Privacy & Data Rights

Bijali Tours & Travels is the data fiduciary for personal data collected on this website, under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). We also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 where they still apply.

Bijali Tours & Travels, email booking@bijalitours.com, phone +91 98300 00000. The grievance officer uses the same desk.

• Enquiry: name, phone, email, trip type, destination, package tier, preferred month, and the page you submitted from.
• Payment proof: the same contact details, travel date, amount, UTR or UPI reference, and the screenshot you upload.
• Newsletter: email address.
• Technical data: browser type, approximate time, and the page address, which our host and our enquiry platform receive so the form can be delivered and abuse can be blocked.
• Booking file, once you confirm: traveller names, ages where a child fare applies, ID or passport details the supplier needs, and special requests you choose to tell us (rooms, meals, accessibility).

We do not ask you to store card numbers on this website. Bank and UPI payments are made on your bank’s own channel. Do not send passwords or full card data by email or WhatsApp.

• To answer your enquiry and prepare a quotation.
• To perform a booking: hotels, cars, guides, permits, flights, and visa packs you have asked for.
• To match a payment screenshot to a booking and issue a voucher or GST invoice.
• To send operational messages about your trip on email, phone, or WhatsApp.
• To send occasional trip notes if you subscribed, until you unsubscribe.
• To meet tax, accounting, and consumer-law record duties.
• To secure the website and investigate misuse.

Submitting an enquiry or payment proof is your consent for those booking purposes. Subscribing is your consent for marketing email. We do not sell personal data, and we do not use it to train public AI models.

• Suppliers who must deliver the trip: hotels, transporters, guides, airlines, insurers, and permit offices. They receive only what that booking needs.
• Our customer-relationship platform (1inall), which stores enquiry and payment-proof submissions so the desk can reply.
• Our website host, email provider, and bank, acting on our instructions or on yours when you pay.
• Authorities, if a law, court, or tax officer requires it.

International trips mean some of this data is sent to hotels or airlines outside India. That transfer is limited to what the booking needs. The DPDP Act allows transfers except to countries the Central Government restricts. The GDPR page explains the extra safeguards for people in the EU, EEA, and UK.

We do not knowingly take a booking from a child. A parent or legal guardian must submit the enquiry and consent to our use of a traveller’s data when that traveller is under 18. We use a child’s data only to arrange their travel and to meet legal duties such as permits and tickets.

• Unconfirmed enquiries: until you ask us to delete them, or 24 months after our last reply, whichever comes first.
• Confirmed bookings, invoices, and payment proofs: for the period Indian tax and company law requires, generally up to eight years after the financial year of the trip.
• Newsletter addresses: until you unsubscribe.
• Staff console session cookies: only for that signed-in session.

As a data principal you may ask us for a summary of the personal data we hold and the people we have shared it with, to correct or complete it, to erase it when the law allows, to withdraw consent, and to nominate another person to exercise these rights if you die or become unable to do so. Withdrawal does not undo use that was already lawful, and we may keep records we are legally required to keep.

Email booking@bijalitours.com with the subject “Data request”, from the address you used with us, and say what you want. We may ask for enough detail to be sure it is you. We aim to complete the request within 30 days. If you are unhappy with the reply, you may complain to the Data Protection Board of India once that route is open for your complaint.

The public site is served over HTTPS. Enquiry and payment uploads are sent to our desk through an authenticated server connection. Access to booking files is limited to staff who need them. These are our reasonable security practices. No method of transmission is perfectly secure; tell us at once if you think an email or form about your trip was compromised.

The public website does not set advertising or analytics cookies. The staff console uses one strictly necessary session cookie after an employee signs in. You can block cookies in your browser; the public enquiry and payment forms still work.

If we change this notice, we will update the date at the top. For a confirmed booking, the notice that applied when you accepted the quotation continues to cover that trip, plus any change the law requires.