Data Protection Policy

This Data Protection Policy sets out how [Timeless Travels / full legal entity name] (“Timeless Travels”, “we ”, “us” or “our”) governs, protects and processes personal data collected through the website [www.___________] and related services (the “Platform ”), and how it meets its obligations as a Data Fiduciary. It should be read together with our Privacy Policy and Cookie Policy.

Applicable law. This Policy is framed in accordance with the Digital Personal Data Protection Act, 2023 (“ DPDP Act”); Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”); the directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the IT Act, including the Directions dated 28 April 2022; and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

This Policy applies to all personal data processed by Timeless Travels in connection with the Platform, including data relating to guests, prospective customers, Property Owners, and website visitors, and to all employees, officers, contractors, and processors who handle such data on our behalf.

Timeless Travels processes personal data in accordance with the following principles: (a) lawfulness and consent — personal data is processed lawfully, on the basis of consent or a legitimate use permitted under the DPDP Act; (b) purpose limitation — data is collected for specified, lawful purposes and not used incompatibly; (c) data minimisation — only data necessary for the stated purpose is collected; (d) accuracy — reasonable steps are taken to keep data accurate and up to date; (e) storage limitation — data is retained only as long as necessary; (f) security and integrity — appropriate safeguards protect data against unauthorised or unlawful processing and accidental loss; and (g) accountability — we remain responsible for, and able to demonstrate, compliance.

Timeless Travels acts as the Data Fiduciary, determining the purposes and means of processing. Third parties that process personal data on our behalf act as Data Processors and are bound by written contracts imposing equivalent data-protection obligations.

A Grievance Officer / Data Protection contact is appointed to oversee compliance and handle Data Principal requests and complaints (see Clause 11).

Personal data is processed only where a lawful basis exists under the DPDP Act, namely the free, specific, informed, unconditional, and unambiguous consent of the Data Principal, or a legitimate use permitted by the Act. Where consent is relied upon, we maintain records of consent and provide an easy means to withdraw it.

We enable Data Principals to exercise their rights under the DPDP Act, including the right to access information about their personal data, to correction and erasure, to grievance redressal, and to nominate another individual to exercise their rights. Requests are actioned within the timelines prescribed under Applicable Law, and a record of such requests is maintained.

We implement reasonable security practices and procedures commensurate with the nature of the data, which may include: encryption of data in transit and, where appropriate, at rest; role-based access controls and authentication; network and application security measures; secure configuration and patch management; logging and monitoring; regular back-ups; vulnerability management; confidentiality obligations for personnel; and periodic security reviews.

We align our security framework with the SPDI Rules and, where implemented, recognised standards such as ISO/IEC 27001.

Personal data is retained only for as long as necessary for the purposes for which it was collected and to meet legal, tax, and statutory record-keeping obligations, after which it is securely deleted, destroyed, or anonymised.

We engage Data Processors and third-party service providers only under written agreements that require them to process personal data solely on our instructions, maintain appropriate security, assist with Data Principal requests, and delete or return data on termination. We conduct reasonable due diligence before engaging processors.

Any transfer of personal data outside India is carried out in compliance with the DPDP Act and only to countries or territories not restricted by the Central Government, with appropriate contractual and security safeguards in place.

We maintain procedures to detect, assess, contain, and remediate personal data breaches and security incidents.

In the event of a breach, we will: (a) report cyber-security incidents to CERT-In within six (6) hours of becoming aware, as required under the CERT-In Directions, 2022; (b) notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act; and (c) implement corrective and preventive measures to avoid recurrence.

We maintain logs and records as required under Applicable Law.

Any Data Principal may address a grievance or exercise a right by contacting our Grievance Officer:

Name: [__________] Designation: Grievance Officer / Data Protection contact Email: [grievance@___________] Address: [___________]

Complaints will be acknowledged and resolved within the timelines prescribed under Applicable Law. A Data Principal who is not satisfied may approach the Data Protection Board of India in accordance with the DPDP Act.

Personnel who handle personal data are made aware of their obligations under this Policy. We review this Policy periodically and update it to reflect changes in our processing activities, technology, and Applicable Law.