Privacy policy

Who we are

TFC World Tours (“we”) operates this website and arranges the trips described on it. [Registered entity name], [registered address], [GSTIN / registration number]. For anything in this policy, write to tfcworldtours@gmail.com.

What we collect

When you send an enquiry

The enquiry form asks for your name, email address and a message. A phone number is optional, and you can tell us which trip you are asking about. Everything in the message box is up to you - please do not send us health details, identity documents or payment details through this form. We will ask for what we need, securely, at the point we need it.

Automatically, when you use the site

• Your IP address, briefly, so we can limit how many enquiries one source can send in a short period. It is held in server memory and is not written to our records.
• Standard server logs kept by our hosting provider - request URL, timestamp, IP address, browser user agent.
• A bot check on the enquiry form, described under third parties below.

We do not use analytics or advertising cookies. The site sets no tracking cookies of its own. If that changes, this policy will be updated before the change goes live.

If you book

Arranging a trip needs more: traveller names as they appear on official identity documents, dates of birth, passport and visa details where a trip requires them, emergency contact details, dietary requirements, and any medical or mobility information you choose to share so we can plan safely. Payment is handled by [payment provider] and we do not see or store full card details.

Why we collect it, and on what basis

• To answer your enquiry. We cannot reply without your contact details.
• To arrange and run your trip - performance of our contract with you. This includes passing what is necessary to the guides, drivers, hotels, airlines and permit authorities involved.
• To keep you safe while travelling, including sharing emergency contact or medical information if a situation requires it.
• To meet legal and tax obligations, which require us to retain booking and accounting records.
• To protect the website from automated abuse.

We do not sell your information, and we do not use it to advertise to you. We will only send you marketing if you separately ask us to.

How long we keep it

We keep personal data for a maximum of [6] months, then delete it.

• Enquiries that do not become bookings: up to [6] months, then deleted.
• Booking and payment records: up to [6] months after your trip ends, then deleted. [Reviewer: Indian tax and company law generally require books of account and supporting records to be kept for several years. Confirm the statutory minimum with the agency’s accountant before publishing - a stated six months may be shorter than the law allows.]
• Server logs: up to [30] days, or however long our hosting provider retains them if that is shorter.
• Rate-limiting data: minutes. It lives in server memory and is never written to disk.

Where we are legally required to keep something for longer than six months, we keep only what the law requires and delete the rest.

Who else processes your information

We use the following service providers. Each processes data on our instructions, and several operate outside India, which means your information may be transferred and stored abroad.

• Sanity - our content management system. Enquiries are stored here so our team can work through them. Sanity hosts data in the EU/US.
• Vercel - website hosting and server logs. US-based, served from a global network.
• Resend - delivers the enquiry notification to us and the confirmation email to you. Your name, email address and message pass through it. US-based.
• Cloudflare Turnstile - the “security check” on the enquiry form. It sees your IP address and browser characteristics to distinguish people from bots. Cloudflare states that Turnstile does not use this to build advertising profiles.
• [Payment provider] - handles payments. Add details once chosen.

We may also share what is necessary with the airlines, hotels, homestays, guides, drivers and permit authorities that deliver your trip, and with authorities where the law requires it.

Your rights

India’s Digital Personal Data Protection Act, 2023 gives you rights over your personal data. Depending on the circumstances you can:

• Ask what we hold about you and why.
• Ask us to correct anything inaccurate or incomplete.
• Ask us to erase it, where we are not required to keep it for legal or accounting reasons.
• Withdraw consent you previously gave.
• Nominate someone to exercise these rights on your behalf.
• Complain to us, and then to the Data Protection Board of India.

Write to tfcworldtours@gmail.com and we will respond within [30] days. We may ask you to confirm your identity first, so that we do not hand your information to someone else.

Grievance officer

[Name], [email address], [phone]. Contact them if you are unhappy with how we have handled your information or your request.

Security

The site is served over HTTPS, access to enquiry records is limited to staff who need it, and our service providers are chosen partly on their security posture. No system is perfectly secure, and we will tell you and the relevant authority if a breach affects you.

Children

This site is not aimed at children, and we do not knowingly collect information from anyone under 18 except as part of a family booking made by an adult.

Changes to this policy

We will update the date at the top when this changes. If a change is significant we will say so on this page rather than leaving you to spot it.

Contact

tfcworldtours@gmail.com · +91 99161 32808 · 1 Maruthi Complex, Near Dasarahali Bus Stop, Dasarahali, Bengaluru, Karnataka, India