Privacy Policy

Identity and contact

This notice is issued by Om Taxi Service, a proprietorship, trading as Om Travels, of Grand Trunk Road, Panipat, Haryana. It covers om-travels.in: this website, the enquiry form on it, the fare calculator, and anything you write to us about, by phone, by WhatsApp, or by email, once it grows out of an enquiry or a booking made through this site. Where this page says "we", "us" or "Om Travels", it means Om Taxi Service.

The law behind this notice, the Digital Personal Data Protection Act, 2023, calls anyone whose personal data is processed a "Data Principal" and calls the business that decides why and how it is processed a "Data Fiduciary". Read as plainly as the Act actually intends: if you have priced a trip, sent us an enquiry, or exchanged a single WhatsApp message with us about a booking, you are a Data Principal under this notice, and we are the Data Fiduciary responsible for what happens to your data next.

The Act requires every Data Fiduciary to publish the name, designation, email and phone number of a person who can actually answer a question about how personal data is handled, so a reader is never left holding a policy with nobody to write to. It is worth being precise about what that person is and is not, because the two are easy to run together and the difference matters legally.

A statutory Data Protection Officer, DPO, is a specific, more demanding role the Act reserves for a "Significant Data Fiduciary": a business the government notifies as such once it crosses a threshold of scale or sensitivity of the data it processes, and that role carries its own reporting duties direct to the Data Protection Board of India. Om Travels is an enquiry-led, single-city chauffeur-hire business and has not been notified as a Significant Data Fiduciary, so a statutory DPO is not a legal requirement here, and this notice does not claim to appoint one.

A Data Protection Contact is a narrower and more practical commitment: one named person, reachable directly, whose job includes answering exactly the kind of question this page raises. We provide one anyway, because every serious enquiry about how we handle someone’s data deserves an actual person on the other end of it rather than a generic mailbox nobody reads.

Sachin Jaglan, Data Protection Contact

Email sachin@om-travels.in · Phone +91 99966 69190 · Grand Trunk Road, Panipat, Haryana. Write here with any question about how we collect, use, share, retain or protect your personal data, or to exercise a right set out in this notice.

If your question is about your trip rather than your data, a fare that looks wrong, a driver’s conduct, a delay, our Grievance Officer and the full escalation ladder for that are published separately at /grievance-redressal. The two roles are held by the same person, and the two questions are answered under two different published pages, so the right one is easy to find.

Scope

This notice covers om-travels.in in full: browsing the site, pricing a trip with the fare calculator, reading a route or fleet page, and submitting the enquiry form. It also covers what follows from an enquiry made through this site, whichever channel that conversation continues on: a call to the numbers published in our footer, a WhatsApp exchange, or an email, once it grows out of something you started here.

It does not matter which of those channels you actually used to reach us. Whether you filled the enquiry form, called the number in the footer, or messaged us on WhatsApp after seeing a route page, you are dealing with the same business under the same commitments, and this notice applies to your data the same way regardless of which door you came in through.

This notice is about a customer or a prospective customer: someone enquiring about a trip or travelling on one we have arranged. It is not the notice for someone who works with us. A driver, a vehicle owner or another partner is covered by a separate document, our Partner Privacy Notice at /legal/partner-privacy-notice, because that relationship collects a different kind of data for a different reason, a driving licence and a police verification rather than a pick-up address, and deserves its own plain-English page rather than a paragraph folded into this one.

How we use cookies, device identifiers and any analytics tool on this website is a related but separate question, covered in full at /legal/cookie-policy, and this notice cross-refers to it rather than repeating it, so the cookie-specific detail, what each one is called, how long it lasts, whether you can decline it, lives in exactly one place rather than two that could drift apart.

What we collect, and why

The Digital Personal Data Protection Rules, 2025 require this notice to be itemised, in clear and plain language, rather than a single paragraph asserting that we collect "information you provide and information we gather automatically." A prose paragraph like that tells you nothing you can actually check your own experience against, so we set it out item by item instead: what we collect, exactly why, roughly how long we keep it, and who else, if anyone, ever sees it.

A word about the note on a medical, mobility or other personal requirement, because the Act treats this kind of information with more care than an ordinary contact detail. You are never asked to disclose one. If you choose to tell us, because it genuinely affects how your trip should be arranged, a wheelchair-accessible vehicle, extra time at a stop, a seating requirement, we use it for exactly that purpose and nothing else, and we pass it on only to the driver actually assigned to your trip, only so far as it is relevant to carrying it out safely. It is not recorded anywhere for a purpose beyond that trip, and it plays no part in pricing your fare beyond what the vehicle class you need actually costs.

