Indian Holidays – Website Privacy Policy

We make holidays that make memories

Last updated: 29 October 2026

1. Who we are

This Privacy Policy explains how Indian Holidays, a sole proprietorship owned by Rajeev Sobti ("Indian Holidays", "we", "us", "our"), collects, uses, shares and keeps personal information through our website https://indianholidaystours.com (the "Website") and when you make an enquiry or booking with us. We arrange domestic, inbound and outbound tours and related travel services.

Indian Holidays decides why and how your personal information is processed. Under Indian data-protection law, we are therefore the "Data Fiduciary" for that information.

Contact: Indian Holidays, Tower-10-001, Emerald Floors Premier, Sector-65, Gurugram-122101, Haryana, India · Phone: +91 98100 74368 · Email: bookings@indianholidaystours.com. For privacy questions and requests, see Sections 10 and 11.

2. Scope

This policy covers personal information we collect:

• when you browse the Website or submit an enquiry form;
• when you contact us by email, phone or WhatsApp about a trip; and
• when you make a booking with us (in which case our General Terms & Conditions, Clause 11, also apply).

The Website is for enquiries only: it does not take bookings or payments. Payments are made after you accept a quotation, by bank transfer or through a payment link that we send you by email or WhatsApp (see Section 6).

It does not cover the websites or services of airlines, hotels and other suppliers, which have their own privacy policies.

3. Information we collect

3.1 Website enquiries. When you send an enquiry through the form on our Website, we collect:

• your name and email address (required);
• your phone/WhatsApp number, if you choose to give it;
• the travel-planning details you choose to give us: type of holiday, destination(s), where you are travelling from (city/country), travel month or approximate dates, number of nights, number of adults, number and ages of any children, hotel category and budget range;
• any message you choose to write; and
• whether you have ticked the optional marketing box (see below).

Information added automatically to your enquiry. So that we know what you are asking about, the form also sends us the address of the page from which you sent it and, where you enquire from a holiday or group-tour page, the identifier, title, web address and status (for example, available or on request) of that holiday or tour, and the type of enquiry (a quotation request or a group-tour expression of interest).

The form shows a short notice explaining how we use these details, with a link to this Privacy Policy. Marketing consent is separate and optional: a separate box, which is never pre-ticked, lets you ask to receive occasional holiday ideas and promotional offers from us by email. We send marketing only by email and do not send marketing messages by WhatsApp. You do not need to tick the box to send an enquiry, and you can withdraw your consent (unsubscribe) at any time, as described in Section 10.

Service providers that process your enquiry. Enquiries are delivered to us by Web3Forms, a form-processing service that acts on our instructions. Web3Forms receives the details you submit together with technical information such as your IP address, and, according to its privacy policy, may send the IP address and email address of the person submitting a form to spam-prevention services. The form is protected by hCaptcha (provided by Intuition Machines, Inc.), which checks that the enquiry is sent by a person and not an automated program. To do this, hCaptcha collects technical information such as your IP address, browser and device information, and how you interact with the check (for example, mouse movements, scrolling and key presses). The form also contains a hidden anti-spam field that is not visible to visitors. Web3Forms and hCaptcha may process information outside India, including in the United States; their own privacy policies explain how they handle it.

We do not ask for passport copies or numbers, PAN, Aadhaar, payment card details or health information through the enquiry form. Please do not include them in your message. If such details are needed later for a booking, we will tell you why (see Sections 3.3 and 3.4).

3.2 Information collected automatically, cookies and similar technologies.

When you visit the Website, the service that hosts it may automatically record standard technical information, such as your IP address, browser and device type, the pages you visit and the date and time of your visit. This information is used to deliver the Website, keep it secure and prevent misuse.

