a traveller whose details one of our customers has entered into it.

This policy applies to touringtour.com, the TouringTour web and mobile applications, our APIs, and any support, sales or marketing interaction you have with us. It does not apply to:

• Third-party websites we link to, including supplier and payment gateway sites, which have their own policies.
• Websites our customers publish using Website Builder. Those sites are controlled by the customer, and the customer's own privacy policy applies to them.
• The internal handling of data by our customers once they export it from the platform.

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), we act in two distinct capacities, and your rights differ depending on which one applies.

As a Data Fiduciary.When we decide why and how personal data is processed, we are the Data Fiduciary. This covers data about our own customers and prospects: the account holder's name and contact details, billing records, support conversations, website analytics and marketing preferences.

As a Data Processor. When our customer — a tour operator, agency or DMC — uploads traveller records, itineraries, passport details or payment references into their TouringTour workspace, that customer is the Data Fiduciary and we process the data only on their documented instructions. If you are a traveller and want your data corrected or erased, please contact the travel company you booked with. If you approach us directly, we will refer you to them and assist them in responding.

Data you give us directly. Your name, business email, phone number, company name, role, and the content of any demo request, support ticket or survey response. If you subscribe to a paid plan, we also collect billing contact details, GSTIN where applicable, and the billing address.

Data created by using the platform. Account identifiers, workspace and user settings, audit logs of actions taken in the product, and records of features used. This is what lets us show an audit trail on a price change or a refund.

Technical data collected automatically. IP address, browser and device type, operating system, referring page, pages viewed, and timestamps. We use this for security, fraud prevention, diagnosing faults and understanding aggregate usage.

Payment data. We do not store complete card numbers or CVVs on our systems. Card payments are processed by PCI-DSS compliant payment gateways, and we retain only a masked reference, the transaction identifier, the amount and the status.

Sensitive personal data. Depending on how a customer configures their workspace, the platform may hold passport numbers, dates of birth, visa details, and occasionally dietary, accessibility or medical notes needed to operate a trip. We treat these as sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and apply the safeguards described in section 10.

Under the DPDP Act we process personal data either with your consent or for a legitimate use permitted by the Act. Where consent is the basis, you gave it through a clear affirmative action and you may withdraw it at any time — withdrawal is as easy as giving it, and it does not affect processing already carried out.

• To provide the platform — creating and running your workspace, storing your itineraries and traveller records, processing bookings through connected suppliers. Basis: performance of our contract with you.
• To bill you and meet tax obligations — invoicing, GST reporting, and statutory record-keeping. Basis: legal obligation and contract.
• To support you — answering tickets, diagnosing faults, and, only where you ask us to, accessing your workspace to reproduce an issue. Basis: contract and legitimate use.
• To secure the service — detecting fraud, abuse, credential stuffing and unauthorised access. Basis: legitimate use.
• To improve the product — aggregate, de-identified analysis of which features are used. Basis: legitimate use.
• To market to you — sending product updates, webinars and newsletters to business contacts. Basis: consent. Every such message carries an unsubscribe link.

We do not sell personal data, and we do not use traveller data that our customers upload to train any general-purpose machine learning model.

Our customers are responsible for having a lawful basis to enter traveller data into TouringTour, for giving travellers the notice the DPDP Act requires, and for responding to traveller requests. Our commitments to them are:

• We process traveller data only on the customer's documented instructions.
• We do not use it for our own purposes, and we do not disclose it except as set out in section 7.
• We keep it logically separated by workspace, with access controlled by role.
• We assist the customer in responding to Data Principal requests and in reporting personal data breaches.
• On termination we return or delete it in line with section 9.

Customers who need these commitments in contractual form can request a Data Processing Addendum at care@touringtour.com.

