TripHexa Privacy Policy

1. INTRODUCTION AND SCOPE

This Privacy Policy explains how TripHexa Private Limited (“TripHexa”, “we”, “us” or “our”) collects, uses, stores, discloses and otherwise processes personal information in connection with the TripHexa Platform.

TripHexa is intended to operate as a technology-enabled travel platform, SaaS and marketplace/intermediary connecting Travellers with independent Curators offering travel experiences. TripHexa facilitates discovery, enquiries, communication, booking and related platform functionality and may facilitate payment processing and settlement through appropriate service providers.

TripHexa is not ordinarily the organiser or provider of the underlying Travel Experience. Accordingly, personal information may also be processed independently by a Curator for purposes connected with providing a booked Travel Experience. Such independent processing is subject to the Curator’s own legal obligations and applicable terms.

This Privacy Policy applies to information processed by TripHexa through its website, application, Platform, booking processes, communications and related services.

By using the Platform, you acknowledge the practices described in this Privacy Policy.

2. INFORMATION WE COLLECT

TripHexa collects only information that is reasonably relevant to operating the Platform, facilitating transactions, providing support, meeting legal obligations and carrying out other legitimate business purposes.

The categories of information collected may vary depending on how you use the Platform. Not every category will be collected from every user.

2.1 Information Provided by Travellers

Depending on the service used, TripHexa may collect:

• name, email address and telephone/mobile number;
• account credentials and profile information;
• date of birth or age information where required for a Trip;
• identity, KYC, PAN, passport or other travel-document information where required;
• emergency contact information;
• travel preferences and Trip-related requirements;
• enquiry, Booking, cancellation and modification information;
• communications with TripHexa or Curators through the Platform;
• payment, transaction, refund and settlement-related information;
• reviews, ratings, photographs and other User Content; and
• location information where voluntarily provided or reasonably necessary for the relevant Platform functionality.

2.2 Information Provided by Curators

TripHexa may collect information necessary to register and manage Curators, including:

• name and contact information;
• address and business/entity information;
• KYC and identity documentation;
• PAN and GST details, where applicable;
• bank and settlement information;
• permits, licences or other business documentation where applicable;
• Curator profile information;
• Trip descriptions, itineraries, prices, photographs, videos and other listing content;
• communications with TripHexa and Travellers; and
• Booking, transaction and settlement records.

2.3 Information About Other Persons

A Traveller or Curator may provide information relating to another person, such as a co-Traveller, guest, family member, group member or emergency contact.

A person providing such information should do so only where reasonably appropriate and, where required by applicable law, with the relevant person’s knowledge or permission.

TripHexa may use such information only for the purposes for which it was provided or otherwise as permitted by applicable law.

2.4 Information Collected Automatically

When users access or interact with the Platform, TripHexa may collect certain technical and usage information, where such functionality is implemented, including:

• IP address;
• device and browser information;
• operating system and application information;
• device or technical identifiers;
• log and diagnostic information;
• pages, screens or features accessed;
• interaction and usage information;
• referral information; and
• approximate location derived from technical information where applicable.

The exact information collected may depend on the device, Platform functionality and technical configuration.

3. BOOKING, PAYMENT AND TRANSACTION INFORMATION

TripHexa may process information relating to enquiries, Bookings, cancellations, modifications, payments, refunds, chargebacks, invoices, receipts, settlements and related communications.

Payment information may be collected and processed by TripHexa and/or designated payment service providers, depending on the payment method and technical arrangement used.

TripHexa does not represent that it stores complete card numbers, CVV details, banking credentials or other payment credentials unless expressly stated or required by the relevant payment arrangement.

Where third-party payment infrastructure is used, the relevant payment provider may independently process payment information in accordance with its own terms and privacy practices.

TripHexa may process transaction information necessary to confirm Bookings, administer refunds, reconcile transactions, facilitate Curator settlements, address payment disputes and maintain appropriate financial and business records.

4. INFORMATION PROVIDED BY CURATORS AND TRAVELLERS TO EACH OTHER

4.1 Traveller Information Shared with Curators

Where reasonably necessary for a Trip or Booking, TripHexa may share relevant Traveller information with the Curator responsible for the applicable Travel Experience.

This may include information necessary to:

• respond to an enquiry;
• confirm or administer a Booking;
• communicate regarding the Travel Experience;
• coordinate meeting, travel or other logistics;
• provide the booked Travel Experience; or
• address a complaint, cancellation, modification or support issue.

TripHexa will seek to limit such sharing to information reasonably relevant to the applicable purpose.

Curators must use Traveller information received through TripHexa only for legitimate purposes connected with the relevant Travel Experience or other purposes permitted by applicable law and their contractual obligations.

Curators must not sell, misuse or unlawfully disclose Traveller information obtained through TripHexa.

4.2 Curator Information Shared with Travellers

TripHexa may make relevant Curator information available to Travellers where reasonably necessary to enable them to understand, evaluate or participate in a Travel Experience.

This may include the Curator’s name or profile, business information, Trip description, itinerary, photographs, reviews, relevant contact or meeting information and other information necessary for the Booking.

