Privacy Policy

1. Introduction

SimplyOffbeat ("SimplyOffbeat", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you visit our website, create an account, submit a travel enquiry, request an itinerary, communicate with our team, or use our travel planning and booking assistance services.

We aim to handle personal information transparently and in accordance with applicable privacy and data protection laws, including the Digital Personal Data Protection (DPDP) Act of India.

2. Information We Collect

Depending on how you use our services, we may collect the following categories of information:

3. How We Use Personal Information

We may use personal information to:

• Create, authenticate, and secure user accounts.
• Verify eligibility and apply age-related safeguards.
• Respond to travel enquiries and requests for assistance.
• Understand your travel preferences and prepare customised itineraries.
• Coordinate bookings with relevant travel providers.
• Communicate confirmations, changes, questions, and service updates.
• Provide customer support and respond to complaints.
• Operate, maintain, troubleshoot, and secure our website.
• Generate AI-assisted travel recommendations where you use those features.
• Prevent fraud, misuse, unauthorised access, and other unlawful activity.
• Meet applicable legal, regulatory, accounting, and recordkeeping obligations.
• Establish, exercise, or defend legal claims where necessary.

We will not use personal information for a materially different purpose in a way that is inconsistent with applicable law without providing the required notice or obtaining consent where necessary.

4. Legal Basis for Processing

Where applicable law requires a legal basis, we may process personal information on one or more of the following grounds:

• Your consent.
• Steps taken at your request before entering into an arrangement, or performance of an agreement with you.
• Compliance with a legal obligation.
• Legitimate interests, where recognised by applicable law and not overridden by your rights.
• Other lawful grounds permitted by the law that applies to the processing.

Where processing depends on consent, you may withdraw that consent as permitted by law. Withdrawal does not make earlier lawful processing unlawful, and some services may no longer be available if the relevant processing is necessary to provide them.

5. Age Eligibility and Children's Privacy

Our website account-based services are intended for people aged 13 and older. We do not knowingly permit a person under 13 to create an account or use account-based services.

If you are aged 13 to 17, you must involve a parent or legal guardian and obtain their consent wherever required by applicable law. Because age-related privacy requirements vary by jurisdiction, SimplyOffbeat may request appropriate confirmation of parental or guardian consent or restrict certain features until the relevant requirements are satisfied.

In India, applicable data protection requirements under the DPDP framework may treat individuals under 18 as children and impose additional requirements, including verifiable parental or guardian consent, subject to applicable commencement provisions, exemptions, and rules. We will apply the safeguards required for the processing in question.

If you are a parent or legal guardian and believe that a child has provided personal information in breach of applicable requirements, please contact us using the details below. We will assess the request and take appropriate steps as required by law.

We aim to collect only the age-related information reasonably needed for eligibility and compliance. We will not claim that date-of-birth information is never stored unless our live application, database, logs, analytics, and related systems have been checked and verified to support that statement.

6. AI Tools and Third-Party Technology Providers

We may use third-party technology providers to operate our services, including:

• Supabase: for relevant database, account, authentication, and application infrastructure.
• Google Gemini: for AI-assisted travel recommendations or related features, where enabled.
• Other hosting, communication, security, or technical service providers where required to operate our services.

Information submitted to an AI feature may be processed by the relevant provider to generate a response. The provider's processing terms, technical configuration, retention settings, and contractual commitments may affect how that information is handled.

We will take reasonable steps to use appropriate provider settings and contractual protections. We will not claim that a provider never retains or uses submitted information unless the applicable configuration and terms have been verified.

Where providers process information outside your country, applicable cross-border transfer requirements and safeguards will be addressed as required by law.

7. When We Share Personal Information

We may share relevant personal information with:

• Authorised SimplyOffbeat staff who need it for travel planning, booking coordination, support, or sales follow-up.
• Airlines, hotels, tour operators, transport providers, activity organisers, and other suppliers when necessary to fulfil your request.
• Technology and infrastructure providers that help us operate the website and services.
• Professional advisers, insurers, auditors, or service providers where reasonably necessary and lawful.
• Government authorities, regulators, courts, or law enforcement where disclosure is required or legally permitted.
• Relevant parties where necessary to protect rights, safety, security, or prevent fraud, subject to applicable law.

We aim to share only the information reasonably necessary for the relevant purpose. Third-party providers may process information under their own privacy notices and terms.

We do not sell personal information for money. Any sharing for targeted advertising, cross-context behavioural advertising, or similar activities, if introduced, will be subject to applicable law and any required notice, consent, and opt-out rights.

8. Cookies and Similar Technologies

Our website may use essential cookies or similar technologies needed for functions such as authentication, session management, security, and core website operation.

We do not intend to activate non-essential advertising or analytics cookies without consent where consent is legally required. If additional technologies are introduced, we will provide appropriate information and consent controls where required.

Because actual website behaviour can differ from policy wording, the cookies, scripts, embedded tools, and third-party requests on the live website should be audited before this statement is published as a confirmed description of current operation.

9. Data Retention

SimplyOffbeat retains personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including responding to travel enquiries, planning and coordinating bookings, providing customer support, maintaining security, and meeting legal obligations.

Retention periods vary depending on the type of information and its purpose. We determine the applicable period based on operational needs, legal and regulatory requirements, security requirements, and the need to resolve disputes or establish and defend legal claims. When personal information is no longer required, we take appropriate steps to delete or anonymise it, subject to applicable legal exceptions.

Certain security logs, processing records, or other information may need to be retained for specific periods required by law. Backups and third-party systems may follow separate deletion schedules.

10. Data Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, disclosure, and misuse.

Depending on the system, safeguards may include access controls, authentication, permissions, secure connections, monitoring, and appropriate service-provider protections.

No website or storage system can be guaranteed to be completely secure. You should keep your account credentials and one-time passwords confidential and inform us promptly if you suspect unauthorised access.

Where a personal data breach occurs, we will assess and provide notifications to affected individuals and relevant authorities as required by applicable law.

11. Your Privacy Rights

Depending on your location and the law that applies, you may have rights to:

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion or erasure, subject to applicable exceptions.
• Withdraw consent where processing relies on consent.
• Object to or restrict certain processing where those rights apply.
• Request a copy or portability of information where legally available.
• Opt out of certain sale, sharing, or targeted advertising practices where applicable.
• Raise a complaint with the relevant data protection or consumer authority.

To make a request, use the contact details below or the privacy controls made available in your account. We may need to verify your identity or authority before acting on a request.

We will respond within the time limits required by applicable law. Some information may need to be retained where a legal exception applies, such as compliance with legal obligations or handling an existing booking or dispute.

12. International Users and Regional Requirements

SimplyOffbeat is based in India and may receive enquiries from people in other countries. Privacy rights and obligations vary depending on where you live, the services offered to you, and the processing involved.

Where applicable, we will provide required notices, legal bases, consent mechanisms, data transfer safeguards, and methods for exercising privacy rights under relevant laws, including Indian data protection law (DPDP Act) and applicable international privacy laws.

Nothing in this policy is intended to remove a mandatory right granted to you by applicable law.

13. External Websites and Third-Party Links

Our website may contain links to third-party websites or services, including travel suppliers. Those services are not controlled by SimplyOffbeat, and their privacy practices may differ from ours.

You should review the privacy policy and terms of any third-party service before providing information or making a booking through it.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, data practices, or legal obligations.

The latest version will be published on our website with its updated effective or last-updated date. Where required by law, we will provide additional notice or obtain consent before implementing relevant changes.