Home
About Us
Team
Contact Us
Customers
Login
Request a Demo

Privacy Policy and Disclaimer for our Customers

GENERAL INFORMATION AND DISCLAIMER

This Privacy Policy is applicable to all services offered on the website www.ziptrrip.com and the Ziptrrip app, along with any pages or services that could be added to the website in the future (the “Services”), and is subject to the terms and conditions set out in the applicable regulations on data protection and on information society services and electronic commerce.

The use of the Services offered by ZIPTRRIP, Wayfarers Technologies Private Limited (W.T.P.L), a company duly incorporated pursuant to the laws of India, with registered office at

Ziptrrip hereby informs you that is not allowed for minors under 18 years old to use the Services. This Privacy Policy is applicable to all customers and their employees, users of the Services, data subjects and/or other persons who contact Ziptrrip for any reason and who access the Services. Please note that this policy is divided into different sections, depending on the role in which Ziptrrip processes data. We therefore ask you to read the section corresponding to the services that are offered to you by Ziptrrip, in order to know in full detail how Ziptrrip processes your data.

A. PRIVACY POLICY APPLICABLE TO THE MANAGEMENT OF BUSINESS TRAVEL

B. PRIVACY POLICY APPLICABLE TO CUSTOMERS OR DATA SUBJECTS

A. PRIVACY POLICY APPLICABLE TO THE MANAGEMENT OF BUSINESS TRAVEL

1. DATA PROCESSING TERMS

If you are a traveler or an administrator, the company, entity or organisation ("Your Company") you work for or collaborate with is the controller of your personal data, with Ziptrrip acting as data processor.

Your Company has given us instructions to sign you up with our platform in accordance with the profile you have been assigned.

For any request for information on the processing of your personal data by Ziptrrip, please contact Your Company to fulfil such request in compliance with its information duties established in current data protection regulations. You may also consult our confidentiality and data protection commitments in Section "OUR PRIVACY COMMITMENTS” of the Privacy Policy applicable to Your Company.

Notwithstanding the foregoing, we inform you that, as a registered user on behalf of Your Company, your data may be used by Ziptrrip to send promotional information about our products and services addressed to Your Company. Such processing is in the legitimate interest of Ziptrrip, which is expressly acknowledged by the data protection regulations and is expressly authorised in the regulations on information society services. You may, now or at any other time, object to receiving commercial notices about Ziptrrip’s products and services by sending an email message to customerhelp@ziptrrip.com.

B. PRIVACY POLICY APPLICABLE TO CUSTOMERS OR DATA SUBJECTS

2. DATA CONTROLLER

In cases where you contact Ziptrrip to request information, make inquiries or when you contract our services, Ziptrrip acts as controller of the personal data provided for such purposes.

For any query, request or clarification regarding the processing of your personal data, you may contact the email and post addresses provided as follows:

ZIPTRRIP, B-903, PLOT-09, SAI SAAKSHAAT, SEC-6 KHARGHAR, Raigarh, Raigad, Maharashtra, 410210; or to the following email address:customerhelp@ziptrrip.com.

3. PERSONAL DATA SUBJECT TO PROCESSING

For the purpose of rendering the services offered, Ziptrrip will process the following personal data:

You guarantee the authenticity and truthfulness of all data provided and must update any information provided to Ziptrrip so that it matches the real and current situation at all times. You will be held liable for any false or inaccurate statement and any damages this may cause to Ziptrrip or any third parties.

4. USE OF PERSONAL DATA

The personal data provided to Ziptrrip will be used for the following purposes:

5. LEGAL BASIS FOR THE DATA PROCESSING

Ziptrrip is authorised to process your data for the purpose of managing and processing your requests, as this is necessary for Ziptrrip to fulfil its contractual obligations in relation with such requests.

The processing of your professional or corporate contact details in relation to maintaining the relationship between Ziptrrip and the company, entity or organisation you work for or collaborate with responds to a legitimate interest of our company, which is expressly acknowledged by the data protection regulations.

Regarding the sending of promotional information about products and services similar in nature to those requested by you, such processing is in the legitimate interest of Ziptrrip, which is expressly acknowledged by the data protection regulations and is expressly authorised in the regulations on information society services. You may, now or at any other time, object to receiving commercial notices about Ziptrrip’s products and services by sending an email message to customerhelp@ziptrrip.com.

