1. Introduction

Tripsica Holidays Private Limited ("Tripsica," "we," "us," or "our") respects your privacy and is committed to protecting personal data entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, transfer and protect personal data when you visit tripsica.com or other Tripsica websites; create or use a Tripsica account; use our AI-powered travel planning, itinerary creation, quotation, collaboration or related services (collectively, the "Services"); interact with us through email, support, demonstrations or events; interact with a travel business using Tripsica; or otherwise provide personal data to us.

This Policy should be read together with our Terms & Conditions, Cookie Policy, Data Processing Agreement ("DPA") where applicable, and any additional privacy notice presented when personal data is collected.

2. Scope and Applicable Privacy Laws

Tripsica processes personal data in accordance with privacy and data protection laws applicable to the relevant processing. Depending on your location and how the Services are provided, these may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR, India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable rules, and other applicable privacy laws.

The rights and obligations applicable to a particular processing activity may depend on jurisdiction, the nature of your relationship with Tripsica and Tripsica's role in the processing.

3. Our Role: Controller and Processor

Tripsica may act as a controller/data fiduciary or as a processor, depending on the processing activity.

3.1 When Tripsica acts as controller

Tripsica generally determines the purposes and means of processing for activities such as:

• account registration and administration
• website operation and product analytics
• prospective customer and business contact management
• billing and subscription administration
• customer support
• security, fraud prevention and service integrity
• marketing communications
• legal and regulatory compliance
• administration and protection of our business

3.2 When Tripsica acts as processor

Travel agents, DMCs, hotels, tour operators and other organizations may use Tripsica to create and manage itineraries, quotations, customer communications and other travel-related information. Where a customer submits personal data relating to its travelers, customers, employees or other individuals and determines why and how that data is processed, that customer is generally the controller/data fiduciary and Tripsica processes the data on its behalf.

In such cases, Tripsica processes personal data according to the customer's documented instructions and applicable contractual terms, including our DPA where applicable. If you are an end customer or traveler of a business using Tripsica, you should normally direct privacy-rights requests concerning data submitted by that business to the business itself. We will assist our customer as required by applicable law and contract.

4. Personal Data We Collect

The information we collect depends on how you interact with Tripsica and which Services are used.

Account and identity information. Name, username, email address, telephone number, organization, job title or role, account credentials, profile information and preferences.

Business and customer information. Company details, authorized-user information, business contacts, subscription details, customer communications, billing and transaction records, and service history.

Traveler and trip information. Traveler name, destination, travel dates, number and composition of travelers, accommodation and transportation preferences, activities, budget, dietary or accessibility requirements, special requests, itinerary and quotation information, and other information voluntarily provided for travel planning.

User-provided content and AI inputs. Prompts, travel requests, itinerary instructions, uploaded documents, notes, customer requirements, edits, feedback and other content submitted to Tripsica's AI or travel-planning functionality.

Transaction and billing information. Subscriptions, invoices, billing address, transaction history and payment status. Payment-card information may be processed directly by authorized payment service providers rather than stored by Tripsica.

Device, log and technical information. IP address, browser, device and operating-system information, session data, timestamps, pages or functions accessed, referring URLs, authentication events, error logs, application activity, security events and diagnostic information.

Cookies and similar technologies. Information collected through cookies, pixels, local storage and similar technologies as described in our Cookie Policy.

Communications and support data. Correspondence, support requests, feedback, survey responses, meeting information and related communications.

5. Sources of Personal Data

We may obtain personal data:

• directly from you;
• from an organization that provides you access to Tripsica;
• from travel agents, DMCs, hotels, tour operators or other Tripsica customers;
• through integrations authorized by you or our customer;
• automatically when you use our website or Services;
• from service providers and business partners where permitted by law; and
• from publicly available sources where permitted by law.

Where personal data is obtained indirectly, we handle it in accordance with applicable transparency and notice requirements.

6. Why We Process Personal Data

We process personal data for specified purposes and rely on an appropriate legal basis where required by law.

