General Data Protection Regulation (GDPR) Policy

1. Purpose & Regulatory Framework

The General Data Protection Regulation (Regulation (EU) 2016/679) enhances privacy rights for individuals and provides a strict, legally binding framework within which commercial entities must operate. Journi Trail™ DMC Private Limited (“Company”, “Journi Trail™ DMC”, “we”, “our”, or “us”) is dedicated to processing all personal records lawfully, transparently, fairly, and securely.

Under UK data protection jurisprudence, including the UK Data Protection Act 2018, this framework remains incorporated into domestic law. Journi Trail™ DMC acts as a registered Data Controller with respect to customer, passenger, vendor, and staff personal data collected to facilitate global travel arrangements, automated itinerary creations, and supplier reservations.

2. Scope & Processing Touchpoints

This Policy applies universally to all personal data collected, managed, and processed by Journi Trail™ DMC across all sales, operational, and digital channels:

• Website visitors and registered platform account holders;
• Customers, travellers, tourists, and individual package bookers;
• Tour participants, group passengers, and family members included on booking vouchers;
• Corporate clients, destination management partners, and B2B travel agents;
• Suppliers, hoteliers, transport operators, airline consolidators, and local excursion contractors;
• Direct employees, contract staff, job applicants, and recruitment candidates; and
• Marketing subscribers, exhibition attendees, and promotional resource downloaders.

Touchpoints encompass web forms, mobile application interfaces, phone recordings (for training and monitoring), WhatsApp coordination desks, email reservation trails, paper tender agreements, and airport immigration desks.

3. Definitions & Operational Roles

• “Personal Data” means any information relating to an identified or identifiable natural person (‘Data Subject’), including names, identification numbers, location data, online identifiers, passport details, or factors specific to physical, physiological, or economic identity.
• “Data Controller” refers to Journi Trail™ DMC, which determines the purposes and means of processing personal data in connection with its travel packages and digital platform.
• “Data Processor” refers to any third-party entity (such as cloud hosting providers, payment gateways, or local ground handlers) that processes personal data on behalf of Journi Trail™ DMC.
• “Processing” encompasses collection, recording, structuring, storage, retrieval, disclosure, dissemination, alignment, restriction, erasure, or destruction.
• “Special Category Data” covers sensitive personal information revealing racial or ethnic origin, religious beliefs, health records, biometric identifiers, or dietary/medical assistance needs.

4. Categories of Personal Data Collected

Depending on the travel service requested or professional engagement, we collect the following structured data sets:

• Identification Data: Full legal name (as per passport), gender, date of birth, nationality, passport number, passport issue and expiry dates, and physical signatures.
• Contact Details: Residential address, operational mailing address, telephone numbers, emergency contact numbers, and verified email addresses.
• Travel & Logistics Data: Passenger manifests, flight numbers, PNR codes, hotel vouchers, ferry tickets, transfer schedules, border visa documentation, and General Practitioner (GP) contact details.
• Financial & Billing Data: Transaction receipts (TRC), bank account identifiers, tax invoices, billing addresses, and payment gateway references (credit/debit card numbers are handled exclusively via PCI-DSS compliant tokenized gateways).
• Technical & Telemetry Data: IP addresses, browser specifications, operating system versions, device telemetry, referral URLs, visit timestamps, and cookie identifiers.

5. How Personal Information is Collected

Personal data is obtained through direct and automated channels:

• Direct Customer Submissions: Online inquiry submissions, customized quotation requests, signed booking forms, electronic dashboard check-ins, telephone calls, customer support chats, and newsletter signups.
• Third-Party Sources: Registered B2B travel agents booking on behalf of lead travellers, airline ticketing systems (GDS), corporate coordinators, recruitment references, and DBS/background check agencies.
• Automated Technology Systems: Essential and analytical cookies, cloud server log files, and mobile location telemetry deployed to coordinate pick-up and drop timings with ground drivers.

6. Purpose of Processing Personal Data

Journi Trail™ DMC processes personal records for defined travel business activities:

• Itinerary Formulation & Quoting: Tailoring tour proposals, calculating dynamic package rates, and managing inquiries prior to contract execution.
• Contract Execution & Fulfilment: Booking flights, holding contracted resort rooms, arranging speedboat/seaplane transfers, securing mandatory attraction entry passes, and issuing ATOL/service certificates.
• Transit Safety & On-Journi Assistance: Providing emergency coordination, managing driver dispatch, and ensuring medical notifications reach on-ground suppliers.
• Post-Tour Feedback & Contests: Conducting post-travel satisfaction surveys, managing photo submission contests, and finalizing supplier settlements.
• Commercial & Financial Audits: Tax reporting (GST/TCS), internal accounting reconciliation, fraud prevention, and dispute resolution.