You will notice there is no row here for a GST number, a PAN or a company registration detail: this table describes what a consumer enquiry and a personal booking actually collect. Where a company opens an account with us, the commercial and billing detail that involves, including how GST is charged and who pays it, is a separate relationship covered by our Corporate Transport Terms at /corporate/terms and our GST & Invoicing policy, not by this consumer-facing notice.

Consent

Where we rely on your consent to process your data, that consent has to meet a specific standard under the Act: it has to be free, meaning not made a condition of something unrelated; specific, meaning tied to a stated purpose rather than a blanket permission; informed, meaning you actually know what you are agreeing to; and given by a clear, affirmative action on your part, a box you actually tick, not a box we have already ticked for you.

Submitting an enquiry is not itself consent to marketing communication. Where we ask for your consent to send you a promotional message, that is a separate, specific choice, presented as its own unticked checkbox, and it is never bundled with, or implied by, the action of submitting an enquiry or a booking.

In practice this means two different things happen on this website, and only one of them needs your permission first. Filling the enquiry form and pressing submit tells us you want a fare and a reply, and we act on that without asking for anything further, because responding to your own enquiry is not marketing, it is the service you have just asked for. A separate question, asked separately, is whether you would also like to hear from us about an offer, a seasonal update or a route you have not asked about yet, and that question is never answered on your behalf by the act of asking us something else. The fuller detail of how each channel treats this split, email, SMS and WhatsApp specifically, is at our Communication Policy, /legal/communication-policy.

You can withdraw consent as easily as you gave it. Write to our Data Protection Contact, named above, and tell us what you would like to withdraw consent for; no explanation is required, and no form has to be filled beyond that message. Where consent was given through a specific channel, ticking a marketing checkbox on the enquiry form, replying to a WhatsApp message, the same channel works to withdraw it, and so does writing directly to the Data Protection Contact regardless of how consent was originally given.

Withdrawing consent is prospective, not retroactive. It stops what happens from that point onward; it does not undo something that was lawfully done while your consent was still in effect. If you withdraw consent to marketing, for example, we stop sending you promotional messages from that point, but a quotation already sent, a booking already confirmed and an invoice already raised remain exactly as they are, because those were not done on the strength of the consent you have withdrawn.

There is a practical consequence worth stating plainly rather than leaving you to discover it. Where the data in question is what we genuinely need to progress an enquiry, your travel dates, your pick-up address, the class of vehicle you want, withdrawing your consent to hold that data means we may no longer be able to progress that particular enquiry, because we would be working without the details a fare and a booking actually require: that is simply what the data was for in the first place. Withdrawing consent to something we do not strictly need to run your trip, a marketing message, an optional preference, has no such consequence at all.

Your rights

The Digital Personal Data Protection Act gives you a specific set of rights over your own personal data, and the Rules require us to say plainly how each one is actually exercised, not merely name it. Here is each right, what it means in practice for someone who has enquired with or booked through Om Travels, and how to use it.

Access

You may ask us for a summary of the personal data we hold about you: what we collected, when, for which enquiry or booking, and who it has been shared with under the table above. Write to our Data Protection Contact with enough detail to identify your enquiry or booking, your name, mobile number and roughly when you contacted us, and we will put that summary together for you.

Correction

If something we hold about you is wrong, a misspelt name, an old phone number, a pick-up address that has since changed, tell us and we correct it. This is as much in your interest as ours: a wrong mobile number is a driver who cannot reach you on the morning of your trip, and a stale address is a car sent to the wrong gate.

Erasure

You may ask us to delete your personal data. We honour this wherever we are not otherwise required to keep it: where a booking is still live and needs the details to be delivered, or where the law genuinely requires us to retain a particular record, an invoice or a document behind it for a statutory tax or accounting duty being the clearest example, we will tell you plainly what we can delete now and what we are required to hold, and for how long, rather than either refusing the request outright or pretending an obligation does not exist.

Grievance redressal

If you are not satisfied with how a request under this notice has been handled, you may raise that with us as a grievance in its own right. The full escalation ladder, our Grievance Officer, the timelines we work to, and the external routes open to you beyond our own process, is published in full at /grievance-redressal.

Nomination

This is the right most people have never heard of, and it is worth explaining plainly rather than assuming you know it. The Act lets you name another person, in advance, who may exercise your rights over your personal data on your behalf if you die or become incapacitated, in the same way you might name a nominee for a bank account or an insurance policy. It exists because personal data does not simply stop mattering when someone can no longer act for themselves, and without a nominated person, nobody has an automatic, recognised right to ask on your behalf what a business holds about you or to have it corrected or deleted. To nominate someone, write to our Data Protection Contact naming that person and how to reach them; we record the nomination against your enquiry or booking record, and honour a request from your nominee, once we have confirmed the circumstances that give them standing to act, on the same terms this notice gives you.

You have the right, under the Digital Personal Data Protection Act, 2023, to nominate another individual who may exercise your rights under this notice in the event of your death or incapacity. Write to our Data Protection Contact to register a nomination.