Cookies and similar technologies. Cookies are small files stored on your device by a website. Our Website does not use analytics, advertising or social-media tracking cookies or tools, and our own pages do not set cookies or use your browser's local storage. The Website uses only the following, which are needed to keep the Website and enquiry form secure:

• hCaptcha (enquiry form only). When you open a page containing our enquiry form, the hCaptcha security check loads from hCaptcha's servers. hCaptcha and its infrastructure provider, Cloudflare, may set a strictly necessary security cookie (such as "__cf_bm", which Cloudflare uses to distinguish people from automated traffic and which expires after 30 minutes of inactivity) and collect the device and interaction information described in Section 3.1.
• Hosting security. Our Website is hosted on Cloudflare. Depending on the security settings in use, Cloudflare may set strictly necessary security cookies (such as "__cf_bm") to protect the Website from malicious or automated traffic.

These cookies are used only for security. If we ever decide to use non-essential cookies, analytics or similar tools, we will first update this Section and, where the law requires, ask for your consent through a notice that lets you refuse them as easily as accept them. You can block or delete cookies through your browser settings, but if you block the cookies used by the security check, you may not be able to send an enquiry through the form. You can still contact us by email or WhatsApp.

3.3 Information needed for a booking. If you go ahead with a booking, we may need, for each traveller and only as required for the Services booked:

• full name as in passport/ID, date of birth, gender and nationality;
• passport, visa or other identity document details (for flights, hotels, visas, permits and Form C registration of foreign nationals);
• PAN and related declarations where required by law for international packages;
• billing details and payment records (card payments are processed by the payment gateway);
• emergency contact details;
• dietary needs, and health, disability or mobility information only where you choose to share it so that suitable arrangements can be made;
• information about children travelling, provided by their parent or lawful guardian (see Section 9); and
• where you ask us to facilitate a travel insurance policy, the details needed for the policy (see Section 3.5).

These details are not collected through the general enquiry form.

3.4 Passport copies and other travel documents. Where a booking, visa, permit or supplier requires it, we may ask you for passport copies, visa documents or other necessary travel documents, which you may send us by email or WhatsApp. When we ask, we will tell you why the document is needed and how it will be used. We use these documents only for legitimate travel-service purposes, such as making and confirming bookings, visa and permit applications, guest registration and legal requirements. Access to them is restricted to authorised personnel who need the information for their duties, and we take appropriate safeguards to protect them against unauthorised access, disclosure, loss or misuse. Please send documents only when we ask for them, and only to our official contact details.

3.5 Travel insurance. If you ask us to facilitate an overseas travel insurance policy, we share the details needed for the policy with Asego Insurance LLP (corporate agent, IRDAI registration no. CA0776) and the insurer. This may include traveller names, dates of birth and passport details; travel dates and destinations; and contact details. Medical or pre-existing-condition information is shared only where the insurer requires it, and access to it is restricted to authorised personnel. The insurer issues the policy and decides claims, and Asego and the insurer use your information under their own privacy policies.

4. Why we use your information

We will not use your information for a purpose unrelated to these purposes without telling you and, where required, asking for your consent.

5. Basis for processing

We process personal information:

• with your consent – for example when you submit an enquiry after reading the privacy notice, or agree to receive marketing (marketing consent is separate and optional); and
• where otherwise permitted by law – for example where you voluntarily provide information for a specified purpose such as a booking, to comply with legal obligations, or to respond to a medical emergency.

When you give us details of other travellers, you confirm that you are authorised to do so and that you have told them about this policy.

6. Sharing your information

We share personal information only as needed to respond to enquiries, process payments, make bookings and deliver travel services:

• Travel suppliers – airlines, hotels, destination management companies (DMCs), cruise operators and other travel suppliers, so that they can provide the services you have booked;
• WhatsApp – where we communicate with you by WhatsApp, your messages and any documents you send pass through WhatsApp's service;
• Email service providers – the providers of the email services we use to correspond with you;
• Online payment gateways – to process payments made through payment links we send you, and refunds.

We may also disclose personal information:

• to embassies, high commissions, consulates, visa processing centres and permit authorities, where you use our visa or permit assistance;

• to Asego Insurance LLP (corporate agent, IRDAI registration no. CA0776) and the insurer, only where you ask us to facilitate a travel insurance policy (see Section 3.5). Indian Holidays acts only as a facilitator and does not provide or underwrite insurance; the insurer issues the policy and decides claims, and its use of your information is governed by its own privacy policy; and

• to government, tax, immigration, police or other authorities, where required by law (for example hotel guest registration or Form C for foreign nationals) or to protect safety.

