Privacy Policy & Personal Data Notice

This Privacy Policy and Personal Data Notice explains how Mumbai Trekizens (Sole Proprietorship — Proprietor: Sagar Shinde) ("we", "our" or "us") collects, uses, stores and protects your personal data when you use mumbaitrekizens.in, book a trek or adventure event, submit an inquiry, or create a user account. We handle personal data in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the rules framed thereunder, acting as a Data Fiduciary.

1. Information We Collect & Data Minimisation

We collect only the minimum personal data strictly required to organise your trek safely, process bookings and permits, or manage your optional account:

• Account & profile data (optional): If you create an account, we collect your full name, email address, mobile number, and confirmation that you are 18 years of age or older. We do not collect your date of birth or blood group. Optional portfolio fields (profile photo, short bio, and city) are requested only if you choose to enable your public travel portfolio.
• Booking & co-participant data: Lead participant's full name, mobile number, email address, batch/date, ticket type, booking-level food preference, and booking-level pick-up point. For additional co-participants, we collect only name and age (and optional gender solely for tent/room allocation) — we do not collect separate mobile numbers or emails for co-participants.
• Booking-level emergency contact: Emergency contact name and 10-digit phone number are collected per booking (mandatory for guest bookings). Logged-in users may pre-fill their emergency contact from their profile and choose whether or not to save updated emergency contact details back to their profile (default: do not save).
• Optional medical / safety notes: If you have any allergy, asthma, diabetes, medication, or other health condition your trek leader should know about for trail safety, you may optionally enter it in the booking form's Medical Notes box with your explicit consent. We handle health and safety information with extra care and strict access restrictions, never display it publicly, and automatically delete it 30 days after the trek concludes.
• Government ID handling (Visual Verification at Base Village; Digital Copy Only for Permit-Regulated Treks): We do not collect Government ID numbers or ID photos on standard booking forms. At the base village, your physical photo ID is only visually inspected for identity verification and no copy is stored. A digital ID copy is uploaded to a private storage bucket only for specific permit-regulated trips marked "Permit Required" on the event booking page (such as forest department, inner-line permit, or tiger reserve safaris) where forest departments or border check-posts mandate an ID copy. When uploading Aadhaar for a permit trip, please upload a Masked Aadhaar (with the first 8 digits hidden). Uploaded permit ID copies are automatically deleted within 7 days after the trek.
• Parental / guardian verification data (when booking for children under 18): Parent or lawful guardian's full name, mobile number / email, 18+ confirmation, and 6-digit OTP verification record. For minor participants, we collect only the child's name and age (never date of birth).
• Payment references: Payments are processed by Razorpay. In our database, we store only the Razorpay payment/order reference ID, amount, and payment status. We never store UPI IDs (VPAs), card digits, or bank account details.
• Reviews & blog comments: Display name and review/comment text only. We do not collect or store email addresses on blog comments or public reviews.
• Corporate inquiries & trek leader applications: For corporate inquiries, we collect contact name, company name, work email, phone, group size, and trip requirements (no street address). For trek leader applications, we collect applicant details and qualification documents; rejected applications and their uploaded files are deleted after 90 days.

2. Itemised Schedule of Personal Data Collected (Section 5 Notice)

In accordance with Section 5(1) of the DPDP Act 2023, the table below sets out each item of personal data we collect, the specific purpose of processing, its legal basis under the Act, retention period, and categories of recipients/processors:

3. Legal Basis for Processing (Consent & Section 7(a) Legitimate Uses)

Under the DPDP Act 2023, we rely on two distinct lawful bases depending on the activity:

• Voluntary Provision for Specified Legitimate Uses (Section 7(a)): When you voluntarily provide your name, contact details, co-participant details, food/pickup preferences, emergency contact, payment reference, or permit ID copy to book a trek, submit an inquiry, or apply as a trek leader, we process that data under Section 7(a) strictly to fulfil your booking, arrange transport/meals/permits, and ensure trail safety.
• Specific, Unbundled Affirmative Consent (Section 6): We rely on your free, specific, informed, and unambiguous consent (via unbundled checkboxes or toggles that are never pre-ticked) for:
  1. Processing optional medical/health notes solely for safety on a booked trek;
  2. Sending promotional trek updates and offers via email, WhatsApp, or browser push notifications;
  3. Subscribing to our newsletter (verified via double opt-in email confirmation);
  4. Making your Travel Portfolio public (and optionally displaying your city); and
  5. Loading any non-essential analytics cookies.

Every consent action and withdrawal is logged server-side in our tamper-evident consent_records audit table along with policy version (privacy-v2.0) and timestamp.

4. Data Processors & Sharing of Information

We do not sell, rent, or trade your personal data to any third party for commercial or marketing purposes. We share limited personal data only with the following categories of recipients and Data Processors, each acting under binding contractual obligations in accordance with Section 8(2) of the DPDP Act 2023:

• Supabase (Database, Authentication & Private Storage): Hosts our PostgreSQL database and encrypted file storage buckets in region ap-south-1 (Mumbai, India).
• Cloudflare (Pages, Pages Functions, Workers, CDN & Turnstile): Provides edge hosting, DDoS/WAF protection, bot protection (Cloudflare Turnstile), serverless API execution, and our automated weekly operations report worker.
• Razorpay (Payment Gateway): Processes online payments (UPI, cards, net banking, EMI) as an independent RBI-regulated payment aggregator.
• Resend & EmailJS (Transactional Email Delivery): Delivers booking confirmations, guardian OTPs, newsletter double opt-in links, and payment confirmation emails.
• WhatsApp / Meta Platforms: Used when you initiate a WhatsApp chat with us or opt in to receive trek coordination/promotional updates on WhatsApp.
• Firebase Cloud Messaging (Google FCM): Delivers browser push notifications only to users who explicitly subscribe in their browser.
• Google Analytics (GA4) (Website Analytics): Used for measuring website performance and traffic (non-essential analytics scripts load only after cookie consent).
• Telegram Bot API (Internal Operational Alerts): Our scheduled Cloudflare Worker (`weekly-report-worker`) sends an internal weekly summary to the site administrator via Telegram and Resend containing aggregate booking/lead counts and recent pending booking status summaries for operational follow-up.
• On-ground Partners & Statutory Permit Authorities: Licensed transport operators, local base-village homestays (name/headcount/meal count only), and Forest Department / border check-posts (for trips marked "Permit Required" where official permits are mandatory).

5. How We Store & Secure Your Data

Your personal data is protected using TLS/HTTPS encryption in transit and encryption at rest provided by our database host (Supabase, hosted in ap-south-1 (Mumbai, India)), combined with strict PostgreSQL Row-Level Security (RLS) policies, server-side validation triggers, and private storage buckets (avatars, applications, and permit-documents) accessible only via short-lived signed URLs. We handle health notes, emergency contacts, and permit ID copies with extra care and strict role-based access controls, and they are never displayed on public pages.

6. Public Profile & Travel Portfolio

Your user account and travel portfolio are private by default. If you explicitly toggle your portfolio to public in your Account Dashboard, the following fields are displayed on your shareable portfolio page:

• Your full name, profile photo, and short bio;
• Your city — only if you also turn on the separate "Show city on public portfolio" toggle;
• Your completed treks (including trek title, date, and location), earned badges, certificates count, mountaineering/outdoor qualifications, bucket list, and trekking statistics (treks completed, kilometres trekked, highest altitude, trek days).

We will never display your email address, mobile number, emergency contact, medical notes, payment history, or booking amounts on a public portfolio page. You can switch your portfolio back to private at any time with a single click.

7. Data Retention & Automatic Erasure

Under Section 8(7) of the DPDP Act 2023, we retain personal data only for as long as necessary to fulfil the specified purpose or comply with Indian laws:

• Trek safety & co-participant details: Booking-level medical_notes, emergency_name, emergency_phone, and co-participants' age/gender are automatically erased 30 days after the trek date.
• Permit ID copies: Files uploaded to the private permit-documents bucket for permit-regulated treks are automatically deleted within 7 days after the trek.
• Rejected trek leader applications: Application records and uploaded CV/certificate files in the private applications bucket are automatically deleted 90 days after rejection.
• Inactive user accounts: Accounts that remain inactive for 3 years (36 months) are scheduled for deletion after sending prior email notice to the registered user.
• Financial & tax records: Booking financial records and invoices are retained for 8 years to comply with Indian tax and accounting statutes; if you delete your account, your personal identifiers on past bookings are anonymised while preserving the statutory financial ledger.

