Who this notice covers

This notice covers visitors, account holders, travellers, hotel and vehicle partners, partner staff, drivers, and people who contact Mandyal Travels. A listed supplier may separately control personal data that it collects to deliver accommodation or transport; its own privacy notice should explain that processing.

Mandyal Travels Services Private Limited operates this website and acts as the data fiduciary for personal data processed for its accounts, marketplace, booking-facilitation, security, support, and compliance functions. Its registered-office and contact details are published in the Legal Centre and Contact page.

Information we collect

Depending on the service, we may collect identity and contact information, account credentials, traveller details, booking requests and confirmations, preferences, support communications, consent records, device and security events, approximate location, and payment or refund references.

Partners may provide business identity, ownership, tax, bank-settlement, licence, permit, insurance, property, vehicle, driver, staff, inventory, pricing, availability, safety, incident, and compliance records. We should collect only information reasonably required for the stated purpose.

Full card credentials should be entered only in an approved payment provider interface. Mandyal Travels is intended to retain governed transaction references, amounts, status, and reconciliation evidence rather than raw card details.

Why we use information

We use information to create and secure accounts, display and transmit availability, facilitate or record bookings, identify the contracting supplier, process or reconcile payments and refunds, communicate service updates, respond to complaints, investigate incidents and fraud, meet accounting and legal duties, and improve service reliability.

Marketing is optional and requires the applicable recorded consent. Booking, safety, security, legal, and account messages may still be sent where necessary to provide or protect a requested service.

Sharing and independent suppliers

We may share the minimum relevant information with the selected hotel, vehicle operator, driver or other named supplier; payment and notification providers; identity, fraud-prevention, infrastructure, and professional advisers; insurers; and public authorities when required by law or necessary to protect people and the service.

A supplier receives traveller information to deliver its own service and may have independent legal obligations. Suppliers must not use marketplace data for unrelated marketing, sell it, or disclose it except as authorized or legally required.

Retention and security

Records are retained only as long as reasonably needed for the stated purpose and applicable booking, tax, accounting, payment, dispute, fraud, safety, audit, and legal requirements. Retention schedules must be reviewed against the Digital Personal Data Protection Act, 2023 and the phased commencement of the Digital Personal Data Protection Rules, 2025.

Mandyal Travels uses access controls, scoped integrations, encryption or tokenisation where appropriate, audit trails, backups, validation, monitoring, and incident procedures. No system can promise absolute security; suspected compromise should be reported immediately.

Your choices and rights

Subject to applicable law and identity verification, a person may request access to a summary of processing, correction, completion, updating, erasure, withdrawal of consent, grievance redressal, or nomination. Some records may be retained where required for bookings, payments, disputes, security, or law.

Withdrawing consent must be as easy as giving it for processing that depends on consent. Withdrawal does not invalidate processing already lawfully completed and may prevent an optional feature from continuing.

Children and other travellers

An adult making a booking for another traveller must have authority to provide that traveller’s information and must share relevant notices with them. Child data requires age-appropriate handling and verifiable parental or lawful guardian consent where applicable; commercial child-account functionality must remain disabled until that control is implemented.

Privacy contact and complaints

Contact Jasveer Singh, Director and Grievance Officer, at support@mandyaltravels.com or +91 80693 77940. Include the booking reference, the supplier name, a description of the issue, and any supporting records. Do not send passwords, one-time codes, or full payment-card details.

The final notice must prominently identify the person responsible for answering data-processing questions and the statutory grievance route before personal-data processing is commercially launched. Unresolved statutory complaints may be taken to the competent authority where applicable.