Privacy policy

Effective Date: 7 September 2026 Last Updated: 7 September 2026

1. Introduction

Prime Vistaa Holidays ("Company", "Prime Vistaa", "we", "us", or "our") operates primevistaa.com and provides domestic and international holiday planning, tour booking, ticketing, and related travel services ("Services").

This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, store, and protect it, and what rights you ("you", "User", or, under Indian law, "Data Principal") have over your data. It applies to our website, mobile touchpoints, WhatsApp/telephone bookings, in-branch bookings, and any other channel through which you share personal data with us.

This Policy is drafted with reference to India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 ("DPDP Law"), the Information Technology Act, 2000 and rules made thereunder, and, where relevant to international travellers, principles consistent with the EU General Data Protection Regulation (GDPR).

By visiting our website, enquiring about a package, making a booking, or otherwise submitting personal data to us, you acknowledge that you have read and understood this Policy. Where the DPDP Law requires your free, specific, informed, and unambiguous consent before we process your data (or a category of it, such as health data), we will seek that consent separately and specifically — your general use of the website does not substitute for it.

2. Who We Are

Prime Vistaa Holidays acts as a Data Fiduciary under the DPDP Law for the personal data described in this Policy, and, in some cases, as a Data Processor on behalf of airlines, hotels, and other principals whose products we sell.

Grievance Officer / Data Protection Officer (DPO)

For any question, concern, complaint, or request regarding this Policy or your personal data, contact:

• Name: Ranjan Tafadar
• Designation: Grievance Officer / Data Protection Officer
• Phone: +91 74394 22239
• Email: privacy@primevistaa.com
• Address: 83 S P Mukherjee Road, Kolkata 700026, West Bengal, India

We acknowledge grievances promptly and aim to resolve them within the timeline prescribed under the DPDP Rules. If you remain dissatisfied, you may escalate your complaint to the Data Protection Board of India.

3. Personal Data We Collect

Travel bookings — particularly international and visa-linked ones — require us to collect more categories of data than a typical e-commerce transaction. We collect only what is reasonably necessary for the specific purpose disclosed to you.

3.1 Identity & Contact Data

Full name, gender, date of birth, nationality, marital status (where relevant to travel documentation), residential/billing address, email address, and mobile/telephone number.

3.2 Travel & Identification Documents

Passport details (number, issuing country, issue/expiry dates, scanned copy/photograph page), visa documents and application data, government-issued identifiers such as Aadhaar and PAN, photographs, frequent flyer/loyalty numbers, and other documents required by airlines, hotels, or foreign missions.

Aadhaar handling: We collect Aadhaar details only where legally required or explicitly requested by you for identity verification or a government scheme, and in line with the Aadhaar Act, 2016 and applicable RBI/UIDAI circulars. Where feasible, we mask or redact Aadhaar numbers in our records and do not publish or share them beyond what a booking or regulatory filing requires.

3.3 Sensitive Personal Data — Health & Dietary Information

Pre-existing medical conditions, disabilities, vaccination status, mobility or medication requirements, and food/dietary preferences (including allergies). This is collected only with your explicit, separate consent, strictly to arrange safe and suitable travel accommodations (e.g., wheelchair assistance, special meals, travel insurance underwriting). You may decline to share this data, though doing so may limit our ability to make certain arrangements on your behalf.

3.4 Financial & Payment Data

Billing address and payment references. We do not store your complete card number, CVV, or net-banking credentials. All online payments are processed through PCI-DSS compliant, third-party payment gateways; we retain only the transaction reference and status needed for invoicing, refunds, and accounting.

3.5 Technical & Usage Data

IP address, device and browser type, operating system, approximate geolocation, referral URLs, pages viewed, time spent, and similar analytics generated automatically as you use our website.

3.6 Communications

Records of enquiries and correspondence made via email, phone, WhatsApp, contact forms, or in person at our office, including call recordings where you are notified of and consent to recording.

We do not knowingly collect more sensitive categories of data (e.g., biometric data beyond passport/visa photographs, genetic data, or data revealing religious belief, except where a Haj/Umrah or pilgrimage-specific service necessarily requires such disclosure with your explicit consent).

4. How We Collect Your Data

• Directly from you — when you fill an enquiry form, make a booking, open a quotation we have sent you, subscribe to updates, or contact us by phone, email, or WhatsApp.
• Automatically — through cookies and similar technologies when you browse our website (see Section 6).
• From third parties — such as your co-travellers (if you submit their details on their behalf, you confirm you are authorised to do so and have informed them of this Policy), corporate travel desks, travel agents/sub-agents, or publicly available sources used for fraud checks.

5. Purpose and Legal Basis for Processing

We process personal data on the following bases recognised under the DPDP Law and other applicable law:

Where we rely on your consent, you have the right to withdraw it at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal.

6. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to operate essential functions, analyse traffic, and (with your consent) deliver personalised marketing. You will be presented with a cookie banner on your first visit, allowing you to accept, reject, or customise non-essential cookies.

6.1 Strictly Necessary Cookies

Required for core site functions such as security and remembering your own cookie choice. We set one such cookie, named pv_consent, which records only which categories you allowed so that we do not ask you again on every page; it holds nothing that identifies you and lasts 180 days. These cannot be switched off.

6.2 Google Analytics 4 (GA4)

Used to understand how visitors use our website (pages viewed, device type, approximate location, on-site behaviour). Data is processed on an aggregated basis to improve our platform and offerings. Opt-out: Install the Google Analytics Opt-out Browser Add-on, or decline analytics cookies via our cookie banner.