We acknowledge a request made under this notice within 48 hours and give a substantive response within 30 days.

This is a different clock from the one that answers a complaint about your trip itself: a fare that looks wrong or a driver’s conduct is acknowledged within 24 hours and resolved within 15 days under our general Grievance Redressal process, because that is a service complaint rather than a data-rights request. A request under this notice specifically, asking what we hold, asking for a correction, an erasure or a nomination to be recorded, is acknowledged within 48 hours and substantively answered within 30 days, which is the standard the Rules set for exactly this kind of request.

If you are not satisfied with how we have handled a request under this notice, you may raise it with our Data Protection Contact in the first instance, and, if it remains unresolved, you may complain to the Data Protection Board of India.

We would genuinely rather you wrote to us first. Most requests about what we hold or how we have used it are things we can put right directly and quickly, without needing a regulator involved at all, and writing to the Data Protection Contact costs you nothing and starts the 48-hour clock above immediately. The route to the Data Protection Board of India stays open to you regardless.

Children's data

This website is not directed at anyone under 18, and submitting an enquiry or confirming a booking is something an adult does, for the reasons our Terms of Use set out in full at /terms. That is a statement about who enters into a contract with us, not about who travels: a chauffeur-driven vehicle we run every day carries children, students and family members of every age, and none of that changes because of this section.

Where a child’s name, age or seating requirement appears in a booking, a family trip, a school run, a wedding party carrying children, that detail is supplied to us by the parent or guardian arranging the trip, on their own authority, and we treat it as data given to us by that adult about the trip they are booking, in the same way an address or a travel date is. We do not collect it directly from a child, and we do not ask a child to fill any part of this website’s enquiry form themselves.

We do not direct advertising, behavioural tracking or profiling at a child. This website carries no advertising at all, to anyone, and any analytics we use, set out in full at /legal/cookie-policy, is about how the site is used in general rather than about building a profile of any individual visitor, adult or child.

Where your data is processed

Running a website and communicating with you by email and WhatsApp involves a small number of service providers who do one part of that job for us: the company that hosts this website, the service that sends transactional email, WhatsApp’s own Business Platform, and, where we use one, an analytics tool that helps us understand how the site is used. In the ordinary course of providing their own service to us, some of these providers may process data outside India, because that is how a global hosting, email or messaging service is generally built to run.

We choose providers of this kind with appropriate safeguards for exactly that reason, and Section 16 of the Digital Personal Data Protection Act is the provision that governs a transfer of this sort: it allows personal data to be transferred outside India except to a country the Central Government specifically restricts, and we check that list before adding any new processor to how this website or our communications actually run.

We do not currently name a specific hosting provider, database technology or server region on this page: this page states a real, checkable commitment, that we choose providers responsibly and check the restricted-country position, rather than a specific technical detail that could go stale the day our infrastructure changes. The full, current list of service providers who process data on our behalf is maintained at /legal/subprocessors, referred to again below.

Security safeguards

A privacy notice is only as good as the safeguards behind it, so this section states what we actually do, in terms that describe how this business operates rather than which specific product does the work.

Your data is encrypted in transit: this website is served over HTTPS, and any message you send us through it, or any exchange we have with you over WhatsApp or email, travels over an encrypted connection rather than in the clear.

Access to your personal data is limited to the people in our team who actually need it to do their job: the person preparing your quotation, the person confirming your booking, the driver assigned to your trip needs your pick-up point and contact number and nothing beyond that. We do not run a system where every member of our team can browse every enquiry that has ever come in; access follows the job that needs it.

Your personal data is not written into an operational log line. When an enquiry comes in, it is tracked internally by its own reference number, the same reference we give you, and that reference, not your name and not your mobile number, is what our team and our systems use day to day to look an enquiry up and progress it. This is a real engineering discipline we hold to: your identifying details are handled separately from the operational record of what a trip involves, precisely so a technical log kept for troubleshooting a system never becomes an unintended second copy of who you are and where you were going.

A sensitive detail, an identity document, a medical or mobility note, is never stored in plain, unprotected form as a matter of routine convenience. Where a booking genuinely calls for a document to be held, a corporate account’s KYC requirement being the clearest example, it is held with access restricted to the people who need it for that specific purpose, and it is not left sitting in a place any member of staff can casually open.

These are commitments about how this business handles your data, not a description tied to one particular piece of infrastructure. Whatever system stores an enquiry or a booking, the same three rules apply to it: encrypted in transit, access limited to who needs it, and no personal detail written into a place it does not need to be.

If something goes wrong: breach notification

On becoming aware of a personal data breach affecting your personal data, we will tell you without undue delay. That notice will describe, in plain language, what happened, the likely consequence for you, and what we are doing about it, so you are never left to guess at the scale of something that involves your own information.

