PRIVACY POLICY
Hill Destinations — “We Feel Travel”
Effective Date: October 03, 2025 | Last Updated: October 03, 2025
Welcome to Hill Destinations (“Company,” “we,” “our,” or “us”). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit https://hilldestinations.com (the “Site”) or use our travel and tourism services.
By accessing or using our services, you agree to this Privacy Policy. If you do not agree, please discontinue use of our services.
1. Scope & Acceptance
This Policy applies to data collected online via our website, booking engines, emails, and customer support channels, and offline via phone or in-person bookings.
2. Information We Collect
- Name, email address, phone number
- Billing address and limited payment details (tokenized; full card data handled by payment gateway)
- Passport/ID, visa information, and other travel documents (where required to fulfill bookings)
- Travel preferences, loyalty numbers, special requests, medical/dietary needs (if voluntarily provided)
- Communications with us (emails, messages, call metadata)
B. Non-Personal/Technical Data
- Device/browser type and operating system
- IP address and approximate geolocation
- Cookies/identifiers, pages viewed, time on page, referral/UTM data
- Aggregated analytics and performance metrics
Children: We do not knowingly collect data from individuals under 18. If we become aware, we will delete such data promptly.
3. Lawful Bases for Processing (GDPR & DPDP)
- Consent — when you submit forms, opt into marketing, or provide optional details.
- Contract — to process bookings, itineraries, and related customer support.
- Legitimate Interests — service improvement, site security, fraud prevention, and relevant offers.
- Legal Obligation — compliance with immigration, KYC, taxation, and regulatory requirements.
4. How We Use Your Information
- Arrange flights, hotels, transport, tours, visas, and other travel services
- Send confirmations, tickets, vouchers, itinerary updates, and notifications
- Provide customer support and handle inquiries or complaints
- Personalize destination recommendations and promotional offers (optional)
- Maintain platform security, prevent fraud, and meet legal obligations
5. Sharing & Disclosures
We do not sell personal data. We share it only as necessary with trusted partners bound by confidentiality and data protection obligations:
- Airlines, hotels, destination partners, visa facilitators, ground transport providers
- Payment gateways and banking partners for secure transactions
- IT/cloud hosting, CRM, analytics, and communication service providers
- Government authorities or law enforcement where legally required
6. Data Security
- Our website uses HTTPS/TLS with Let’s Encrypt SSL to encrypt data in transit.
- We implement access controls, logging, and encryption-at-rest where appropriate.
- Payments are processed via PCI-DSS compliant gateways; we avoid storing full card numbers.
No method of transmission or storage is 100% secure, but we strive to follow industry best practices.
7. Cookies & Similar Technologies
We use cookies to remember preferences, analyze traffic, and personalize content. You can manage or disable cookies in your browser settings. Disabling some cookies may affect site functionality.
8. International Data Transfers
Your data may be processed in India and other jurisdictions where our partners operate. Where required, we implement safeguards recognized under GDPR (e.g., Standard Contractual Clauses) and comply with the DPDP Act for international transfers.
9. Data Retention
We retain personal data only as long as necessary for the purposes set out in this Policy and to satisfy legal, accounting, or reporting requirements. Typical retention periods range from 6 to 84 months depending on the transaction type and applicable regulations.
10. Your Rights
- Access the personal data we hold about you
- Rectify inaccurate or incomplete information
- Delete your data (subject to lawful exceptions and retention requirements)
- Withdraw consent for optional marketing at any time
- Complain to your supervisory authority (GDPR) or to the DPDP Board (India)
To exercise rights, email travel@hilldestinations.com with the subject line “Privacy Request.”
11. Children’s Privacy
Our services are not intended for individuals under 18 years of age. If we learn that we have collected personal data from a minor, we will delete it promptly.
12. Updates to This Policy
We may update this Policy to reflect changes in law, technology, or our services. Updates will be posted here with a revised “Last Updated” date. Please review periodically.
13. Contact & Grievance Redressal
Compliance Snapshot:
• GDPR lawful bases recognized
• Alignment with India’s DPDP Act (2023)
• SSL/TLS enforced
• Third-party processors bound by contract.
This Policy is for transparency and does not create contractual rights beyond applicable law.