6. DATA DISCLOSURES, INTERNATIONAL TRANSFERS AND AUTOMATED DECISION-MAKING

Ziptrrip does not disclose data to third parties without first obtaining your consent, except where necessary to fulfil the legal and contractual obligations to which Ziptrrip is subject at any time due to its nature and business and/or to comply with your request.

In this respect, Ziptrrip hereby informs you that your data may be disclosed to service providers with whom Ziptrrip has signed the relevant agreements pursuant to the applicable regulations.

Ziptrrip uses services rendered by technology providers located in countries that do not have regulations equivalent to the Indian regulations. Its use of these services meets all the requirements set by the data protection regulations, with the guarantees and safeguards required to protect your privacy being applied to transfers of your data.

For more information about how your privacy is guaranteed, you may contact the Data Protection Manager through the specified post and email addresses.

Ziptrrip does not adopt any decisions that could affect you in a significant manner based solely on automated processing of your data. All decision-making processes of our company related to your requests, services, queries or purchases are conducted with the involvement of a human being.

7. RETENTION PERIOD

Your personal data will be kept for as long as your relationship with Ziptrrip continues. After this relationship has ended, Ziptrrip will keep your data for the legal statutes of limitations applicable to each processing. In such case, the data will only be processed to demonstrate that we have fulfilled our legal or contractual obligations. Once such statutes of limitations have ended, your data will be deleted or, alternatively,digitally anonymised.

8. SECURITY AND CONFIDENTIALITY MEASURES APPLIED TO THE DATA

Ziptrrip has implemented and maintains administrative, technical and organisational measures appropriate to the kind of data it collects and subject to the terms and conditions set out in the applicable data protection regulations, for the purpose of protecting the personal information provided to Ziptrrip against unauthorised or unlawful access and accidental loss, damage, alteration or destruction of data. Only authorised staff may access the personal information and they may only do so for the permitted business purposes. Notwithstanding the foregoing, criminal acts may be committed by third parties even where Ziptrrip uses all the means at its disposal to prevent such acts.

Despite this, you are responsible for suitably protecting any codes and passwords provided for access and prevent them from being used or accessed by unauthorised third parties. Ziptrrip cannot be held liable for any inappropriate use of the user name and password carried out by any user.

9. YOUR RIGHTS

You may exercise your rights to withdraw any consent you granted, to access, rectification, erasure, portability, restriction and/or objection to the processing of your personal data at any time and free of charge by sending a notice to our Data Protection Manager at the post and email addresses specified below:.

Further, should you consider that the processing infringes the data protection regulation or your rights, you may submit a complaint with our Data Protection Manager at the postal and electronic addresses indicated

ZIPTRRIP, B-903, PLOT-09, SAI SAAKSHAAT, SEC-6 KHARGHAR, Raigarh, Raigad, Maharashtra, 410210; or to the following email address: customerhelp@ziptrrip.com.

10. OUR PRIVACY COMMITMENTS

Where Ziptrrip processes personal data on behalf of the customer for the provision of the Services, we undertake the following confidentiality and data processing commitments:

  1. In order to provide the Services, Ziptrrip will collect, among others, corporate information of the customer and its employees, such as the name, surname, e-mail address, password, phone number, payment data, identification documents and other professional and personal data from the customer and its employees.
  2. The access to personal data from databases controlled by the customer or its affiliates will be regulated in Appendix 1 of this Privacy Policy.
  3. The terms of this Section are to apply to all data processing carried out for the customer (for the purposes of this section, the “Data Controller”) or any of its subsidiary companies by Wayfarers Technologies PVT LTD. [Ziptrrip] (for the purposes of this section, the “Data Processor”) and to all personal data transferred by the Data Controller to the Data Processor. The terms of this Section shall supersede any previous arrangement, understanding or agreement between the Data Controller and the Data Processor relating to data protection, and shall continue in force until the termination of the Services rendered by the Data Processor.
  4. The Data Processor will process personal data received from the Data Controller, in particular the personal data set forth in Clause 1 above, only on the express instructions of designated contacts at the Data Controller, which may be specific instructions or instructions of a general nature or as otherwise notified by the Data Controller to the Data Processor.
  5. Notwithstanding the aforementioned, the Data Controller expressly authorises the Data Processor to use the personal data in order to proceed with the bookings, reservations and any modifications, confirmations, cancellations of the travel services to be provided. In this concern, the personal data may also be accessed by the providers of the travel services, included, but not limited to, airline companies, train operators, rental car agencies, accommodation providers, others travel agents and any other person that may need the data to provide the travel services requested by the Data Controller.