7. Lawful Legal Bases for Processing

Under Article 6 of the GDPR, Journi Trail™ DMC relies upon the following legal bases:

1. Contractual Necessity (Art. 6(1)(b)): Processing is indispensable to prepare quotations, confirm reservations, issue flight tickets, and deliver overseas travel arrangements requested by the data subject.
2. Legal Obligation (Art. 6(1)(c)): Retaining transaction histories, passenger lists, and invoices to satisfy statutory accounting, tax, airline security, and civil aviation mandates.
3. Legitimate Interests (Art. 6(1)(f)): Analyzing website performance, defending against legal or chargeback claims, preventing cyber fraud, and sending relevant direct marketing brochures (subject to opt-out rights).
4. Explicit Consent (Art. 6(1)(a)): Sending promotional email newsletters, processing voluntary customer survey submissions, and handling special category health information.

8. Special Category Data Protocols

International travel often necessitates processing sensitive personal data under Article 9 of the GDPR. This includes dietary restrictions, physical mobility needs, allergies, and specific medical conditions.

Journi Trail™ DMC processes special category data exclusively when:

• The data subject has provided explicit written or electronic consent (e.g., via the signed reservation form);
• It is essential to safeguard the vital interests of the traveller during medical transit emergencies; or
• It is strictly required by contracted airlines, resorts, or excursion providers to accommodate passengers with disabilities or severe allergies.

Such data is never utilized for marketing or profiling and is wiped once operational travel and legal audit requirements are satisfied.

9. Third-Party Sharing & Data Disclosures

To deliver holiday packages, Journi Trail™ DMC must disclose relevant data to authorized third parties:

• Travel Service Providers: Airlines, contracted hotels/resorts, coach operators, ferry companies, cruise liners, and local Destination Management Companies (DMCs).
• Government & Border Authorities: Customs, border control, security agencies, and immigration desks (such as Imigrasi or international visa authorities).
• Operational & Financial Partners: Insurance underwriters, cloud hosting providers, enterprise email delivery systems, and licensed payment gateways.

All third-party corporate entities are bound by confidentiality obligations and are prohibited from utilizing personal data for unauthorized secondary purposes.

10. Cross-Border International Data Transfers

As a global travel network, Journi Trail™ DMC transfers personal data outside the European Economic Area (EEA) and the UK to destinations where tours are booked (including India, Maldives, Indonesia, UAE, Singapore, Thailand, and Malaysia)[cite: 2, 107].

Where data is transferred to jurisdictions that have not received an adequacy decision under Article 45 of the GDPR, Journi Trail™ DMC implements robust transfer mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• International Data Transfer Agreements (IDTAs) compliant with UK GDPR; and
• Derogations under Article 49(1)(b) of the GDPR, where the cross-border transfer is strictly necessary for the performance of a travel contract concluded between the traveller and Journi Trail™ DMC.

11. Data Storage, Retention & Destruction

Personal data is securely hosted on enterprise-grade cloud servers located within the UK, EU, and compliant international regions (including Google Cloud, Microsoft Azure, Microsoft O365, and Ionos Web Services).

We retain records only as long as necessary for the purpose collected:

• Quotation Records (Unconfirmed): Deleted 12 months post-issuance if booking is not finalized.
• Confirmed Booking Records: Stored for 7 years post-travel to comply with statutory accounting, tax, airline compliance, and legal liability timebars.
• Marketing Contact Lists: Retained until the data subject unsubscribes or exercises their right to object.

Expired records are permanently erased, digitally shredded, or irreversibly anonymized.

12. Technical & Organizational Security Measures

Journi Trail™ DMC implements defense-in-depth security to protect personal data against loss, destruction, alteration, or unauthorized disclosure:

• End-to-end data encryption using SSL/TLS protocols during web and database transmission;
• Role-Based Access Controls (RBAC) ensuring only authorized operations personnel access passenger lists;
• Firewall protections, anti-malware systems, encrypted backups, and multi-factor authentication (MFA) on all administrative systems; and
• Routine system vulnerability assessments and data handling audits.

