Legal
Privacy Policy
Last updated: January 2025
This Privacy Policy describes how Kadal2Sahyadri collects, uses, and protects your personal information when you use our platform. We are committed to safeguarding your privacy and handling your data transparently and responsibly.
Contents
1. Information We Collect
1.1 Information you provide directly
- Account registration: name, email address, mobile number, password
- Organizer registration: organization name, business documents for KYC verification
- Bookings: participant names, age, ID proof type, emergency contact name and phone number
- Reviews: ratings and written feedback you submit
- Communications: messages you send to our support team
1.2 Information collected automatically
- Usage data: pages visited, features used, search queries, timestamps
- Device information: IP address, browser type, operating system
- Cookies: session identifiers and preference cookies (see Section 8)
1.3 Payment information
Payments are processed by Razorpay. We do not store credit/debit card numbers, CVV, or full bank account details. We receive and store transaction IDs, payment status, and amounts for booking and refund purposes.
2. How We Use Your Information
We use the information we collect to:
- Create and manage your account
- Process bookings, payments, and refunds
- Generate e-passes and participant manifests for activity organizers
- Send booking confirmations, OTPs, and important service notifications via SMS and email
- Verify organizer identity and process KYC approvals
- Enable you to leave and receive reviews
- Respond to your support queries
- Detect and prevent fraud and platform abuse
- Improve the platform through aggregated, anonymised analytics
- Comply with applicable legal obligations
We do not use your personal data for automated decision-making that produces significant legal effects on you.
4. Organizer Data Obligations
As an organizer, you receive personal data about trekkers (name, phone, emergency contact) solely for the purpose of conducting the specific booked activity. You must:
- Use customer data only for conducting the booked adventure
- Not share customer data with third parties without explicit consent
- Not use customer data for marketing, solicitation, or any purpose beyond the booking
- Delete customer data within 90 days of the activity completion date
- Maintain reasonable security measures for any stored participant data
Violation of these obligations constitutes a breach of the Organizer Terms & Conditions and may result in account termination.
5. Data Security
We implement industry-standard security measures to protect your personal data, including:
- HTTPS encryption for all data in transit
- Passwords are hashed and never stored in plain text
- OTP-based verification for account access
- Access controls limiting who can access personal data internally
No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately.
6. Data Retention
We retain your personal data for as long as your account is active or as needed to provide you with our services. Specifically:
- Account data: retained until you delete your account
- Booking records: retained for 7 years for financial and legal compliance
- Payment records: retained for 7 years as required by Indian tax law
- Usage logs: retained for up to 12 months, then anonymised
After account deletion, we anonymise or delete your personal data within 30 days, except where retention is required by law.
7. Your Rights
Under applicable Indian data protection law, you have the right to:
- Access: request a copy of the personal data we hold about you
- Correction: update inaccurate or incomplete information via Account Settings
- Deletion: request deletion of your account and associated personal data
- Portability: request your data in a structured, machine-readable format
- Objection: object to processing of your data for certain purposes
- Withdraw consent: opt out of non-essential communications at any time
To exercise any of these rights, contact us at privacy@kadal2sahyadri.com. We will respond within 30 days.
9. Children's Privacy
Our platform is intended for users aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it promptly.
Trek bookings for participants under 18 must be made by a parent or legal guardian who accepts full responsibility for the minor's participation.
10. Contact Us
For privacy-related queries, requests, or complaints, contact our Data Protection point of contact:
This policy is governed by the laws of India. We will endeavour to resolve all queries within 30 days of receipt.