Privacy Policy

01 Introduction & Scope

1.1 This Privacy Policy explains how CYC Enterprises Pvt. Ltd., operating the Travelexie brand (“Travelexie”, “the Company”, “we”, “us”, “our”), collects, uses, discloses, retains and protects the personal data of individuals who enquire about, book, or travel on Travelexie's international travel packages (“you”, “your”, or “Data Principal”).

1.2 This Policy applies solely to the Travelexie brand's business-to-consumer (B2C) activities. It does not apply to Travixa DMC, CYC Enterprises Pvt. Ltd.'s separate business-to-business (B2B) destination-management brand.

1.3 This Policy should be read together with Travelexie's Master Terms & Conditions of Booking.

1.4 This Policy is framed with reference to the Digital Personal Data Protection Act, 2023 and rules made thereunder, and, to the extent still applicable, the Information Technology Act, 2000 and related rules.

02 Who We Are

CYC Enterprises Pvt. Ltd. is the “Data Fiduciary” responsible for your personal data processed in connection with Travelexie bookings.

03 Definitions

“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act, 2023.

“Data Principal” means the individual to whom the personal data relates — typically you, the Customer or Traveller.

“Data Fiduciary” means CYC Enterprises Pvt. Ltd., which determines the purpose and means of processing your personal data.

“Processing” means any operation performed on personal data, including collection, storage, use, sharing, and erasure.

“Consent Manager” means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review or withdraw consent, where applicable.

“Supplier(s)” means airlines, hotels, cruise lines, ground handlers, embassies/consulates, visa facilitation partners, and insurers involved in delivering your Booking.

04 Personal Data We Collect

Depending on the Services you request, we may collect:

• Identity & contact data: full name, date of birth, gender where required, phone number, email address and postal address.
• Travel documentation: passport number, passport copy, visa copies, PAN/Aadhaar where required, photographs and other identification.
• Payment data: billing name and address and payment confirmation references. Travelexie does not store full card numbers or CVV.
• Communication data: messages, call records and correspondence exchanged over WhatsApp, email or phone.
• Travel preference & special-assistance data: dietary preferences, mobility or medical assistance needs, or other information voluntarily disclosed to arrange suitable Services.
• Website/device data: IP address, browser type and cookie data.
• Trip photographs, videos & testimonials: images, video footage and testimonials captured during your trip.

4.1 Where you share special-category information such as health or medical-assistance needs, you do so voluntarily and give explicit consent for Travelexie to use it solely to arrange or facilitate the relevant travel Service.

05 How We Collect Your Data

• Directly from you via WhatsApp, phone, email, website/enquiry forms or in person.
• From your payment gateway/bank, limited to payment confirmation and transaction reference data.
• From a co-traveller or group leader who submits your data on your behalf for a shared Booking.
• From Suppliers where they share confirmation, ticketing or visa-status information.

06 How We Use Your Data

• Creating and managing your Booking, itinerary, and payment records.
• Filing visa applications and submitting required documents to embassies, consulates and visa centres.
• Issuing flight tickets, hotel vouchers and confirmation documents.
• Communicating booking confirmations, payment reminders, itinerary updates and customer support responses.
• Complying with legal and tax obligations including GST/TCS record-keeping.
• With your separate consent, sending promotional offers, newsletters or destination content.
• Internal record-keeping, fraud prevention and improving our Services.

6A Use of Photographs, Videos & Trip Collaterals

6A.1 During group departures, escorted tours or destination photo/video activities, Travelexie may capture or receive photographs, videos, testimonials and other travel collaterals that include you and/or your co-travellers.

6A.2 Unless you specifically opt out in writing before or during the trip, you consent to Travelexie using your image, likeness and voice appearing in such Trip Collaterals for its marketing purposes.

• Travelexie's social media pages.
• Travelexie's website, brochures, blogs and Google Business Profile.
• Other Travelexie marketing and promotional materials.

6A.3 Where a specific photograph, video or testimonial identifies you individually, Travelexie will seek your specific consent before publishing it.

6A.4 You may withdraw consent to future use of Trip Collaterals featuring you and/or request removal of specific published content by contacting the Grievance Officer/Data Protection contact.

