Privacy & Data Governance Policy
In Compliance with the Digital Personal Data Protection Act (DPDP Act), 2023 & IT Rules, 2011
Diamon Gragon Private Limited acts as the Data Fiduciary for all personal information collected through the DG TRAVEL ecosystem. We adhere to the fundamental principles of purpose limitation, data minimization, and military-grade encryption.
1. Categories of Personal Data Collected
- Identity & Contact: Full legal name, gender, date of birth, postal address, email, and contact number.
- Travel & KYC Particulars: Passport number, passport expiry, nationality, photograph scans, visa approvals, and PAN card details for mandatory statutory TCS compliance.
- Financial & Billing Data: Transaction references, invoices, and GSTIN details. (Note: DG TRAVEL does not store raw card credentials; all payments are routed through PCI-DSS Level 1 tokenized gateways).
2. Specific Purpose for Data Processing
Your data is collected and processed exclusively to execute travel arrangements (hotel check-ins, airline PNR bookings, transfer dispatch, and visa filing), issue legally compliant tax invoices, and provide personalized 24/7 concierge assistance.
3. Non-Disclosure & Information Security
We never sell, rent, or monetize your personal data. Information is shared strictly on a need-to-know basis with operational partners (airlines, hotels, and consular authorities) solely to deliver your confirmed travel bookings. All server communications utilize TLS 1.3 encryption and AES-256 data-at-rest protection.
4. Your Statutory Rights as a Data Principal
Under the DPDP Act, 2023, you retain the right to:
- Request a summary of your personal data processed by DG TRAVEL.
- Seek correction, completion, or updating of misleading or inaccurate records.
- Request erasure of your data upon completion of statutory tax retention periods.