6.3 Meta Pixel (Facebook Pixel)

Used to measure ad performance and show you relevant Prime Vistaa Holidays offers on Facebook and Instagram, based on pages you've viewed on our site (e.g., a specific holiday package). Opt-out: Adjust your Facebook/Instagram Ad Preferences, or decline marketing cookies via our cookie banner.

6.4 WhatsApp Business Communications

If you contact us or opt in via WhatsApp, we use the WhatsApp Business Platform to send booking confirmations, itineraries, and (with consent) promotional updates. You can stop these at any time by messaging "STOP" or through your WhatsApp settings.

7. Who We Share Your Data With

We share personal data only as necessary to deliver your travel arrangements, and under confidentiality/data-processing obligations where applicable:

• Travel Service Providers: Airlines, hotels/resorts, destination management companies (DMCs), cruise lines, coach/transport operators, local guides, and travel insurers involved in your itinerary — domestic or international.
• Government & Regulatory Authorities: Embassies, consulates, visa processing centres, customs, immigration, and law-enforcement or tax authorities, where required for your travel or by law.
• Payment Gateways & Financial Institutions: PCI-DSS compliant processors that handle your online payment.
• IT, Cloud & Marketing Partners: Hosting/cloud storage providers, email/SMS/WhatsApp distribution platforms, and analytics providers, engaged under written confidentiality and data-protection terms.
• Professional Advisors: Auditors, insurers, and legal advisors, where necessary.
• Corporate Transactions: In the event of a merger, acquisition, or sale of business assets, subject to equivalent privacy protections for your data.

We do not sell, rent, or trade your personal data to unauthorised third parties. Any transfer of sensitive personal data (e.g., health information) to a third party (such as a travel insurer) is made only with your explicit consent for that specific purpose.

8. Cross-Border Data Transfers

Booking an international holiday necessarily requires sharing your data (including passport, visa, and sometimes health information) with airlines, hotels, DMCs, and government authorities located outside India.

Under the DPDP Law, cross-border transfer of personal data is permitted by default, except to countries specifically restricted by the Government of India from time to time. By booking an international tour, you acknowledge and consent to this transfer, and understand that the destination country's data protection standards may differ from India's. We take reasonable steps to ensure recipients handle your data securely and only for the purpose of your travel arrangement.

9. Data Retention

We retain personal data only for as long as reasonably necessary to:

• fulfil the booking/travel purpose for which it was collected;
• meet statutory retention requirements under tax, foreign exchange (FEMA), accounting, and travel-trade regulations (typically the periods prescribed under the Income Tax Act, Companies Act, and related rules); and
• resolve disputes, defend legal claims, or comply with a court/regulator order.

Once these purposes are met, we securely delete, anonymise, or archive your data in line with our internal retention schedule and applicable law. Sensitive data such as health/dietary information is retained only for the duration of the specific trip it relates to, plus any period required for insurance claims, unless you ask us to retain it for future bookings and give fresh consent to do so.

10. Your Rights as a Data Principal

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you, and a summary of the processing activities carried out.
• Correction & Updating — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
• Withdraw Consent — withdraw consent for marketing communications, non-essential cookies, or processing of sensitive data (e.g., health data) at any time, without affecting processing already carried out.
• Grievance Redressal — raise a complaint with our Grievance Officer (Section 2) and, if unresolved, escalate to the Data Protection Board of India.
• Nominate — nominate another individual to exercise your rights under the DPDP Law in the event of your death or incapacity.

To exercise any of these rights, write to our Grievance Officer/DPO, Ranjan Tafadar, using the contact details in Section 2. We may need to verify your identity before actioning a request.

11. Children's Data

Our Services are intended for adults capable of entering a binding travel contract. Where a booking includes a minor (a person below 18 years, as defined under the DPDP Law), we collect the minor's data (e.g., passport details) only with the verifiable consent of the parent or lawful guardian making the booking, and use it solely for that travel arrangement. We do not knowingly use children's data for tracking, behavioural monitoring, or targeted advertising.

12. Data Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or loss, including access controls, encryption of sensitive fields where feasible, secure storage of scanned identity documents, and staff confidentiality obligations. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach that is likely to affect you, we will notify you and the Data Protection Board of India as required under the DPDP Law, along with the steps being taken to mitigate the impact.

13. Third-Party Website Links

Our website may link to third-party booking engines, airline/hotel websites, partner travel brands, or payment gateways. Once you leave primevistaa.com, this Policy no longer applies. We encourage you to review the privacy policy of any third-party site before submitting personal data to it.

14. Marketing Communications

We send promotional offers, newsletters, and travel updates only where you have opted in (e.g., via a subscription form, WhatsApp opt-in, or checkbox at booking). You may opt out at any time by:

• clicking "unsubscribe" in any marketing email;
• replying "STOP" to WhatsApp/SMS communications; or
• writing to our Grievance Officer/DPO.

We will continue to send transactional communications (booking confirmations, itinerary updates, payment receipts) necessary to deliver your Services, as these are not marketing communications.

15. Changes to This Privacy Policy

We may update this Policy periodically to reflect changes in law, regulation, or our business practices. Material changes will be notified by posting the revised Policy on our website with an updated "Effective Date," and, where required by law, through direct communication to you.

16. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Courts at Kolkata, West Bengal shall have exclusive jurisdiction over any disputes arising from this Policy, without prejudice to your right to approach the Data Protection Board of India or other statutory authority.

17. Contact Us

Prime Vistaa Holidays 83 S P Mukherjee Road, Kolkata 700026, West Bengal, India Phone: +91 74394 22239 Email: privacy@primevistaa.com Grievance Officer / DPO: Ranjan Tafadar