1. Who We Are
This Privacy Policy describes how GHURIO™ ("Ghurio™", "we", "us", "our"), a partnership firm, collects, uses, and protects personal data you provide when using the Ghurio Platform (website and related services).
GHURIO is the data fiduciary responsible for your personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act).
GHURIO
Rani Kutir, Baisnabghata Patuli
Kolkata – 700084, West Bengal, India
Email: [email protected]
2. Data We Collect
2.1 Data you give us
| Category | Examples | When collected |
|---|---|---|
| Account data | Name, email address, password (hashed) | Registration |
| Passenger data | Full name, date of birth, gender, nationality, passport number & expiry, frequent flyer number | Booking |
| Contact data | Phone number, WhatsApp number, email address | Registration / booking |
| Payment data | Payment method type, last 4 digits of card (from payment processor receipt only — card numbers are never stored by Ghurio) | Payment |
| Support data | Messages, attachments, and information you provide when contacting support | Support interaction |
2.2 Data we collect automatically
| Category | Examples |
|---|---|
| Device & browser data | IP address, browser type, operating system, device type |
| Usage data | Pages visited, search queries (origin, destination, dates), clicks, session duration |
| Error data | JavaScript errors and stack traces (for debugging only) |
We do not use Google Analytics, Facebook Pixel, or any advertising or behavioural tracking technologies.
3. How We Use Your Data
| Purpose | Legal basis (DPDP Act) |
|---|---|
| Process and manage your bookings | Performance of contract |
| Send booking confirmations, e-tickets, and invoices | Performance of contract |
| Communicate important booking updates (delays, cancellations) | Performance of contract |
| Process payments via our payment processors (PayU / Cashfree) | Performance of contract |
| Respond to support queries and grievances | Performance of contract / legal obligation |
| Fraud detection and platform security | Legitimate interest |
| Debug platform errors | Legitimate interest |
| Comply with legal obligations (GST, IT Act) | Legal obligation |
We do not use your personal data for targeted advertising, profiling for marketing purposes, or selling to third parties.
6. Data Retention
| Data type | Retention period |
|---|---|
| Account data | Until account deletion + 30 days (for recovery) |
| Booking and passenger data | 7 years from booking date (GST record-keeping requirement) |
| Payment transaction records | 7 years (as required by financial regulations) |
| Support communications | 3 years from last interaction |
| Error logs | 90 days |
After the applicable retention period, data is securely deleted or anonymised.
7. Your Rights
Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights regarding your personal data:
- Right to access — request a copy of the personal data we hold about you
- Right to correction — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your data (subject to legal retention requirements)
- Right to grievance redressal — raise a complaint with our Grievance Officer
- Right to nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the Data Protection Board of India once it is operational.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:
- HTTPS/TLS encryption for all data in transit
- Per-user access controls and encryption at rest for stored data
- Session-based authentication with short-lived tokens
- Payment data handled exclusively by our PCI-DSS Level 1 certified payment processor — Ghurio never sees or stores full card numbers
- Access to production data restricted to authorised personnel only
No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
9. Children
The Ghurio Platform is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us at [email protected] and we will delete it promptly.
Bookings for minors travelling with adults may include the minor's passenger details (name, DOB, passport). This data is provided by the accompanying adult traveller and is used solely to fulfil the booking.
10. Account Deletion
You may request deletion of your Ghurio account at any time by:
- Going to My Account → Settings → Delete Account, or
- Emailing [email protected] with subject line "Account Deletion Request"
Upon deletion, your account and associated personal data will be removed within 30 days, except for data we are required to retain under law (e.g., booking and tax records for 7 years per GST requirements).
11. Grievance & Contact
For any privacy-related queries, concerns, or to exercise your rights, contact our Grievance Officer:
Arpan Debnath
Grievance Officer — GHURIO
Email: [email protected]
Address: Rani Kutir, Baisnabghata Patuli, Kolkata – 700084, West Bengal
Response time: within 30 days of receipt
For general support queries, contact [email protected].
12. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated by email or a notice on the Platform at least 7 days before the change takes effect.
Continued use of the Platform after the effective date of a change constitutes acceptance of the updated Policy.