We share personal data only in these circumstances:

• Suppliers and distribution partners you choose to book through — global distribution systems, bed banks, airlines, hotels, transfer and ferry operators. To issue a booking we must pass the traveller details that supplier requires.
• Sub-processors that run parts of our infrastructure: cloud hosting, email and messaging delivery, error monitoring, analytics, and payment gateways. Each is bound by written obligations no less protective than this policy. The current list is available on request.
• Professional advisers — auditors, lawyers, accountants and insurers, under duties of confidentiality.
• Authorities, where disclosure is required by Indian law, a court order, or a lawful request from an agency authorised under the Information Technology Act, 2000. We assess every such request and disclose only what is legally required.
• An acquirer, if we are involved in a merger, acquisition or transfer of assets. We will give notice before your data becomes subject to a different privacy policy.

Personal data is stored by default in data centres located in India. Customers on eligible plans may request that their workspace be hosted in the European Union or in a data centre serving the Asia-Pacific region.

Because travel is inherently cross-border, some transfers outside India are unavoidable — a booking with an overseas hotel or airline requires sending traveller details to that supplier, and some of our sub-processors operate globally. The DPDP Act permits such transfers except to countries the Central Government restricts by notification; we monitor those notifications and will comply with them.

Where we transfer personal data originating in the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses and the additional safeguards described in our GDPR & International Transfers notice.

We keep personal data only as long as the purpose requires, or as long as Indian law obliges us to.

• Active workspace data — for as long as the subscription is active.
• After termination — customer data remains available for export for 30 days, after which it is deleted from live systems and purged from encrypted backups within a further 90 days.
• Invoices and tax records — retained for eight years as required under Indian tax and companies legislation.
• Security and audit logs — retained for up to 180 days as contemplated by the Information Technology Act and the CERT-In directions.
• Marketing contacts — until you withdraw consent, after which we retain a minimal suppression record so we do not contact you again by mistake.

We maintain reasonable security practices and procedures as required by section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011, aligned to the ISO/IEC 27001 control set. These include:

• Encryption in transit using TLS 1.2 or above, and encryption at rest for stored data and backups.
• Role-based access control, least-privilege administration and mandatory multi-factor authentication for staff.
• Logical separation of each customer workspace.
• Audit logging of access to customer data, retained and reviewable.
• Periodic vulnerability assessment and independent penetration testing.
• Background-verified personnel bound by confidentiality obligations.
• A documented incident response plan, tested at least annually.

If a personal data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act, and report to CERT-In within the timelines set by its directions. Where we act as processor, we will notify the affected customer without undue delay so they can meet their own obligations.

No system is perfectly secure. You are responsible for keeping your credentials confidential and for telling us promptly at care@touringtour.com if you suspect unauthorised use of your account.

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you and the processing activities undertaken.
• Correct, complete, update or erase your personal data, unless retention is required by law.
• Withdraw consent at any time, where consent was the basis for processing.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Grievance redressal — to have a complaint heard and answered within the timelines in section 14.

To exercise any of these, write to care@touringtour.com from the email address on your account. We may ask for proof of identity before acting, to make sure we are not disclosing your data to someone else. We respond within 30 days.

The DPDP Act also places duties on you as a Data Principal: not to impersonate another person, not to suppress material information, and not to file a false or frivolous complaint.

The platform is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18.

Traveller records may legitimately include minors — a family booking, a school group. Where a customer processes a child's data through TouringTour, the customer is responsible for obtaining verifiable consent from a parent or lawful guardian as the DPDP Act requires. Neither we nor our customers may use a child's personal data for tracking, behavioural monitoring or targeted advertising.

We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. With your consent we also use analytics and preference cookies. You can change your choice at any time. Full detail — including each cookie's purpose and lifetime — is in our Cookie Policy.

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, the following officer may be contacted about any grievance concerning your personal data or your use of the platform.

We acknowledge every grievance within 24 hours of receipt and resolve it within 15 days, as required by the IT Rules, 2021. If your complaint needs more time, we will tell you why and give you an expected date.

If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India, or to the appropriate consumer redressal forum under the Consumer Protection Act, 2019. The full escalation ladder is set out on our Contact page.

We may update this policy as the product, the law or our sub-processors change. The “last updated” date at the top of this page always reflects the current version.

If a change materially affects how we handle your personal data, we will give at least 30 days' notice by email to account administrators and by notice in the product before it takes effect. Continuing to use TouringTour after that date means you accept the revised policy.