Data you provide directly

When you make a booking, submit an enquiry, or contact us, we collect your name, email address, mobile number, company name, designation, travel itinerary details, pickup and drop locations, and any other information you voluntarily provide. For corporate accounts, we may also collect the name and contact details of your authorised representative.

Payment data

Payments are processed exclusively by Stripe, a PCI-DSS Level 1 certified payment processor. We do not receive, store, or process your card number, CVV, or full payment credentials on our servers. Stripe's Privacy Policy (stripe.com/in/privacy) governs the handling of your payment data.

Technical and usage data

Our web server automatically records standard access logs including your IP address, browser type and version, pages visited, referral URL, and timestamps. This data is used solely for security monitoring, fraud prevention, and improving our service. We do not use this data to build individual profiles.

Communications

If you contact us by email, phone, or through our enquiry form, we retain records of that correspondence to respond to your query and to maintain a service history.

Under the Digital Personal Data Protection Act, 2023, we process your personal data on the following lawful bases: (a) Consent — you have given free, specific, informed, and unambiguous consent when submitting an enquiry or creating an account; (b) Contract — processing is necessary to perform the travel service contract you have entered into with us; (c) Legal obligation — processing is required to comply with applicable Indian law, including tax, accounting, and transport regulations; (d) Legitimate interests — processing is necessary for our legitimate business interests such as fraud prevention and service improvement, provided those interests are not overridden by your rights.

We use your personal data to: process, confirm, and manage your bookings; communicate booking confirmations, receipts, and service updates; respond to your enquiries and provide customer support; issue invoices and comply with GST and other tax obligations; improve our website, services, and internal processes; detect and prevent fraud or misuse of our services; comply with legal obligations and respond to lawful requests from government authorities.

We do not sell, rent, or trade your personal data to third parties for marketing or advertising purposes. We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.

Service providers (Data Processors)

We engage trusted third-party service providers who process data on our behalf under written data processing agreements. These include Stripe (payment processing) and GoDaddy (website hosting and infrastructure). These providers are permitted to use your data only to perform services for us and are contractually bound to protect it.

Legal and regulatory disclosure

We may disclose your personal data if required by law, court order, or a competent government or regulatory authority, or where necessary to protect the rights, property, or safety of Muni Nayak Travels, our customers, drivers, or the public.

Business transfers

In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy, and you will retain the right to withdraw consent.

Cross-border transfers

Our primary operations and data storage are within India. Where data is transferred outside India (for example, to Stripe's global infrastructure), such transfers are made in accordance with the DPDPA and applicable rules, including to countries notified by the Central Government as providing adequate data protection.

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. Booking and transaction records are retained for a minimum of seven years to comply with GST, income tax, and accounting regulations under Indian law. Enquiry and communication records are retained for up to two years. You may request deletion of your data at any time (see Section 7), subject to our legal retention obligations.

Our website uses strictly necessary cookies required for the site to function correctly, such as session management and security tokens. We do not currently use advertising, behavioural tracking, or third-party analytics cookies. If we introduce such cookies in the future, we will update this policy, display a cookie consent notice, and obtain your consent before placing non-essential cookies on your device, in accordance with applicable law.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. All data transmitted between your browser and our website is encrypted using HTTPS/TLS. Access to personal data is restricted to authorised personnel on a need-to-know basis.

In the event of a personal data breach that is likely to result in harm to you, we will notify the Data Protection Board of India and affected individuals as required under the DPDPA. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the following rights: (a) Right of Access — to obtain a summary of the personal data we hold about you and the processing activities carried out; (b) Right to Correction and Erasure — to correct inaccurate or incomplete data, and to request erasure of data no longer necessary for the purpose for which it was collected, subject to legal retention obligations; (c) Right to Grievance Redressal — to have your grievances addressed by our Grievance Officer within the timelines prescribed under the DPDPA; (d) Right to Nominate — to nominate another individual to exercise your rights in the event of your death or incapacity; (e) Right to Withdraw Consent — to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our Grievance Officer at [email protected] or call +91 9989803363. We will acknowledge your request within 48 hours and respond substantively within 30 days. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is constituted.

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the details of our Grievance Officer are as follows: Name: Muni Nayak; Organisation: Muni Nayak Travels; Address: Hyderabad, Telangana — 500097, India; Email: [email protected]; Phone: +91 9989803363. The Grievance Officer can be contacted for any complaints or concerns regarding the processing of your personal data or any violation of applicable data protection law.

Our website may contain links to third-party websites, including payment processors and social media platforms. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit before providing your personal data.

Our services are directed at businesses and adult individuals. We do not knowingly collect personal data from children under the age of 18. Under the DPDPA, processing of personal data of children requires verifiable parental consent. If you believe we have inadvertently collected personal data of a child, please contact us immediately and we will delete such data promptly.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. The updated policy will be posted on this page with a revised effective date. Where changes are material, we will notify you by email or by a prominent notice on our website. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact our Grievance Officer: