Privacy Policy

This Privacy Policy explains how [Timeless Travels / full legal entity name] (“Timeless Travels”, “we”, “ us” or “our”), which operates the website [www.___________] and related booking services (the “ Platform”), collects, uses, shares, stores and protects your personal data when you use the Platform to browse, book or stay at the villas and holiday properties we offer.

Timeless Travels curates and offers short-stay villas and holiday homes that it has the right to make available under lease or commercial arrangements with the respective property owners. We are the “ Data Fiduciary” in respect of the personal data we determine the purpose and means of processing.

Applicable law. This Policy is framed in accordance with the Digital Personal Data Protection Act, 2023 (“ DPDP Act”); the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“ SPDI Rules”); the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; and the Consumer Protection (E-Commerce) Rules, 2020. Where we knowingly offer the Platform to individuals in the European Economic Area or the United Kingdom, we additionally seek to align with the General Data Protection Regulation (GDPR) / UK GDPR to the extent applicable.

In this Policy, “personal data” means any data about an individual who is identifiable by or in relation to such data; “ Data Principal” means the individual to whom the personal data relates; “processing” means any operation performed on personal data, whether automated or not; and “ Property Owner” means the owner or authorised custodian of a villa or property offered on the Platform. Terms not defined here have the meaning given to them under the DPDP Act.

Depending on how you use the Platform, we may collect: (a) identity and contact data — name, email address, postal address, telephone number, and, where required for check-in or statutory record-keeping, government-issued identification details; (b) booking data — dates of stay, number and details of guests, property selected, special requests, and stay history; (c) payment data — transaction amount, date and payment status (card, UPI or bank details are collected and processed directly by our payment gateway partners and are not stored by us); (d) guest and co-traveller data — details of other guests you include in a booking (which you confirm you are authorised to share); (e) communications — correspondence, reviews, ratings, and support queries; and (f) technical and usage data — IP address, device and browser information, and Platform usage, collected through cookies and similar technologies (see our Cookie Policy).

We collect personal data (a) directly from you when you register, make an enquiry or booking, or contact us; (b) automatically through cookies and similar technologies when you use the Platform; and (c) from third parties, including Property Owners, payment gateways, and analytics or marketing partners.

We process personal data to: create and manage your account; process, confirm and administer bookings and payments; share necessary booking and guest details with the relevant Property Owner to enable your stay; provide customer support and manage grievances; comply with legal, tax, and statutory guest-registration obligations; prevent fraud and ensure security; and, where you have consented, send you offers and marketing communications.

Under the DPDP Act, we process personal data on the basis of your consent and, where applicable, for legitimate uses permitted by the Act (such as processing necessary to fulfil a booking you have requested or to comply with law). You may withdraw your consent at any time as described in Clause 8, though this will not affect processing carried out before withdrawal.

We share personal data only as necessary: (a) with Property Owners and their on-site staff, to the extent required to host your stay; (b) with payment gateways, banks and financial institutions to process payments; (c) with service providers and processors (hosting, analytics, communications, customer support) acting on our documented instructions and under confidentiality and data-protection obligations; (d) with government, regulatory or law-enforcement authorities where required by law or valid legal process; and (e) with a successor in the event of a merger, acquisition or reorganisation.

We do not sell your personal data.

Where personal data is transferred to or stored on servers or with service providers located outside India, we ensure such transfer complies with the DPDP Act and is not made to any country or territory restricted by the Central Government. For EEA/UK Data Principals, we rely on appropriate safeguards recognised under the GDPR/UK GDPR where applicable.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to provide the services, and to comply with legal, tax, accounting, and statutory guest-record obligations, after which it is securely deleted or anonymised.

Booking and transaction records may be retained for the period prescribed under applicable tax and commercial laws.

Subject to the DPDP Act, you have the right to: (a) access a summary of your personal data and its processing; (b) correction, completion, updating and erasure of your personal data; (c) grievance redressal (see Clause 12); (d) nominate another individual to exercise your rights in the event of your death or incapacity; and (e) withdraw your consent at any time.

To exercise any of these rights, contact our Grievance Officer using the details in Clause 12. We will respond within the timelines prescribed under Applicable Law.

EEA/UK users may additionally have rights of data portability and objection under the GDPR/UK GDPR.

The Platform and bookings are intended for individuals aged eighteen (18) years or older. Where we process the personal data of a child (any individual under 18), we do so only after obtaining verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, in accordance with the DPDP Act.

We use cookies and similar technologies to operate and improve the Platform. Please refer to our separate Cookie Policy for details of the cookies we use and how you can manage your preferences.

We implement reasonable security practices and procedures, including appropriate technical and organisational measures, to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction, as required under Section 43A of the IT Act, the SPDI Rules, and the DPDP Act.

Details are set out in our Data Protection Policy. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required by law.

In accordance with the DPDP Act, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer is:

Name: [__________] Designation: Grievance Officer / Data Protection contact Email: [grievance@___________] Address: [___________]

The Grievance Officer will acknowledge complaints within the timelines prescribed by Applicable Law and endeavour to resolve them promptly.

We may update this Policy from time to time. The updated version will be posted on the Platform with a revised “Last updated” date, and material changes will be notified to you where required by law.