Privacy Policy

1. Introduction & Data Fiduciary

ADAB Travels (operated by Eram Enterprises, having its principal office at Kamta, Lucknow, Uttar Pradesh, PIN: 226028, India) is committed to protecting the privacy, integrity, and confidentiality of personal data entrusted to us. In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, this Privacy Policy explains how we collect, process, store, and safeguard your personal information when you access or use our consumer and B2B travel portal (adabtravels.in).

2. Personal Data We Collect

We collect only necessary and proportionate personal data required to deliver travel booking services:

• Contact & Account Information: Name, business title, phone number, email address, agency name, and encrypted login credentials.
• Traveler Details: Passenger names, date of birth, gender, passport details (for international flights/tours), visa documentation, and government ID numbers where required by airlines or transport regulators.
• Agency KYC & Verification: PAN card, GST registration certificate, IATA/TAFI credentials, and bank account/cheque copies for B2B float credit verification.
• Transaction Data: Booking reference numbers, wallet ledger movements, payment gateway transaction IDs, and invoice details. We do not store card CVVs or net banking passwords.

3. Purpose and Legal Basis for Processing

Your data is processed strictly based on lawful purposes under Section 4 and Section 7 of the DPDP Act:

• Fulfilling flight ticket issuance, hotel reservations, car rentals, and tour bookings with downstream transport carriers (Air India, IndiGo, Akasa, AirIQ, GDSs).
• Complying with aviation security regulations mandated by the Bureau of Civil Aviation Security (BCAS) and the Directorate General of Civil Aviation (DGCA).
• Preventing financial fraud, unauthorized double-spending, and identity theft.
• Generating GST-compliant tax invoices and fulfilling statutory accounting audits under Indian tax laws.

4. Data Sharing & Downstream Transfers

Personal data is shared only with verified downstream service providers strictly required to complete your booking:

• Airlines & Travel Aggregators: Passenger manifests transmitted to airline reservation systems for PNR generation and ticketing.
• Payment Gateways: RBI-authorized payment aggregators (PhonePe, Paytm, Razorpay) for transaction processing over TLS 1.3 encryption.
• Government & Law Enforcement: Strictly when mandated by statutory summons or valid court orders under Indian law.

5. Data Retention & Security Controls

We enforce multi-layered defense in depth to safeguard data at rest and in transit:

• All database transmissions are secured using TLS/SSL encryption with automated certificate renewal.
• Traveler and customer PII is access-controlled via granular Role-Based Access Controls (RBAC) and HMAC-protected access tokens.
• Data is retained for the period necessary to complete the travel lifecycle and comply with GST accounting mandates (7 years), after which it is securely purged or anonymized.

6. Your Rights Under the DPDP Act

As a Data Principal under Indian law, you have the right to:

• Right to Access: Request a summary of your personal data processed by ADAB Travels.
• Right to Correction & Erasure: Request correction of inaccurate personal data or deletion of data no longer required for statutory purposes.
• Right of Grievance Redressal: Direct questions, concerns, or complaints to our appointed Grievance Officer.