13. Personal Data Breach Incident Protocol

In accordance with Articles 33 and 34 of the GDPR, Journi Trail™ DMC maintains a rapid incident response protocol. In the event of a verified security incident resulting in unlawful destruction, loss, or unauthorized disclosure of personal data:

• The incident is isolated and contained by technical security officers within hours;
• The relevant supervisory authority is formally notified within 72 hours of discovery where the breach poses a risk to individual rights; and
• Affected data subjects are notified without undue delay if the incident presents a high risk to their rights and freedoms, accompanied by remedial guidance.

14. Data Subject Rights (Articles 15–22)

Under Chapter III of the GDPR, individuals located in the EU/EEA and UK possess enforceable legal rights:

• Right of Access (Article 15): Obtain confirmation of processing and receive a free copy of personal records held by the Company.
• Right to Rectification (Article 16): Demand correction of inaccurate, outdated, or incomplete records (such as passport spelling rectifications).
• Right to Erasure / Right to be Forgotten (Article 17): Request deletion of records where retention is no longer justified, subject to statutory accounting overrides.
• Right to Restriction of Processing (Article 18): Restrict active processing while data accuracy or legal objections are evaluated.
• Right to Data Portability (Article 20): Receive personal data provided to us in a structured, commonly used, and machine-readable format (CSV/JSON).
• Right to Object (Article 21): Object at any time to processing based on legitimate interests or direct marketing campaigns.
• Right to Withdraw Consent (Article 7(3)): Revoke previously given consent without affecting the lawfulness of prior processing.

15. How to Exercise Your Rights (Subject Access Requests)

To exercise any data protection right, submit a formal written Subject Access Request (SAR) to our compliance team:

By Email: info@journitrail.com
By Post: Journi Trail™ DMC, Gr.F 119 A, FIEE Complex, Okhla Phase-II, Okhla Industrial Estate, New Delhi – 110020, India

Requests are processed without undue delay and within one calendar month of receipt. For complex or multiple inquiries, this window may be extended by up to two additional months with prior written notification. Identity verification is mandatory prior to releasing records. All SARs are executed free of charge, unless requests are deemed manifestly unfounded or excessive, in which case a £50 administrative fee may apply.

16. Supplier & Vendor Tendering Data Practices

When external companies tender for or supply hospitality, coach, transfer, or guide services to Journi Trail™ DMC, we process business contact data:

• Owner, transport manager, and driver names and phone numbers;
• Operator licences, public liability insurance certifications, and vehicle registration numbers; and
• Hotel management, health and safety audit signatures, and emergency contact details.

This information is processed to coordinate emergency tour assistance, verify passenger safety standards, and execute commercial settlements.

17. Human Resources & Employee Data Practices

During recruitment and employment stages, Journi Trail™ DMC processes applicant CVs, references, national insurance numbers, payroll accounts, next-of-kin contacts, pension numbers, and workplace training files. Unsuccessful applicant records are purged within 6 months post-interview, while active employee files are maintained for statutory employment record periods.

18. Limitation of Liability

While Journi Trail™ DMC maintains industry-standard technical, operational, and organizational security protocols, the Company shall not be held liable for damages resulting from state-sponsored cyber disruptions, global internet backbone collapses, or unauthorized third-party malicious intrusions that occur beyond commercially reasonable control.

19. Policy Amendments & Updates

Journi Trail™ DMC reserves the right to amend, update, or revise this GDPR Policy periodically to reflect technological advancements, operational requirements, or international regulatory updates. Revised versions take effect immediately upon publication on the platform.

20. Data Protection Officer & Contact Desk

For questions, formal rights requests, or regulatory communications regarding our GDPR compliance, reach out to our dedicated compliance desk:

Journi Trail™ DMC Private Limited
Head of Compliance / DPO: Prakash Verma[cite: 102, 106]
Email: info@journitrail.com | director@journitrail.com
Direct Hotline: +91 99-11-555-721 | +91 99-11-555-720
Registered Address: Gr.F 119 A, FIEE Complex, Okhla Phase-II, Okhla Industrial Estate, New Delhi – 110020, India

You also maintain the legal right under Article 77 of the GDPR to lodge a complaint with your domestic Data Protection Supervisory Authority (such as the UK Information Commissioner's Office - ICO, or relevant EU Data Protection Authority) if you believe processing violates statutory rules.