Privacy Policy

1. Introduction

Harshubh Tech Pvt. Ltd. (hereinafter referred to as "HMS Group," "we," "us," or "our"), operating under the brand name HMS India Tour, is committed to protecting the privacy and personal data of its users. This Privacy Policy explains how we collect, use, store, and protect your personal information when you access our website, book event tickets, or interact with our services.

This Privacy Policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDPA).

2. Data Fiduciary Information

Data Fiduciary: Harshubh Tech Pvt. Ltd.
Registered Office: Surat, Gujarat, India
Contact Email: privacy@harshubh.com
Website: https://hmsapp.harshubh.com

3. Personal Data We Collect

We collect the following categories of personal data when you use our services:

Data Category	Details	Purpose
Identity Data	Full name	Ticket booking, event check-in, certificate generation
Contact Data	Email address, phone number	Booking confirmation, event updates, support communication
Transaction Data	Payment reference, booking ID, transaction amount	Payment processing, invoice generation, records
Technical Data	IP address, browser type, device information	Security, rate limiting, fraud prevention
Usage Data	Pages visited, time spent, click patterns	Website improvement, analytics

We do not collect or store any payment card details, bank account numbers, or UPI IDs. All payment processing is handled securely by our payment gateway partner, PayU India, which is PCI-DSS compliant.

4. Lawful Basis for Processing

Under the DPDPA 2023, we process your personal data based on the following lawful grounds:

• Consent: You provide explicit consent when you submit your details to book a ticket.
• Contractual Necessity: Processing is necessary to fulfil the ticket booking contract between you and HMS Group.
• Legitimate Interest: For fraud prevention, security, and improving our services.
• Legal Obligation: To comply with applicable Indian laws, including tax and accounting requirements.

5. How We Use Your Data

Your personal data is used for the following purposes:

• Processing and confirming your ticket booking
• Generating and delivering your e-ticket with QR code via email
• Facilitating event check-in and attendance verification
• Sending event-related communications (schedule changes, venue updates)
• Generating participation certificates
• Responding to your queries and support requests
• Complying with tax, accounting, and legal obligations
• Preventing fraud, abuse, and ensuring platform security
• Improving our website and services through anonymised analytics

6. Data Sharing and Third Parties

We may share your personal data with the following categories of third-party service providers, solely for the purposes outlined in this policy:

• PayU India: Payment processing (they operate under their own privacy policy and PCI-DSS standards)
• Amazon Web Services (AWS): Email delivery service (AWS SES) for sending booking confirmations
• Supabase: Cloud database hosting for storing booking records
• Vercel: Website hosting

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

7. Data Retention

We retain your personal data for the following periods:

• Booking and transaction data: 8 years from the date of transaction (as required under the Income Tax Act, 1961 and GST laws)
• Contact information: Until you request deletion, or 3 years after your last interaction with us, whichever is earlier
• Technical/usage data: 12 months from the date of collection

After the retention period expires, your data is securely deleted or anonymised.

8. Your Rights Under DPDPA 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access: You may request confirmation of whether we process your personal data and obtain a summary of it.
• Right to Correction: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent: You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing done prior to withdrawal.
• Right to Grievance Redressal: You may raise a complaint with our Grievance Officer or escalate to the Data Protection Board of India.
• Right to Nominate: You may nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us at privacy@harshubh.com. We will respond within 30 days of receiving your request.

9. Cookies and Tracking

Our website uses the following types of cookies:

• Essential Cookies: Required for the website to function (e.g., session cookies, admin authentication). These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with the website. These are anonymised and used solely for improving our services.

We do not use third-party advertising cookies. You may manage your cookie preferences through your browser settings.

10. Data Security

We implement reasonable security practices and procedures as required under the Information Technology Act, 2000. These include:

• HTTPS/TLS encryption for all data transmitted between your browser and our servers
• Row-level security on our database to prevent unauthorised access
• Secure, httpOnly authentication cookies
• Rate limiting to prevent brute-force and abuse attacks
• Payment processing handled by PCI-DSS compliant payment gateway (PayU)
• Access to personal data restricted to authorised personnel only

11. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, you must have your parent or legal guardian book tickets on your behalf. If we become aware that we have collected data from a minor without verifiable parental consent, we will delete such data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be notified via email to registered users or by posting a prominent notice on our website. The "Last updated" date at the top of this page indicates the most recent revision.

13. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDPA 2023, the details of our Grievance Officer are:

Name: Harshubh Mahesh Shah
Designation: Grievance Officer
Email: grievance@harshubh.com
Response Time: Within 30 days of receiving the complaint

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India established under the DPDPA 2023.

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this policy shall be subject to the exclusive jurisdiction of the courts in Surat, Gujarat, India.