TripHexa will not ordinarily make unnecessary confidential, financial or sensitive Curator information publicly available through the Platform.

5. PURPOSES FOR WHICH WE USE INFORMATION

TripHexa may process personal information for the following purposes, as applicable:

• creating and managing user and Curator accounts;
• providing and operating the Platform;
• enabling Traveller-Curator discovery and interaction;
• receiving and responding to enquiries;
• facilitating Bookings;
• processing or facilitating payments, refunds and transaction adjustments;
• facilitating Curator settlement processes;
• communicating Booking and Trip-related information;
• providing customer support;
• verifying Curator identity, KYC and business information;
• preventing fraud, misuse and unauthorised activity;
• maintaining Platform security and integrity;
• improving Platform functionality, performance and user experience;
• analysing usage and developing products or features;
• handling complaints, disputes and chargebacks;
• enforcing applicable contractual terms and protecting TripHexa’s rights;
• complying with legal, regulatory, tax, accounting or governmental requirements;
• sending service and administrative communications; and
• sending promotional or marketing communications where permitted by applicable law and consistent with the user’s choices.

TripHexa will not use personal information for purposes materially unrelated to the circumstances in which it was collected unless permitted or required by applicable law.

6. BASIS AND AUTHORITY FOR PROCESSING

TripHexa processes personal information in accordance with applicable Indian law and other laws that may apply to the relevant processing activity.

Depending on the circumstances, processing may be undertaken because it is:

• necessary to provide a service requested by the user;
• necessary to perform or administer a contractual relationship;
• required to comply with a legal or regulatory obligation;
• necessary for legitimate business, security, fraud-prevention or operational purposes where legally permitted; or
• based on consent or another legally recognised basis where required.

Where consent is relied upon, TripHexa will seek consent in an appropriate manner and will provide applicable choices or withdrawal mechanisms.

The precise basis for processing may vary depending on the nature of the information and the relevant activity.

7. SHARING AND DISCLOSURE OF PERSONAL INFORMATION

TripHexa may share personal information where reasonably necessary for the purposes described in this Privacy Policy.

Categories of recipients may include:

• Curators providing or arranging the relevant Travel Experience;
• payment gateways, payment aggregators and financial or settlement service providers;
• hosting, cloud, software and technology service providers;
• analytics, security and fraud-prevention service providers;
• customer-support and communication service providers;
• professional advisers, auditors, accountants and legal advisers;
• insurers or other service providers where relevant to a transaction or claim;
• courts, regulators, governmental authorities or law-enforcement agencies where required or permitted by law; and
• persons or entities involved in a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, where applicable.

TripHexa does not sell personal information merely because information is shared with service providers or Curators for legitimate Platform purposes.

Third-party service providers may process information under contractual or other arrangements appropriate to the services they provide.

8. COOKIES AND SIMILAR TECHNOLOGIES

TripHexa may use cookies and similar technologies where implemented to operate, secure and improve the Platform.

These technologies may be used for purposes including:

• essential Platform functionality;
• maintaining preferences;
• authentication and security;
• analytics and performance measurement; and
• other functionality or communications where applicable.

The precise technologies used by TripHexa may change as the Platform develops.

Where applicable, users may be provided with choices concerning non-essential cookies or similar technologies. Users may also be able to control certain cookie settings through their browser or device.

TripHexa will not represent that it uses advertising or tracking technologies that have not been implemented or confirmed.

9. MARKETING AND SERVICE COMMUNICATIONS

TripHexa may send communications necessary to operate the Platform and administer a user’s relationship with TripHexa.

These may include:

• account-related communications;
• Booking confirmations;
• payment or refund notifications;
• cancellation or modification notices;
• security alerts;
• important Platform notices; and
• customer-support communications.

These communications are generally necessary for the relevant service and may continue even where a user has opted out of promotional communications.

TripHexa may also send promotional communications where permitted by applicable law and subject to applicable consent or user preferences.

Users may use the available unsubscribe or preference mechanism for promotional communications.

10. DATA RETENTION

TripHexa retains personal information for only as long as reasonably necessary for the purposes for which it was collected and for legitimate business, contractual, legal and regulatory purposes.

Retention may be necessary for purposes including:

• maintaining account and Booking records;
• completing transactions and settlements;
• accounting and tax requirements;
• resolving disputes and complaints;
• preventing fraud and misuse;
• enforcing contractual rights;
• complying with legal or regulatory requirements; and
• establishing, exercising or defending legal claims.

Specific retention periods may vary depending on the nature of the information and applicable legal requirements.

TripHexa generally retains material records relating to Platform-Originated Bookings, transactions, settlements, refunds, chargebacks and other material contractual or compliance matters for 8 years, or such longer period as may be required under applicable law. For other categories of personal information, the applicable retention period may be shorter or longer depending on the nature of the information, the purpose for which it is processed and applicable legal requirements.

After the applicable retention period expires, information may be deleted, anonymised or otherwise securely disposed of, subject to technical, legal and legitimate business requirements.