Where we rely on legitimate interests, we consider whether those interests are overridden by your privacy interests or fundamental rights. Where processing relies on consent, you may withdraw consent at any time without affecting processing that was lawful before withdrawal.

7. AI and Automated Processing

Tripsica uses artificial intelligence and automated technologies to provide travel planning, itinerary generation, recommendations, content generation, trip refinement and related functionality.

Information submitted to these features may be processed by Tripsica and authorized technology service providers supporting the Services. We apply contractual, technical and organizational safeguards appropriate to the nature of the processing and our role under applicable law.

AI-generated recommendations and itineraries may involve probabilistic outputs and should not automatically be treated as verified facts. Users should verify information important to travel decisions, including availability, pricing, visa requirements, opening hours, safety information and other time-sensitive information.

Unless expressly disclosed otherwise, Tripsica does not use automated processing to make decisions that produce legal effects or similarly significant effects concerning individuals without appropriate safeguards where required by applicable law. Where applicable law provides rights relating to qualifying automated decision-making, Tripsica will honor those rights.

8. How We Share Personal Data

Tripsica does not sell personal data. We may disclose personal data to the following categories of recipients where appropriate and lawful:

Service providers and subprocessors. Cloud infrastructure and hosting, AI and machine-learning services, databases, authentication, email and communications, customer support, analytics, monitoring and security, payment processing and other technical infrastructure.

Tripsica customers and authorized users. Where Tripsica is used by an organization, information may be available to authorized users and administrators according to their permissions.

Travel and service providers. Where requested by the user or necessary to provide a requested travel-related service.

Professional advisers. Auditors, lawyers, accountants, insurers and other professional advisers where reasonably necessary.

Legal and regulatory authorities. Where required to comply with applicable law or valid legal process, protect rights or property, investigate fraud or security incidents, or protect safety.

Corporate transactions. In connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets or similar transaction, subject to appropriate safeguards.

9. Subprocessors

Tripsica may engage third-party subprocessors to support delivery of the Services. Where Tripsica processes personal data on behalf of customers, we maintain appropriate contractual arrangements with subprocessors in accordance with applicable data protection requirements. Where required, customers may receive information concerning material changes to relevant subprocessors.

10. International Data Transfers

Tripsica operates and uses service providers in multiple jurisdictions. Personal data may therefore be processed outside the country in which it was originally collected.

Where personal data subject to the GDPR is transferred outside the European Economic Area, we use an appropriate transfer mechanism where required, which may include an adequacy decision, European Commission Standard Contractual Clauses, supplementary technical, contractual or organizational measures, or another mechanism permitted by applicable law. For transfers subject to other privacy laws, we implement safeguards as required by those laws.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services and satisfying legal, accounting, security and contractual obligations.

Retention periods may depend on the nature of the information, duration of the customer relationship, contractual requirements, customer instructions where Tripsica acts as processor, security and fraud-prevention requirements, applicable limitation periods, and legal or regulatory obligations.

When personal data is no longer required, we take reasonable steps to delete, anonymize or otherwise securely dispose of it, subject to applicable legal requirements and backup retention processes. Where Tripsica acts as processor, customer data is retained and deleted in accordance with applicable customer instructions and contractual terms.

12. Security of Personal Data

Tripsica maintains administrative, technical and organizational safeguards designed to protect personal data against unauthorized access, acquisition, disclosure, alteration, destruction or loss. Depending on the nature of the system and information involved, safeguards may include:

• access controls and least-privilege principles;
• authentication controls;
• encryption of data in transit and, where appropriate, at rest;
• logging and monitoring;
• vulnerability and security management;
• secure development practices;
• backup and recovery controls;
• incident detection and response procedures;
• employee confidentiality obligations and security awareness practices; and
• vendor and service-provider risk management.

No system can guarantee absolute security. We continually evaluate safeguards in light of evolving risks and technology.

