1. Who we are
TravZora is operated by Travzora Private Limited, G-06, Confident Square Mall, Dommasandra, Yamare, Karnataka 562125, India.
In this policy, “TravZora”, “we” and “us” mean that company. “You” means the travel agency using our platform, and the people at that agency who hold logins.
We provide a business-to-business visa fulfilment platform. Travel agencies use TravZora to prepare, submit and track visa applications on behalf of their own customers.
2. What this policy covers
This policy explains how we handle personal data when you use our platform. It covers two distinct groups of people.
Agency users
The owners, managers and executives at a travel agency who hold TravZora logins. We decide how their data is used, so for them we are a Data Fiduciary under the Digital Personal Data Protection Act, 2023.
Travellers
The individuals whose visa applications an agency prepares. The agency collects their data, obtains their consent, and instructs us. For traveller data we act principally as a Data Processor on the agency’s instructions. The agency is responsible for having a lawful basis to share traveller data with us.
3. What we collect
From agency users
- Name, business email address, mobile number, role and login credentials.
- Agency name, GSTIN or PAN, registered address and documents uploaded to verify the business.
- Records of actions taken in the platform.
About travellers, provided by the agency
- Identity, nationality, birth and passport details, including passport images.
- Photographs and supporting documents required by the destination country, which may include bank statements, employment letters, hotel bookings and itineraries.
- Contact details where required by a destination.
Automatically
- IP address, browser and device information.
- Pages visited and actions taken, retained as security and audit logs.
We do not collect Aadhaar numbers. We do not store payment card details — payments are handled by our payment gateway, and card data never reaches our systems.
4. Why we process it
We process data to provide the service, verify agencies, transmit applications to the relevant authorities, operate the wallet and issue invoices, communicate status updates and support, prevent fraud, maintain audit logs and meet legal obligations.
We do not sell personal data. We do not use traveller data to train machine learning models, and we do not use it for any purpose other than fulfilling the application it was provided for.
5. How we obtain consent
For agency users, we obtain consent at signup through a clear, unbundled notice. For travellers, the agency is responsible for obtaining consent before providing data to us and confirms this when submitting an order.
You may withdraw consent at any time by writing to us. Withdrawal does not affect processing already carried out and may mean we can no longer provide the service.
7. Where your data is stored
Our primary database and document storage are located in India. Some service providers process data outside India, limited to what the service requires.
Visa applications involve transferring traveller data to the destination country’s authorities. That country’s laws apply once the data reaches them, and we have no control over how they handle it.
8. How long we keep it
- Agency account and KYC records: life of the account, then 8 years.
- Traveller data and application documents: 3 years from the application decision.
- Passport images: 6 months after the application is decided.
- Wallet ledger and invoices: 8 years.
- Security and access logs: 12 months.
When a retention period ends, we delete or irreversibly anonymise the data. Where an agency asks us to delete traveller data sooner, we will do so unless legally required to keep it.
9. The agency’s responsibilities
A travel agency using TravZora is responsible for:
- Obtaining each traveller’s consent before providing their data.
- Giving each traveller a privacy notice that covers processing by TravZora and transmission to the relevant authority.
- Ensuring data is accurate and up to date.
- Promptly telling us about withdrawn consent or deletion requests.
- Keeping login credentials secure and removing access for staff who leave.
You must not upload documents belonging to people who have not asked you to arrange a visa for them.
10. Your rights
Under the Digital Personal Data Protection Act, 2023, agency users may ask what data we hold and how we use it; request correction or erasure; withdraw consent; nominate someone to exercise rights after death or incapacity; and complain to us and then the Data Protection Board of India.
Email hello@travzora.com from the address registered to your account, quoting your agency name. We will respond within 30 days. Travellers should contact the agency that arranged their visa first.
11. How we protect data
- Traffic to our platform is encrypted in transit.
- Documents are held in private storage, reachable only by the agency that uploaded them.
- Access rules are enforced by the database, not only by the application.
- Production access is limited to named staff and logged.
- Access logs are kept for at least one year.
- Financial records are append-only and cannot be altered after the fact.
No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as required by law.
12. Children
Our platform is for businesses and is not directed at children. Agency users must be 18 or over.
Visa applications are frequently made for children travelling with their families. Where an agency provides a minor’s data, the agency confirms that a parent or lawful guardian has consented. We do not carry out tracking, profiling or advertising directed at children.
13. Contact and complaints
Grievance Officer
Travzora Private Limited
G-06, Confident Square Mall, Dommasandra, Yamare, Karnataka 562125, India
Email: hello@travzora.com
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
14. Changes
We may update this policy. Where a change is significant, we will tell you by email and show a notice in the platform before it takes effect. The date at the top shows when it was last changed.