11. DATA SECURITY

TripHexa implements reasonable technical and organisational safeguards appropriate to the nature of the personal information processed.

Depending on the relevant system and functionality, safeguards may include access controls, authentication measures, secure storage, monitoring, organisational controls and other security measures.

Encryption or other technical controls may be used where implemented and appropriate to the nature of the information.

No online platform can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials and should promptly notify TripHexa of suspected unauthorised access or security incidents.

TripHexa may require service providers handling personal information to maintain appropriate safeguards consistent with the nature of the services provided.

12. DATA BREACHES AND SECURITY INCIDENTS

If TripHexa becomes aware of a security incident involving personal information, it will assess and respond to the incident in accordance with its internal procedures and applicable law.

Depending on the circumstances, TripHexa may take steps to contain, investigate, remediate and document the incident and make notifications to affected persons or competent authorities where required by applicable law.

TripHexa does not guarantee a particular notification period beyond what is required under applicable law.

13. USER RIGHTS AND CHOICES

Subject to applicable law and reasonable verification requirements, users may have rights or choices concerning their personal information, including the ability to:

• request access to information held by TripHexa;
• request correction or updating of inaccurate information;
• request deletion or erasure where legally available;
• withdraw consent where processing is based on consent;
• raise a grievance concerning the processing of personal information;
• manage applicable marketing preferences; and
• make other requests available under applicable law.

These rights may be subject to lawful limitations, including requirements to retain information for legal, tax, accounting, security, fraud-prevention or dispute-resolution purposes.

TripHexa may need to verify the identity of a person making a request before processing it.

14. CURATOR DATA OBLIGATIONS

A Curator receiving Traveller information through TripHexa is responsible for handling that information in accordance with applicable law and the Curator’s contractual obligations to TripHexa.

A Curator shall, as applicable:

• use Traveller information only for legitimate purposes connected with the relevant Travel Experience or Booking;
• protect information against unauthorised access, use or disclosure;
• not sell or unlawfully disclose Traveller information;
• not use Traveller information for unrelated marketing or other purposes without an appropriate legal basis;
• retain information only for as long as reasonably necessary and legally permitted; and
• comply with applicable privacy and data-protection requirements.

This Privacy Policy does not constitute a separate data-processing agreement between TripHexa and a Curator. Where additional contractual data-protection obligations are required, they may be addressed separately in the Curator Agreement or another applicable agreement.

15. THIRD-PARTY SERVICES AND LINKS

The Platform may contain links, integrations or references to third-party websites, applications, payment services or other services.

TripHexa does not control the privacy practices of independent third parties.

A third party may collect and process information under its own privacy policy, terms and applicable legal obligations.

Users should review the relevant third party’s privacy documentation before providing information directly to that third party.

16. CHILDREN AND MINORS

The Platform is not intended to be specifically directed towards children unless expressly stated otherwise.

Eligibility requirements for creating an account or making a Booking are governed primarily by the TripHexa Terms of Service and applicable Trip-Specific Terms.

Where TripHexa becomes aware that personal information has been collected in circumstances contrary to applicable legal requirements concerning children, it may take appropriate steps in accordance with applicable law.

17. INTERNATIONAL DATA PROCESSING

TripHexa may use third-party technology, hosting, payment, communication or other service providers whose operations may involve processing of personal information outside India.

The specific locations and transfer arrangements applicable to TripHexa may vary depending on the third-party technology, hosting, payment, communication or other service providers actually engaged by TripHexa. TripHexa will not represent that all personal information is stored exclusively in India unless this has been specifically confirmed.

Where cross-border processing applies, TripHexa will take such steps as are required by applicable law.

18. ACCOUNT CLOSURE AND DELETION

A user may request closure of the user’s TripHexa account through the applicable account or support process.

Account closure does not necessarily result in immediate deletion of every record relating to the user.

TripHexa may retain information where reasonably necessary for:

• pending or completed Bookings;
• refunds, settlements or transaction reconciliation;
• accounting or tax obligations;
• fraud and security purposes;
• dispute resolution;
• legal or regulatory requirements; or
• establishment, exercise or defence of legal claims.

Once the applicable retention requirement expires, TripHexa may delete, anonymise or securely dispose of the relevant information.

19. GRIEVANCE AND CONTACT

Users may raise privacy-related questions, requests or grievances through the contact mechanism designated by TripHexa.

TripHexa may request reasonable information necessary to verify the identity of the person making a privacy request or grievance. General enquiries may also be directed to triphexa.travels@gmail.com.

TripHexa will address privacy requests and grievances in accordance with applicable law and its applicable internal procedures.

20. CHANGES TO THIS PRIVACY POLICY

TripHexa may update this Privacy Policy from time to time to reflect changes in the Platform, business model, legal requirements, technology or data-processing practices.

Routine administrative or non-material changes may be reflected by updating the “Last Updated” date.

Where TripHexa makes a material change that substantially affects how personal information is processed, TripHexa may provide an appropriate notice or other communication where required by applicable law.

Users should periodically review the Privacy Policy to remain informed about TripHexa’s current privacy practices.