13. Security Incidents and Personal Data Breaches

Tripsica maintains processes designed to identify, investigate, contain and remediate security incidents. Where a personal data breach occurs, Tripsica will assess the incident and provide notifications to affected customers, individuals, regulators or other parties where and within the timeframes required by applicable law. Where Tripsica acts as processor, we will notify and cooperate with the relevant customer as required by applicable contractual and legal obligations.

14. Privacy by Design and Data Minimization

Tripsica seeks to incorporate privacy and security considerations into the design and operation of its Services. We seek to collect only personal data reasonably necessary for identified purposes, limit access according to business need, establish appropriate retention practices, evaluate privacy risks associated with new features and processing activities, and apply safeguards proportionate to the nature and risk of processing.

15. Your Privacy Rights

Depending on applicable law and your circumstances, you may have the right to:

• request confirmation of whether we process your personal data;
• access personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• request portability of eligible personal data;
• object to direct marketing;
• exercise applicable rights relating to qualifying automated decision-making;
• nominate another person to exercise rights where applicable under law; and
• lodge a complaint with an applicable data protection authority.

These rights are subject to applicable legal conditions, limitations and exemptions. We will not unlawfully discriminate against individuals for exercising applicable privacy rights.

16. Exercising Your Rights

Privacy-rights requests may be submitted to support@tripsica.com. We may need to verify your identity before processing certain requests. Where permitted by applicable law, an authorized representative may submit a request on your behalf, subject to appropriate verification.

If Tripsica processes the relevant personal data solely on behalf of one of our business customers, we may refer your request to that customer or assist that customer in responding. We respond to verified requests within the period required by applicable law.

EU and EEA residents may also lodge a complaint with the competent supervisory authority. Individuals in India may exercise rights and grievance mechanisms available under applicable provisions of the DPDP Act and associated rules as they become applicable.

17. Marketing Communications

Where permitted by law, Tripsica may send communications concerning our Services, features, events and offers. You may unsubscribe from marketing emails using the unsubscribe mechanism contained in the communication or by contacting us. Even if you opt out of marketing communications, we may continue sending non-promotional communications necessary to administer your account or provide the Services.

18. Sensitive Personal Data

Tripsica's Services generally do not require sensitive personal data. Travel requirements may nevertheless reveal information concerning matters such as health, disability, dietary requirements, religion or other sensitive characteristics. Users should provide such information only when necessary for the requested travel service. Where applicable law requires consent or another specific legal basis for processing sensitive information, the relevant controller is responsible for establishing that basis.

19. Children's Privacy

Tripsica is primarily intended for businesses and adults arranging travel. Children may be included as travelers in itineraries created by parents, guardians or authorized travel businesses. Such information should be provided only where necessary for legitimate travel-planning purposes and with appropriate authorization.

Tripsica does not knowingly permit children who are below the age at which they can independently consent under applicable law to create accounts or directly provide personal data where parental or guardian authorization is legally required. If you believe a child has provided personal data to Tripsica contrary to applicable law, contact support@tripsica.com.

20. Third-Party Websites and Services

Our Services may contain links to or integrate with third-party websites, travel providers, mapping services, booking systems, payment services or other platforms. Their privacy practices are governed by their own privacy policies. Tripsica is not responsible for the independent privacy practices of third parties acting as separate controllers. We encourage users to review third-party privacy policies before providing personal information to them.

21. Business Customer Responsibilities

Organizations using Tripsica are responsible for ensuring that they have an appropriate legal basis and provide required notices when submitting personal data to the Services. Customers should not upload personal data that is unnecessary for their use of Tripsica. Where Tripsica processes customer personal data as processor, the respective responsibilities of Tripsica and the customer may additionally be governed by a DPA.

22. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our Services, technology, business practices or legal obligations. The updated version will be published with a revised "Last Updated" date. Where changes materially affect individuals' privacy rights or our processing practices, we will provide additional notice where required by applicable law.

23. Contact Us

For questions, concerns, complaints or privacy-rights requests, contact: