Privacy Policy

Welcome to Tripiffic Travels Pvt. Ltd. ('Tripiffic', 'we', 'us', or 'our'). We provide end-to-end corporate travel management platforms, enterprise booking software, flight search aggregations, hotel reservation portals, and AI-assisted itinerary planning services (collectively, the 'Platform').

This Privacy Policy applies to all users of our digital platforms, including corporate travel administrators, authorized employee travelers, corporate guest travelers, and website visitors. It outlines our practices regarding the collection, processing, transfer, storage, and erasure of personal data under applicable data protection laws, including the Indian Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and where applicable, the EU General Data Protection Regulation (GDPR).

When an enterprise company ('Corporate Client') contracts with Tripiffic to manage corporate employee travel, the Corporate Client determines travel policies and authorized passenger details. In such instances, Tripiffic acts as a Data Processor/Intermediary, while the Corporate Client is the Data Controller/Fiduciary.

To fulfill corporate travel bookings, issue airline tickets (PNRs), reserve accommodations, and maintain administrative duty of care, we collect and process several categories of personal data:

We rely on lawful grounds under the DPDP Act 2023 and GDPR to process personal data. These purposes include:

• Booking Fulfillment: Transmitting passenger manifests to commercial airlines, Global Distribution Systems (GDS: Sabre, Amadeus, Travelport), and hotel inventory providers (TBO) to issue valid tickets and room confirmations.
• Corporate Policy Compliance: Enforcing corporate travel approval matrices, travel budget caps, manager verification workflows, and out-of-policy notifications.
• Traveler Safety & Duty of Care: Allowing corporate travel managers to locate traveling employees during flight disruptions, extreme weather events, or geopolitical emergencies.
• Statutory & Tax Compliance: Issuing GST-compliant corporate tax invoices, maintaining accounting records mandated by the Indian Companies Act 2013, and complying with civil aviation safety mandates.
• Customer Service & Travel Assistance: Providing 24/7 urgent flight rescheduling, baggage delay coordination, cancellation assistance, and refund disbursements.
• Platform Security & Fraud Prevention: Monitoring for unauthorized corporate account access, fraudulent booking attempts, bot traffic, and payment chargebacks.

To fulfill international and domestic travel bookings, Tripiffic must transmit personal information to third-party travel suppliers and technology sub-processors. The table below outlines our primary sub-processors, their roles, and processing jurisdictions:

Tripiffic operates its core platform within secure cloud data centers located in India. However, when an authorized traveler books an overseas itinerary (such as a flight between New Delhi and London or a hotel in Singapore), personal data must necessarily be transmitted to airlines, ground handling agents, and hotel properties located outside India.

We implement Standard Contractual Clauses (SCCs), robust Data Transfer Addendums, and strict technical safeguards to guarantee that overseas recipients uphold equivalent data protection standards as prescribed under Indian data privacy laws and international treaties.

Tripiffic maintains strict organizational, operational, and technical safeguards to preserve the confidentiality, integrity, and availability of all customer records:

• Encryption in Transit: All data transferred between your browser, mobile app, and Tripiffic servers is encrypted using Transport Layer Security (TLS 1.3) with HSTS enforcement.
• Encryption at Rest: All production databases containing passport numbers, traveler profiles, and booking histories are encrypted using AES-256 standard cryptographic keys.
• Role-Based Access Control (RBAC): Employee access to customer records is restricted on a strict least-privilege basis, requiring multi-factor authentication (MFA) and immutable audit logging.
• Vulnerability Assessments: We conduct recurring vulnerability scans, automated dependency audits, and annual third-party penetration tests on all web applications and APIs.
• Network Isolation: Production workloads reside inside private virtual cloud subnets with strict web application firewall (WAF) rule sets guarding against DDoS attacks and SQL injection.

Different types of personal records are governed by specific statutory retention mandates:

Under applicable privacy legislations, travelers and corporate administrators have the following enforceable rights:

• Right of Access & Summary: Request a comprehensive summary of personal data held about you by Tripiffic and the specific third parties with whom it was shared.
• Right to Rectification: Correct out-of-date or incomplete passport, name spelling, or contact details directly through your Traveler Profile portal.
• Right to Erasure / Deletion: Request the permanent deletion of personal data when travel bookings are concluded and legal retention periods have expired.
• Right to Data Portability: Receive an export of your historical booking records and profile data in a structured, machine-readable (JSON/CSV) format.
• Right to Withdraw Consent: Withdraw consent for optional processing activities (such as marketing newsletters or AI personalized recommendations) without penalty.
• Right to Nominate: Under Section 14 of the DPDP Act 2023, you have the right to nominate an authorized individual who may exercise your data rights in the event of death or incapacity.

Our web platform uses HTTP cookies, local storage tokens, and session identifiers to provide a seamless booking experience:

• Strictly Essential Cookies: Necessary for authentication, maintaining your corporate login session, CSRF token security, and booking cart state.
• Functional Cookies: Remember your preferred currency, airport code origins, departure dates, and passenger counts during complex multi-city searches.
• Performance & Analytics: Help our engineering team understand search latency, booking completion rates, and page error rates to optimize platform performance.

Tripiffic reserves the right to amend this Privacy Policy at any time. When we enact material modifications, we will update the 'Last Updated' date at the top of this document, post a prominent banner on the corporate dashboard, and where appropriate, send an email notification to registered corporate administrators.

Your continued use of our booking services and corporate portal following notice of revisions constitutes acknowledgment of the updated policy terms.

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, Tripiffic has designated a full-time Grievance Officer and Data Protection Officer to address consumer privacy matters and regulatory queries.