Who we are

T4Travelonline Private Limited (“T4Travel”, “we”, “us”) runs www.t4travelonline.com, the T4Travel mobile app (Android and iOS), our corporate travel portal and our offline sales channels. For the personal data described here we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023: we decide why and how it is processed, and we are responsible for it. Our registered office is at 109 Shree Krishna Commercial Centre, 6 Udyog Nagar, S V Road, Goregaon West, Mumbai 400104, Maharashtra, India.

This policy applies to customers, travellers booked by customers, corporate users, people who send us an enquiry, and visitors to our website and app. It does not cover third-party websites linked from ours, or airlines, hotels and insurers, which have their own privacy policies for the data they receive to deliver your service.

The data we collect

We do not ask for Aadhaar. If you choose to share an Aadhaar card as ID, we mask all but the last four digits.

Why we use it, and on what basis

We use only what each purpose needs. We do not use your data for automated decisions that have legal or similarly significant effects on you.

Who we share it with

We share personal data only with those who need it to deliver your booking or support our service:

• Airlines and hotels, and our booking platform partner TBO, to issue tickets and confirm stays;
• Easebuzz, our payment aggregator, to process payments and refunds;
• Asego and partner insurers, if you add travel insurance;
• Cashfree, to verify PAN;
• Service providers who host our systems, send emails, SMS and WhatsApp messages, deliver app notifications (Google Firebase) and build and support our software (Wooshelf), all under contracts that limit their use of the data;
• Your employer, if you book under a corporate account;
• Government authorities, only when the law requires it.

We do not sell or rent personal data, and we do not share it with advertisers. Full details are in our Third-Party Data Sharing and Vendor Management Policy.

International transfers

An international booking means sharing data with an airline or hotel abroad, and some service providers process data outside India. We transfer data abroad only as permitted by section 16 of the DPDP Act and never to a country restricted by the Central Government, and we require the same protection from overseas partners as from Indian ones.

How long we keep it

We keep data only as long as the purpose needs, or as the law requires. For example: your account until you delete it; booking, invoice and tax records for 8 years from the end of the financial year; passport details for 90 days after travel unless you save them to your profile; security logs for at least one year. The full schedule is in our Data Retention and Deletion Policy.

How we protect it

• All traffic to our website, app and APIs is encrypted with HTTPS (TLS 1.2 or higher).
• Databases and backups are encrypted at rest; passwords are stored only as salted hashes.
• Staff and partners see only the data their role needs, with multi-factor authentication for administrative access.
• Access and changes are logged, and logs are kept as the DPDP Rules and CERT-In Directions require.
• We test our systems for vulnerabilities and fix them on a set timeline.
• If a breach affects your data, we tell you and the Data Protection Board without delay, as set out in our incident response policy.

No system is perfectly secure. Please keep your password private, and remember that we will never ask for your OTP, password or card PIN by phone, email or chat.

Your rights

We respond within 30 days, and in every case within the 90-day limit set by the DPDP Rules. We may ask you to confirm your identity first. Withdrawing consent does not affect processing already done, or processing we need for your booking or by law. Under section 15 of the Act you also have duties: to give accurate information and not to file false or frivolous complaints.

Children

You must be 18 or older to create an account or make a booking. When an adult books for a child or infant, the adult confirms they are the child's parent or lawful guardian or acting with the guardian's permission, and we use the child's data only to deliver that booking. We do not track children's behaviour or show them targeted advertising.

Cookies and the mobile app

Our website uses cookies as described in our Cookie Policy, where you can choose which non-essential cookies to allow. Our mobile app's data practices and device permissions are described in our Mobile App Privacy Policy.

Contact us and complaints

Questions, requests and complaints about personal data go to our Grievance Officer. We acknowledge within 24 hours.

If you are not satisfied with our response, you may complain to the Data Protection Board of India once our process has been completed, as provided in section 13(3) of the DPDP Act. The process is described in our Grievance Redressal Policy.

Changes to this policy

We review this policy at least once a year. If we make a material change, such as a new purpose or a new kind of recipient, we will tell you by email or in the app before it applies, and ask for fresh consent where the law requires. The version and effective date are shown at the top of this document.

Laws this policy follows