Where a breach is a cyber security incident, a system compromise rather than, say, a document sent to the wrong address by mistake, a separate and faster duty also applies: the CERT-In Directions dated 28 April 2022 require us to report the incident to the Indian Computer Emergency Response Team, CERT-In, within 6 hours of noticing it. That clock runs to a regulator responsible for the country’s cyber security posture, and it is a genuinely fast one by design, because an incident like this is exactly the kind where an early report to the right authority helps contain it before it spreads further.

And beyond our own process entirely, the Data Protection Board of India is the ultimate regulator for a privacy complaint under the Act, including one arising from a breach, and it remains open to you as a route regardless of how we have handled our own notification to you, in the same way the section above sets out for a data-rights request generally.

How long we keep your data

We keep your personal data for as long as it is genuinely needed for the purpose it was collected for, which for most of what this notice covers means for as long as needed to deliver your trip and answer any question that reasonably follows from it, and not indefinitely once that purpose has run its course.

In practice that covers two different periods, and it is worth naming both rather than collapsing them into one figure. While your enquiry or booking is live, we hold what we need to progress it, your contact details, your trip details, any note relevant to arranging it. For a reasonable period after your last interaction with us, we continue to hold enough to answer a question that can genuinely come back after a trip is over, a query about an invoice, a complaint that reaches us some weeks later, a repeat enquiry from someone we have dealt with before who would rather not retype everything.

Where a document behind a booking, an invoice being the clearest example, is required to be kept for a statutory period under tax or accounting law, that document is kept for that period regardless of whether the underlying personal data would otherwise have been deleted sooner, in the same way our Corporate Transport Terms describe for a company account’s own invoicing record: a legal record-keeping duty that sits on top of, and outlasts, the ordinary customer-service reason the data was first collected for.

Once neither of those reasons applies, the purpose has run its course and no statutory duty extends it further, we do not keep your data on regardless. This is the same discipline our right of erasure above already commits us to on request; retention is meant to work the same way as a matter of course, not only when someone specifically asks.

Automated decision-making

No legally significant decision about you is made solely by automated means on this website. The fare our calculator shows you against a route is a starting figure, worked out from our own published rates and route data, and it is indicative rather than binding, as our Terms of Use set out in full: a human on our team reviews and confirms it before it becomes the written Quotation you can actually rely on.

Nothing on this website scores you, profiles you, or decides whether to serve you differently based on an automated assessment of who you are. Every enquiry that reaches us is looked at and answered by a person, and any decision that actually affects you, the fare you are quoted, whether a particular class of vehicle is available on your date, is made by that person rather than by an algorithm acting alone.

Call recording

A call to or from our office may be recorded, for quality and training, and to settle a dispute about what was said or agreed on it, including a fare quoted over the phone. A recording is personal data like any other record we hold about you, and it is treated with the same care set out in the Security safeguards section above.

The fuller position, why we record, how a recording is used, and how long one is kept, is set out in full at our Communication Policy, /legal/communication-policy, rather than repeated here.

Service providers who process data on our behalf

We work with a small number of outside service providers to run this website and to communicate with you, the categories are described above at Where your data is processed, and each is chosen because it does one job we could not do as well ourselves.

The current, named list of these service providers is maintained at /legal/subprocessors, kept separately from this notice so it can be updated as our own providers change without every update requiring a change to this whole page. Where a new provider is added that would process your personal data in a materially different way, we say so there.

Language

This notice is published in English. In accordance with Section 5(3) of the Digital Personal Data Protection Act, 2023, we will provide it in any language specified in the Eighth Schedule to the Constitution of India on request to our Data Protection Contact, named above.

Changes to this notice

We may update this Privacy Policy from time to time, to reflect a change in the law, a new way we handle your data, or simply to state an existing practice more clearly than before. The effective date at the top of this page tells you which version you are reading.

We inform users of changes to our rules and regulations, privacy policy and user agreement at least once every year, and immediately where a change materially affects your rights. Material changes are notified by email and WhatsApp to our enquiry and customer list and by an on-site banner displayed for 30 days.

A change that materially affects your rights, what we collect, who we share it with, how long we keep it, is announced through those direct channels and the on-site banner, so you see it rather than discover it later by chance. A smaller change, clarifying wording that already reflected our actual practice, correcting a typo, is simply recorded without the same announcement. Either way, nothing changes quietly: /legal/changelog carries every version of this page we have published.

Questions about this notice, or a request under it: write to our Data Protection Contact above, or to info@om-travels.in. A written quote for a trip, separately, reaches you 9 am to 9 pm, the same day, as our general enquiry commitment describes; a question about your data is answered on the 48-hour and 30-day timeline this page sets out, because it is a different kind of question and deserves its own clock stated plainly rather than borrowed from another page.