• Website hosting and IT service providers – the providers that host our Website, deliver enquiry-form submissions to us and store our business records, acting on our instructions.

We do not sell your personal information.

Transfers outside India. For international travel, your details must be shared with suppliers and authorities in the countries you visit, and some of the service providers listed above may process information outside India. Such transfers will be made subject to any restrictions notified by the Government of India.

7. How long we keep your information

We keep different kinds of information for different periods. Some periods are required by law (7.1). Others are Indian Holidays' own retention periods, set to suit our business (7.2). Our own periods are not statutory deadlines that apply to every business, and they never shorten a period the law requires.

7.1 Records we must keep by law

• Bookings, itineraries, invoices, payment, tax and accounting records (including relevant booking correspondence): kept separately, for the periods required by applicable law. These currently include the Central Goods and Services Tax Act, 2017 (section 36: 72 months from the due date of the annual return for the year, or longer where an appeal or proceedings are pending) and the Income-tax Rules, 2026 (rule 46(9): seven tax years from the end of the relevant tax year, or until a reopened assessment is completed). In practice, this is up to eight years after the end of the financial year to which the records relate, or longer where proceedings are pending. These records cannot be deleted on request while we are required to keep them.
• Insurance records (your request for us to facilitate a policy, copies of policy documents we receive and related correspondence): kept with the booking records for the same record-keeping period, and then securely deleted or anonymised when no longer required, unless the law requires us to keep them longer.
• Parent or guardian confirmations for children's information: kept with the booking record (see Section 9).
• Technical information and logs relating to the Website and our systems: for as long as needed for security and as required by law. From 13 May 2027, Indian data-protection rules require certain logs to be kept for at least one year.

7.2 Indian Holidays' own retention periods

• Enquiries that do not lead to a booking (unconverted leads): kept for up to 24 months from our last meaningful interaction with you. They are then deleted or anonymised, unless continued retention is justified by your consent, a renewed enquiry, a legal obligation or another lawful purpose. You may ask us to delete them earlier.
• Copies held by our form-processing provider: enquiries sent through the Website form are also stored by Web3Forms, our form-processing provider, which may keep form submissions for up to three years from the date of submission under its own retention policy. This is separate from our own 24-month period above, and we may not be able to delete Web3Forms' copies within that period.
• Copies of passports, visas and similar travel documents, and of health documents (including health, dietary or mobility information shared for travel arrangements, and medical or pre-existing-condition information given for an insurance policy): deleted within 90 days after completion of your trip. We keep them longer only where a pending claim, complaint, dispute, legal obligation or other documented legitimate need requires it, and then only the relevant documents and only for as long as necessary. This 90-day period does not apply to information that forms part of records we must legally keep for longer under 7.1 (for example, passport details shown in booking records or invoices, or copies contained in an issued insurance policy).
• Complaints: kept for 3 years after the complaint is closed, unless a legal obligation, an ongoing dispute, a claim or a legal hold requires longer.
• Marketing preferences: kept until you withdraw consent. We keep a record of your withdrawal so that we respect it.

7.3 Legal claims and legal holds. Records needed for a legal claim, dispute, legal hold or official enquiry are kept until the matter is finally resolved (including any appeal), and are then handled as set out above.

We collect and keep only the information reasonably needed for these purposes. We do not keep personal information indefinitely. When it is no longer needed, and we are neither required by law nor entitled for a legitimate purpose (such as dealing with a dispute) to keep it, we securely delete it or make it anonymous.

8. How we protect your information

We restrict access to personal information to the persons who need it to deal with your enquiry or booking, and we take reasonable security safeguards to protect it against unauthorised access, disclosure, loss or misuse. Our Website, including its enquiry form, is served over a secure HTTPS connection (TLS encryption), and enquiry-form submissions are sent to our form provider over HTTPS. No method of transmission or storage is completely secure. If a personal data breach occurs, we will take steps to contain it and will inform affected persons and authorities as required by law.

