Privacy Policy

1. Introduction

Shoib Tour and Travels ("we", "us", "our") operates the ShareUrSeats platform. This Privacy Policy explains how we collect, use, store, share, and protect personal and business information when you use our platform at shareurseat.com.

This Policy is drafted in compliance with applicable Indian law, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and as guided by the Digital Personal Data Protection Act, 2023 ("DPDPA").

By registering on or using the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your information as described herein.

2. Data Controller

We are responsible for determining the purposes and means of processing your personal data in connection with the Platform.

3. Data We Collect

3.1 Business & Account Information

3.2 Transaction & Booking Data

3.3 Passenger Information (Processed on Behalf of Agencies)

When an agency adds passenger details to a booking, the following personal data is submitted and processed:

• First name, last name
• Passenger type (adult/child/infant)
• Date of birth (optional)
• Passport number and expiry (optional, for international travel)
• Meal preference (optional)
• Uploaded travel documents

3.4 Technical & Usage Data

• IP address, browser type, operating system
• Pages visited, features used, timestamps
• Session data stored in cookies and server sessions
• Search queries (routes, dates, filters)

4. How We Collect Data

• Directly from you — registration forms, booking forms, support emails
• Automatically — server logs, browser cookies, session data when you use the Platform
• From third-party services — Razorpay (payment status), Pusher (real-time presence), WhatsApp Cloud API (OTP delivery status)
• OTP verification — your mobile number is used to send a one-time password via WhatsApp during supplier registration

5. How We Use Your Data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

6. Legal Basis for Processing

We process your data under the following lawful bases:

• Contractual necessity — to fulfil the services you registered for (account management, booking processing, payments)
• Legal obligation — to comply with applicable Indian law (GST Act, IT Act, DPDPA)
• Legitimate interest — to prevent fraud, improve the Platform, and maintain security
• Consent — for WhatsApp OTP delivery and optional notifications; consent may be withdrawn by contacting us (this may affect your ability to use certain features)

7. Data Sharing & Disclosure

7.1 Between Platform Users

To facilitate bookings, limited information is shared between agencies and suppliers. Specifically:

• Agencies see supplier's seat listings and business name
• Suppliers receive booking details (number of seats, notes) upon a booking request
• Passenger details are accessible to the relevant supplier once a booking is confirmed and paid, for the purpose of PNR/ticket assignment

7.2 Legal Disclosure

We may disclose your information to government authorities, law enforcement, or courts when required by law, court order, or government regulation, or to protect the rights, property, or safety of ShareUrSeats, its users, or the public.

7.3 Business Transfer

In the event of a merger, acquisition, or sale of all or part of our business, user data may be transferred as part of that transaction. We will notify registered users of any such change via email.

8. Third-Party Service Providers

We use the following third-party services that may process your data:

Each of these providers has their own privacy policy. We encourage you to review them. We do not control and are not responsible for the privacy practices of these third parties.

9. Data Retention

We retain your data for the following periods:

• Account data — for the duration of your account and up to 3 years after account closure or last activity, whichever is later, to comply with legal obligations
• Booking & transaction records — 7 years from the date of transaction, as required under the Companies Act and GST regulations for financial record-keeping
• KYC documents — for the duration of the account and 3 years post-closure
• Passenger data — retained as part of booking records (7 years), after which it is deleted or anonymised
• OTP session data — 10 minutes from generation; not persisted after session ends
• Server logs & usage data — up to 90 days on a rolling basis

Upon expiry of the retention period, data is securely deleted or anonymised so it can no longer be associated with an individual or business.

10. Data Security

We implement reasonable technical and organisational security measures to protect your data, including:

• All data transmitted over HTTPS (TLS encryption in transit)
• Passwords stored using bcrypt hashing; never stored in plain text
• Payment card data never stored on our servers (handled exclusively by Razorpay)
• Role-based access control (RBAC) restricting data access to authorised personnel only
• Database-level tenancy isolation preventing cross-agency data access
• Regular security reviews and dependency updates

While we take all reasonable precautions, no transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and report any suspected breach immediately to support@shareurseat.com.

11. Your Rights

Under applicable Indian data protection law, you have the following rights with respect to your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to correction — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations
• Right to withdraw consent — where processing is based on consent (e.g. WhatsApp notifications), you may withdraw consent at any time by contacting us
• Right to grievance redressal — lodge a complaint with our Grievance Officer (details in Section 15)

To exercise any of these rights, email us at support@shareurseat.com with the subject line "Data Rights Request" along with your registered email address and the nature of your request. We will respond within 30 days.

Please note that exercising certain rights (such as erasure) may result in your inability to continue using the Platform.

12. Cookies & Session Data

The Platform uses cookies and server-side sessions to maintain your login state and provide a seamless user experience. Specifically:

• Session cookies — store your authentication state; deleted when you close the browser or log out
• CSRF token cookies — protect form submissions from cross-site request forgery
• Registration session data — multi-step registration data stored in server session temporarily

We do not currently use advertising cookies, cross-site tracking pixels, or third-party analytics cookies. If this changes, this Policy will be updated with prior notice.

You may configure your browser to refuse cookies; however, disabling cookies will prevent you from logging into the Platform.

13. Children's Privacy

ShareUrSeats is a B2B platform intended exclusively for adults operating registered businesses. We do not knowingly collect personal data from individuals under the age of 18 as account holders.

Passenger records may include child passengers (where an agency adds a child's travel details for a booking). This data is processed solely for the purpose of fulfilling the travel booking and is governed by the agency's consent obligations to its customers.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. Where changes are material, we will notify registered users via email at least 14 days before the changes take effect. The updated Policy will always be accessible at shareurseat.com/privacy.

Continued use of the Platform after the effective date of an updated Policy constitutes your acceptance of the changes.

15. Contact & Grievance Officer

For any privacy-related questions, requests, or complaints, please contact our Grievance Officer as designated under the IT Act and SPDI Rules:

If you are not satisfied with our response, you have the right to escalate your complaint to the relevant authority under Indian data protection law.