Privacy Policy – The Travel Saints

Last updated: 2^nd November 2026

This policy explains how The Travel Saints collects, uses, shares and protects your personal information when you visit thetravelsaints.com, send us an enquiry, register as a travel advisor, or travel with us. We have written it to meet India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Act”), the UK General Data Protection Regulation and the Data Protection Act 2018 (the “UK GDPR”), and the EU General Data Protection Regulation (the “EU GDPR”), because our guests come from all three.

In India, the old saying is that the guest is god. We treat your information with the same care: we collect only what we need to plan and deliver your journey, we never sell it, and you can ask us what we hold and have it corrected or deleted at any time.

1. Who we are

The Travel Saints (“we”, “us”, “our”) is a trading name of THE TRAVEL SAINTS, GSTIN 06AISPP2790E2ZV, with its office at 15th Floor, Quest Offices, Ocus Quantum, Sector 51, Gurugram, Haryana 122003, India.

For the purposes of data protection law, we are the “data fiduciary” (under the DPDP Act) and the “controller” (under the UK and EU GDPR) of the personal information described in this policy.

You can contact us about anything in this policy at [email protected] or by post at the address above. Our Grievance Officer is named in section 13.

2. The information we collect

Information you give us

When you send an enquiry or request your invitation: your name, email address, phone or WhatsApp number, country of residence, how you would like to travel, the number of travellers, your preferred dates and length of stay, the eras or experiences that interest you, any special occasion, how you heard about us, and anything else you choose to tell us.
When you register as a travel advisor: your name, agency name, role, business email and phone, website, country, the kind of clients you serve and your trade association membership, if any.
When you book a journey: the full names, dates of birth, nationalities and passport details of every traveller (needed by hotels and the authorities in India), emergency contact details, flight and arrival details, room preferences, and billing and payment information.
Information about your needs: dietary requirements, mobility needs, medical conditions or allergies you choose to share so that we can look after you safely. Some of this may reveal information about your health or religious beliefs (for example, a halal, kosher or Jain diet). We treat it with extra care, as explained in section 4.
For Celebrations journeys: your clothing sizes and style preferences, so that your outfits can be chosen and fitted, and any information you share about how you would like to take part in the wedding.
When you contact us: the content of your emails, WhatsApp messages and calls, and notes of our conversations.
When you subscribe to our newsletter: your email address and your consent.
After your journey: feedback, reviews and photographs you choose to share with us.

Information collected automatically

Device and usage information: your IP address, browser type, device type, pages visited, links clicked and the website that referred you. This is collected through cookies and similar technologies, as explained in our Cookie Policy.
Security logs: our hosting, firewall and security services record IP addresses and requests to protect the website against attacks and spam.

Information from others

Travel advisors: if you book through a travel advisor, they give us the details needed to plan and book your journey.
People you travel with: the lead traveller may give us information about other members of the group. If you give us information about someone else, please make sure they have seen this policy and are happy for you to share it.
Suppliers: hotels, guides and transport partners may tell us about incidents or feedback during your journey.

3. How we use your information, and why

We only use your information where the law allows. The table below sets out what we do, and the legal basis for each purpose under the UK and EU GDPR. Under the DPDP Act, we rely on your consent, given when you send us your details, or on “legitimate uses” such as processing information you have voluntarily provided for a specified purpose, or meeting a legal obligation.

What we use it for	Legal basis (UK and EU GDPR)
To reply to your enquiry, talk with you about your journey and prepare a proposal	Steps taken at your request before entering a contract; our legitimate interest in responding to people who contact us
To book and deliver your journey: stays, transport, guides, experiences, host families and entry permits	Performance of our contract with you
To look after your safety, dietary and mobility needs	Your explicit consent for health information; performance of our contract; your vital interests in an emergency
To take payments, issue invoices and keep accounts	Performance of our contract; legal obligation (tax and accounting laws)
To meet legal requirements in India, such as hotel guest registration of foreign nationals (Form C) and record keeping	Legal obligation
To work with travel advisors who book on behalf of clients	Performance of our contract with the advisor; our legitimate interest in running our business
To send our newsletter, Stories from India	Your consent, which you can withdraw at any time
To keep in touch with past guests about journeys similar to the ones they have taken	Our legitimate interest (UK and EU soft opt-in rules); you can opt out at any time
To understand how visitors use our website and improve it	Your consent to statistics cookies (and, in the UK, the statistics exemption with a right to object)
To protect our website, guests and business from fraud, spam and misuse	Our legitimate interest in keeping our services secure
To handle complaints, claims and legal disputes	Our legitimate interest in defending our rights; legal obligation

We do not make decisions about you based solely on automated processing, and we do not use your information to profile you for advertising.

4. Sensitive information

Information about your health (including allergies, medical conditions and mobility), and information that reveals religious beliefs through dietary choices, is treated as “special category data” under the UK and EU GDPR. We only collect it if you choose to give it to us, and we ask for your explicit consent to use it. We use it only to keep you safe and comfortable, and share it only with the people who need it, such as your hotel, guide, host family or a doctor in an emergency.

You can withdraw your consent at any time. If you do, we may not be able to provide some parts of a journey safely, and we will tell you if that is the case.

We do not ask for passport details, copies of documents or payment information through our website forms. Please do not send card details by email or WhatsApp.

5. Children

Our website is intended for adults. We do not knowingly collect information directly from anyone under 18.

Children are welcome on many of our journeys. When a child travels with us, a parent or legal guardian gives us the child’s information and consents on their behalf. Under the DPDP Act, we obtain verifiable consent from the parent or guardian before processing a child’s personal data, and we never track children’s behaviour or direct advertising at them.

6. Who we share your information with

We never sell your personal information. We share it only as follows, and only as much as each recipient needs:

The people who make your journey happen: hotels, palace and heritage properties, drivers and transport companies, rail and airline operators, guides and Saints (historians, artisans, cooks, musicians and hosts), host families for Celebrations, tailors and stylists, and venues and monuments that need guest lists for private access.
Your travel advisor, if you booked through one.
Our service providers, who process information on our behalf under contracts that require them to keep it secure and use it only on our instructions. These include our website host and email provider ([Hostinger International Ltd.]), our website security and content delivery network ([Cloudflare, Inc.]), website analytics ([Google Ireland Ltd. / Google LLC], Google Analytics), cloud storage for backups ([Google Drive]), our call booking tool ([Calendly LLC]), messaging ([WhatsApp, a Meta company]), our newsletter provider (Substack), and our payment provider (Razorpay).
Professional advisers, such as accountants, lawyers and insurers, under duties of confidentiality.
Authorities, where the law requires it: for example, hotels in India must report the stay of foreign nationals to the Foreigners Regional Registration Office (FRRO), and we may need to respond to lawful requests from courts, police or regulators.
In an emergency, with doctors, hospitals, your insurer, your emergency contact or consular officials, where needed to protect your life or health.
If our business changes hands, with a buyer or successor, who would be bound by this policy.

7. International transfers

We are based in India, and your journey takes place in India. If you live in the UK, the European Economic Area or elsewhere, your information will be transferred to India so that we can reply to you and deliver your journey. Some of our service providers may also process information in other countries, such as the United States or the European Union.

Where the UK or EU GDPR applies, we transfer information to India because the transfer is necessary to perform our contract with you or to take steps you have asked for, and, for our service providers, we rely on safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the provider’s certification under the EU-US and UK-US data frameworks.

Under the DPDP Act, we may transfer personal data outside India except to any country the Government of India restricts.

8. How long we keep your information

Information	How long we keep it
Enquiries that do not lead to a booking	24 months after our last contact with you, then deleted
Booking records, invoices and payment records	8 years after your journey, as required by Indian tax and accounting law
Health, dietary and mobility information	Until 3 months after your journey ends, unless needed for a claim or incident
Passport details	Until 3 months after your journey ends, unless the law requires longer
Travel advisor registrations	For as long as we work together, and 2 years after
Newsletter subscriptions	Until you unsubscribe; we then keep your email on a suppression list so that we never email you again
Website analytics	14 months
Website backups	Up to 30 days on a rolling basis
Complaints and claims	6 years after they are resolved

When information is no longer needed, we delete it or make it anonymous.

9. How we protect your information

We use appropriate technical and organisational measures to protect your information, including encrypted connections (HTTPS) across our website, two-step login for our staff, a website firewall, daily backups kept off the server, access limited to the people who need it, and confidentiality obligations for everyone who handles guest information.

No system is completely secure. If a personal data breach occurs that is likely to affect you, we will tell you without undue delay and notify the Data Protection Board of India, the UK Information Commissioner’s Office or the relevant EU authority where the law requires, within the time limits it sets.

10. Your rights

Depending on where you live, you have some or all of the following rights:

Access: ask for a copy of the information we hold about you and how we use it.
Correction: ask us to correct or complete information that is wrong or out of date.
Erasure: ask us to delete your information, unless we must keep it by law (for example, invoices).
Withdraw consent: at any time, as easily as you gave it. This does not affect what we did before you withdrew it.
Object: to our use of your information based on legitimate interests, and at any time to direct marketing.
Restriction: ask us to pause using your information while a concern is looked into (UK and EU).
Portability: receive information you gave us in a common electronic format, or have it sent to another organisation (UK and EU).
Grievance redressal: have your concern dealt with by our Grievance Officer (India).
Nomination: nominate another person to exercise your rights if you die or are unable to do so (India).

To use any of these rights, write to [email protected] with the subject “Privacy request”. We may ask you to confirm your identity. There is no charge. We will reply as soon as possible, and within one month for UK and EU requests, or within the time set by the DPDP Rules for Indian requests.

Under the DPDP Act, you may also give, manage or withdraw your consent through a registered Consent Manager once such services are available.

11. Marketing

We only send our newsletter if you have asked for it. Past guests may occasionally hear from us about similar journeys. Every email includes a link to unsubscribe, and you can also write to us at any time. We do not share your details with other organisations for their marketing.

12. Cookies

Our website uses cookies. Essential cookies keep it working and secure. We only use statistics or marketing cookies with your consent, which you can give or withdraw at any time using the cookie banner or the “Manage consent” link at the foot of every page. Our Cookie Policy explains each cookie we use.

13. Questions, complaints and our Grievance Officer

If you have a question or concern about how we handle your information, please contact us first. We take every concern seriously and will acknowledge it within 30 days.

Grievance Officer: Administrator, The Travel Saints, 15th Floor, Quest Offices, Ocus Quantum, Sector 51, Gurugram, Haryana 122003, India. Email: [email protected]. Phone: +91 90081 05051 and +91 99900 53150.

You also have the right to complain to a data protection authority:

India: the Data Protection Board of India, once you have used our grievance process.
United Kingdom: the Information Commissioner’s Office, ico.org.uk.
European Union: the data protection authority in the country where you live or work.

14. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. If we make significant changes, we will tell you by email or with a notice on our website.