9. Children

Our Website is intended for adults. We do not knowingly accept enquiries from children under 18. Where a child (a person under 18) is to travel, we collect the child's information only from the child's parent or lawful guardian, and only what is needed for the booking: the child's name, date of birth or age, passport details where required for the travel booked, and any special needs only where necessary to make safe and suitable arrangements.

Parent or guardian confirmation. Before we process a child's information for a booking, we will ask the parent or lawful guardian to confirm, by email or WhatsApp, that they are the child's parent or lawful guardian and that they agree to our processing the child's information for that booking. We keep this confirmation with the booking record. Where the law requires us to check that the person giving consent is an identifiable adult, we will do so using reliable identity details we already hold for the booking or that the person provides. A tick-box alone will not be treated as sufficient.

We use children's information only to provide the travel services and to meet legal requirements, we share it only as described in Section 6, and we keep it for the periods described in Section 7. We do not use children's information for marketing, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children.

10. Your rights and how to make a request

10.1 Your rights. Subject to applicable law, you may:

• ask for a summary of the personal information we hold about you and how we use it, and the identities of those we have shared it with;
• ask us to correct, complete or update inaccurate or incomplete information;
• ask us to delete information that is no longer needed (unless we must keep it – see 10.4);
• withdraw consent at any time (for example to marketing) – as easily as you gave it. Withdrawal does not affect processing already carried out, and if you withdraw consent needed for a booking we may be unable to continue with it;
• nominate another person to exercise your rights in the event of death or incapacity; and
• raise a grievance with us about how your information is handled.

10.2 How to make a request. Write to us at bookings@indianholidaystours.com, or by post to our address in Section 1, stating your name, your contact details, the booking reference (if any) and what you are asking for. You may also contact us by phone (+91 98100 74368) and we will tell you how to complete the request in writing.

10.3 Identity verification. To protect your information, we may ask you to confirm your identity before acting on a request, for example by replying from the email address or phone number we hold for you or by providing details of your booking. We will ask only for what is reasonably needed and will use it only to verify the request. If someone makes a request on your behalf, we may ask for proof of their authority.

10.4 How we handle requests. We will acknowledge your request and respond as quickly as possible and in any case within one month of receipt. If we cannot meet a request in full, we will explain why. Booking confirmations, invoices, payment records and other records that we must keep for legal, tax, accounting or official purposes cannot be deleted while that obligation lasts; we will tell you which information this affects, and we will delete or anonymise the rest where we are not required or entitled to keep it.

11. Grievances

Grievance Officer: Rajeev Sobti, Proprietor, Indian Holidays · Email: bookings@indianholidaystours.com · Phone: +91 98100 74368 · Address: Indian Holidays, Tower-10-001, Emerald Floors Premier, Sector-65, Gurugram-122101, Haryana, India.

We will acknowledge your grievance within 48 hours of receipt, and your grievance will be redressed within one month of receipt, as required by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. When the grievance-redressal provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 apply to us (from 13 May 2027), we will handle grievances within the period required by law; our commitment to redress them within one month of receipt will continue.

If you are not satisfied with our response, you may, once the relevant provisions of the Digital Personal Data Protection Act, 2023 are in force, complain to the Data Protection Board of India in the manner provided by law. This does not affect any other right or remedy you have under law.

12. Links and third-party services

The Website may link to supplier websites, social media or messaging services (for example WhatsApp). Their use of your information is governed by their own privacy policies.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page with the date it was last updated. Where changes are significant, we will tell you by a notice on the Website or, where appropriate, by email.

Indian Holidays – sole proprietorship (Proprietor: Rajeev Sobti) · Tower-10-001, Emerald Floors Premier, Sector-65, Gurugram-122101, Haryana, India · Phone: +91 98100 74368 · Email: bookings@indianholidaystours.com · Website: https://indianholidaystours.com · GSTIN: 06AIGPS2325C1ZM

Indian Holidays – We make holidays that make memories