6A.5 Trip Collaterals are used solely for Travelexie's own marketing purposes and are not sold or licensed to unrelated third parties for their independent commercial use.

07 Legal Basis for Processing

7.1 We process your personal data on the basis of:

• Your consent.
• The necessity to perform our contract with you.
• Compliance with legal obligations such as tax, visa or immigration requirements.

08 Consent & Withdrawal

8.1 Where we rely on your consent, we will provide a clear notice describing the personal data to be collected and the purpose of processing.

8.2 You may withdraw consent for a specific purpose such as marketing communications by contacting the Grievance Officer/Data Protection contact or using an unsubscribe link where available.

09 Disclosure & Sharing of Personal Data

We share your personal data only to the extent necessary to deliver your Booking or meet a legal obligation, with:

• Airlines, hotels, cruise lines, ground handlers and activity operators.
• Embassies, consulates and visa facilitation centres.
• Insurers where you have opted for travel insurance.
• Payment gateways, banks and card networks.
• Government and regulatory authorities where required under applicable law.
• Professional advisors bound by confidentiality.

9.1 We do not sell your personal data to third parties, and we do not share it with marketing partners outside the Travelexie brand without your specific consent.

10 Cross-Border Transfer of Data

10.1 Because our Services are international travel packages, your personal data may necessarily be transferred outside India to foreign embassies/consulates, overseas hotels, airlines and ground-handling partners solely to deliver the Services you have booked.

10.2 Where we transfer personal data internationally, we take reasonable contractual and organisational measures to require the recipient to protect it in a manner consistent with this Policy.

11 Data Retention

11.1 We retain your personal data for as long as necessary to fulfil the purposes described in this Policy, including applicable statutory retention periods and any period required to defend or pursue a legal claim, after which it is securely deleted or anonymised unless an overriding legal ground for retention applies.

12 Data Security

12.1 We use reasonable technical and organisational security safeguards including access controls, encrypted transmission for payment data and restricted internal access to passport/visa documents.

12.2 No system is completely secure. While we take reasonable measures, we cannot guarantee absolute security of data transmitted over the internet or messaging platforms.

13 Cookies & Website Tracking

13.1 If you visit Travelexie's website, we may use cookies and similar technologies to remember preferences, understand site usage and improve our Services.

Where required, a cookie-consent banner will let you accept or manage non-essential cookies.

14 Children's Data

14.1 Our Services are not directed at, or marketed to, children travelling unaccompanied. Where a minor's personal data is submitted as part of a family or group Booking, it is provided and consented to by their parent or legal guardian.

15 Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you.
• Request correction or completion of inaccurate or incomplete personal data.
• Request erasure of personal data that is no longer necessary, subject to legal retention obligations.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Register a grievance with us and, if unresolved, with the Data Protection Board of India.
• Withdraw consent at any time as described in Section 8.

15.1 To exercise any of these rights, write to the Grievance Officer/Data Protection contact in Section 16.

16 Grievance Redressal & Data Protection Contact

16.1 The Grievance Officer will acknowledge your written complaint within forty-eight (48) hours and endeavour to resolve it within thirty (30) days.

17 Personal Data Breach

17.1 In the event of a personal data breach that is likely to affect you, we will take prompt remedial action and notify you and the Data Protection Board of India in the manner and within the timeline required under the DPDP Act, 2023 and rules made thereunder.

18 Third-Party Links

18.1 Our website, itineraries or communications may contain links to third-party websites such as Supplier booking portals or payment gateways.

This Policy does not apply to those third-party sites, and we encourage you to review their privacy policies independently.

19 Changes to this Policy

19.1 We may update this Policy from time to time to reflect changes in law or our practices.

The version in force at the date of your Stage 1 payment shall govern the personal data collected for that Booking, and the then-current version will be published on our website.

20 Governing Law & Jurisdiction

20.1 This Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023.

Subject to your statutory right to approach the Data Protection Board of India, courts at Kolkata, West Bengal, India shall have exclusive jurisdiction over any dispute arising from this Policy.

21 Contact Us