8. Personal Data Breach Notification (Section 8(6))

In the event of a personal data breach affecting your data:

1. Notification to Affected Users: We will notify affected Data Principals without delay via email/SMS in clear, plain language describing: (a) the nature and extent of the breach, (b) the likely consequences for you, (c) the mitigation and remedial measures implemented by us, (d) recommended safety steps you can take to protect yourself, and (e) the contact details of our Grievance Officer.
2. Notification to the Data Protection Board of India: We will intimate the Data Protection Board of India without delay upon becoming aware of a personal data breach and submit a detailed report within 72 hours (or within such timeframe and manner as prescribed under the DPDP Rules).

9. Your Rights Under the DPDP Act 2023 & How to Exercise Them

As a Data Principal under Sections 6, 11, 12, 13, and 14 of the DPDP Act 2023, you have the following rights, which you can exercise directly through our self-service tools in your Account Dashboard or by emailing our Grievance Officer:

• Right to Access & Data Portability (Section 11): Use the "Download My Data" button in your Account Dashboard to instantly download a machine-readable JSON export of your profile, bookings, consent records, reviews, wishlist, and trek history, or request a summary of data and processors via email.
• Right to Correction & Completion (Section 12): Edit your profile, emergency contact, and portfolio settings anytime in My Profile, or email us to correct booking details.
• Right to Erasure (Section 12): Use the "Delete My Account & Data" tool in My Profile to permanently delete your profile, avatars, permit IDs, wishlist, qualifications, and trek log, and anonymise past bookings/reviews (subject to 8-year tax ledger retention).
• Right to Withdraw Consent (Section 6(4)): Use the one-click "Withdraw Marketing Consent" control in your Account Dashboard (which logs the withdrawal in consent_records and turns off newsletter and promotional push offers), toggle off your Public Portfolio, or click the unsubscribe link in any marketing email. Withdrawal of consent does not affect the legality of processing carried out prior to withdrawal.
• Right to Nominate (Section 14): Register or update a Nominee (name, relationship, and contact details) directly in your Account Dashboard who may exercise your rights under the DPDP Act in the event of death or incapacity.
• Right of Grievance Redressal (Section 13): Contact our Grievance Officer using the details in Section 12 below.

How We Verify Rights Requests Submitted by Email: If you exercise your rights by emailing [email protected] (for example, as a guest booker without an account), please send the request from the same email address used at the time of booking and mention your full name, registered mobile number, and Booking PNR (if applicable). We verify ownership by confirming a one-time reply from your registered email/mobile; we do not ask for additional Government ID copies unless strictly necessary to verify a legal nominee acting under Section 14.

10. Cookies & Analytics

We use essential browser storage (`localStorage` / session tokens) strictly necessary for Supabase authentication, booking form state, and Cloudflare Turnstile anti-spam verification. Any non-essential analytics cookies or scripts (Google Analytics (GA4)) are off by default and load only if you explicitly opt in via our Cookie Notice Banner. You can review or change your cookie choice at any time using the "Cookie Settings" link in the website footer.

11. Children & Minor Data (Section 9)

User accounts and booking submissions on mumbaitrekizens.in may only be created by individuals aged 18 years or older. In accordance with Section 9 of the DPDP Act 2023:

• Minors (children under 18) may participate in a trek only when booked by a parent or lawful guardian aged 18+ who completes our Guardian OTP Verification during booking (verifying the guardian's full name, mobile/email OTP, and 18+ guardian declaration, logged in consent_records).
• For minor participants, we collect only the child's name and age (never date of birth, mobile number, or email).
• We do not undertake any tracking, behavioural monitoring, or targeted advertising directed at children, nor any processing likely to cause detrimental effect on the well-being of a child.

12. Data Fiduciary & Grievance Officer Contact (Section 13)

In accordance with Sections 5, 8(10), and 13 of the DPDP Act 2023, the details of the Data Fiduciary and appointed Grievance Officer are as follows:

• Data Fiduciary (Legal Entity): Mumbai Trekizens (Sole Proprietorship — Proprietor: Sagar Shinde)
• Grievance Officer Name: Sagar Shinde
• Designation: Proprietor, Grievance Officer & Data Protection Contact
• Registered Address: Sector 20, Kamothe, Navi Mumbai, Maharashtra 410209, India
• Email: [email protected]
• Telephone: +91 97023 32748 (Mon–Sat, 09:00–20:00 IST)
• Acknowledgement Timeline: Within 48 hours of receipt
• Resolution Timeline: Within 30 calendar days of receipt

If your grievance is not resolved within 30 days or you are not satisfied with our resolution, you have the right to make a complaint to the Data Protection Board of India in accordance with Section 13(3) of the DPDP Act 2023.