Privacy Policy

We collect only what a booking actually requires. Nothing on this list is gathered speculatively.

Identity and contact

Name, email, phone number and billing address, given when you create an account or submit an enquiry.

Traveller details

Ages of travellers, passport or government ID numbers where a hotel or permit requires them, and any dietary, medical or accessibility needs you choose to disclose so we can brief the operator.

Booking records

Journeys viewed, quotes issued, itineraries confirmed, dates, payment status and correspondence with our team.

Payment data

Handled by our payment gateway. We receive the last four digits, card network and authorisation result. Full card numbers never reach our servers.

Technical data

IP address, browser and device type, pages visited and referring URL. Used for security, fraud prevention and aggregate statistics.

Content you upload

Review text, ratings and any photographs you attach to a review. These are published under the name on your account.

Sensitive categories — health conditions, dietary requirements revealing a religious observance — are collected only when you volunteer them for a specific trip, used only to arrange that trip, and deleted with the booking record.

• To quote, confirm and deliver the journey you asked for — our primary contractual basis.
• To pass the details a supplier genuinely needs: a hotel needs guest names, a permit office needs ID numbers, a driver needs a pickup time.
• To take payment and issue invoices, and to meet the tax and record-keeping rules we are bound by.
• To answer your questions and keep a record of what was agreed, which protects both sides in a dispute.
• To send service messages about a booking you hold. These are not marketing and cannot be opted out of while the booking is live.
• To send travel ideas and offers, only where you have opted in. Every such email carries a one-click unsubscribe.
• To understand which pages and journeys perform, using analytics cookies you have consented to.
• To detect fraud, abuse and automated scraping, and to keep accounts secure.

We set strictly necessary cookies without asking, because the site cannot sign you in or remember your wishlist without them. Everything else — preferences, analytics, marketing — runs only after you opt in, and you can change that decision at any time from the cookie settings link in the footer.

The Cookie Policy lists every category, what sits in it, and how long each entry lasts.

We do not sell personal data, and we do not trade it for advertising. Disclosure happens in four situations only.

Travel suppliers

Hotels, guides, drivers, permit offices and activity operators receive the minimum needed to honour your booking — typically names, dates and any requirement they must plan around.

Service providers

Payment gateways, email delivery, cloud hosting, image storage and error monitoring. Each is bound by contract to process data only on our instructions.

Professional advisers

Auditors, accountants and lawyers, where they need records to advise us or to defend a claim.

Authorities

Where a law, court order or valid police request compels disclosure. We disclose the narrowest set that satisfies the request.

Some suppliers and providers sit outside India. Where they do, transfers rely on contractual safeguards and we remain accountable for what happens to your data.

Booking and invoice records

Eight years from the end of the financial year in which the trip took place, which is the tax retention period we are bound by.

Account data

For as long as the account is open. Delete the account and the profile goes within thirty days, except where a record must be kept for tax.

Enquiries that never became bookings

Twenty-four months, then deleted.

Passport and ID numbers

Deleted once the trip is complete and no supplier dispute is open — typically within ninety days of return.

Published reviews

Kept until you ask us to remove them. Deleting your account anonymises the review rather than erasing the rating.

Cookie consent record

Twelve months, after which we ask again.

Under the Digital Personal Data Protection Act 2023, and under the GDPR where it applies to you, you can exercise all of the following. We do not charge for any of them and we do not degrade your service for asking.

• Ask for a copy of the personal data we hold about you, with a summary of how it has been used and shared.
• Have inaccurate or incomplete data corrected.
• Have data erased where we no longer have a lawful reason to keep it.
• Withdraw consent for anything that relied on consent — marketing email, optional cookies — without affecting what was lawful before.
• Object to processing based on our legitimate interests, and ask us to restrict processing while a dispute is open.
• Receive your data in a portable, machine-readable format.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Complain to the Data Protection Board of India, or your local supervisory authority.

Email us from the address on the account to exercise any of these. We may ask one verification question before acting on a deletion request, because acting on a spoofed request would itself be a breach.

• Traffic to and from this site is encrypted in transit over HTTPS.
• Passwords are stored as salted one-way hashes. Nobody here can read your password, and we will never ask you for it.
• Access to booking records is limited to staff who need it to service your trip, and administrative access requires a separate account.
• Card details are entered on our payment provider’s hosted form and never traverse our servers.
• Uploaded images are size- and type-checked on the server, not only in your browser.

No system is perfect. If a breach ever affects your personal data, we will notify you and the Data Protection Board without undue delay, and tell you what was exposed rather than issue a vague advisory.

Accounts are for adults of eighteen or over. Children travel as named travellers on an adult’s booking, and we collect a child’s details only from the adult making that booking. We do not profile children or send them marketing.

When this policy changes materially we update the date at the top and, for registered users, send a notice to the email on the account. Continuing to use the site after a change means the revised policy applies — but a change can never retroactively widen consent you already gave.

Questions about your personal data or this policy go to our team directly. We aim to acknowledge within one working day and to resolve within thirty days, which is the statutory ceiling for a data request under the DPDP Act.

Email

supportkamba@gmail.com

Phone

+91 70196 88177 (Mon – Sat, 9:30am – 7:00pm IST)

Registered office

Kamba Trips Journeys Pvt Ltd, Ideal Homes, Near Nimishamba Temple, RR Nagar, Bengaluru, Karnataka 560098, India

If you are not satisfied with our response, you may escalate to the Data Protection Board of India, or to your local supervisory authority if you are resident in the EEA or the UK.