    Ziptrrip is entitled by law to send to the customer, including by electronic means, promotional communications related to the products and services offered by Ziptrrip similar to those contracted by the customer without the latter’s prior consent. Recipients of these communications will receive them as registered users of Ziptrrip’s platform on behalf of the customer (“Registered Users”). Registered Users may opt-out from receiving promotional communications at any time by clicking on the unsubscribe link contained within the communication or by sending an email to the following address: customerhelp@ziptrrip.com. Registered Users may also exercise their rights of access, correction, suppression, opposition, portability and limitation by sending a request to personaldata@ziptrrip.com or to our address at ZIPTRRIP, B-903, PLOT-09, SAI SAAKSHAAT, SEC-6 KHARGHAR, Raigarh, Raigad, Maharashtra, 410210; or to the following email address: customerhelp@ziptrrip.com.
  6. Appendix 2 of this Privacy Policy sets out the nature, duration and purpose of the processing, the types of personal data the Data Processor processes and the categories of data subjects whose personal data is processed.
  7. All personal data provided to the Data Processor by the Data Controller or obtained by the Data Processor in the course of its work with the Data Controller is strictly confidential and may not be copied, disclosed or processed in any way without the express authorisation of the Data Controller.
  8. The Data Processor agrees to comply with any reasonable measures required by the Data Controller to ensure that its obligations under this Section are satisfactorily performed in accordance with all applicable legislation from time to time in force.
  9. Where the Data Processor processes personal data (whether stored in the form of physical or electronic records) on behalf of the Data Controller it shall:

    10. a) Process the personal data only to the extent, and in such manner, as is necessary in order to comply with its obligations to the Data Controller or as is required by law or any regulatory body;

    b) Implement appropriate technical and organisational measures and take all steps necessary to protect the personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure, and promptly supply details of such measures as requested from the Data Controller;

    c) In furtherance of its obligations under Clause 10(b) above, implement and maintain the security measures set out in Appendix 1 to this Privacy Policy;

    d) If so requested by the Data Controller (and within the timescales required by the Data Controller) supply details of the technical and organisational systems in place to safeguard the security of the personal data held and to prevent unauthorised access.

    e) Upon reasonable prior notice, permit persons authorised by the Data Controller to enter into any premises on which personal data provided by the Data Controller to the Data Processor is processed and to inspect the Data Processor’s systems to ensure that sufficient security measures are in place;

    f) Not process personal data outside the Indian Sub-Continent Area unless it is necessary for the performance of a contract concluded in the interest of the data subject.

    g) Except for the provision contained in Clause 5 above, Data Controller authorises the Data Processor to use another data processor (hereinafter, the “Sub-processors”), whose identification data and subcontracted services must be communicated to the Data Controller, prior to the provision of the service. The Data Processor will also inform the Data Controller of any change envisaged in the incorporation or substitution of the Sub-processors, giving thus to the Data Controller the opportunity to object such changes.

    The Data Controller consents hereby to the engagement of the specific sub-processors listed in Appendix 3.

    The Data Processor is obliged to transfer and communicate to the Sub-processor the whole obligations that for the Data Processor derive from this Section and, in particular, the provision of enough guarantees that he will apply appropriate technical and organisational measures, so that the processing complies with the applicable regulations.

    In any case, access to the data made by natural persons who render their services to the Data Processor, acting within the organisational framework of the latter by virtue of a commercial and non-labour relationship, is authorised. In addition, access to the data is granted to companies and professionals that the Data Processor has hired in his internal organisational framework in order to provide general or maintenance services (computer services, consulting, audits, etc.), as long as such tasks have not been arranged by the Data Processor with the purpose of subcontracting with a third party all or part of the Services provided to the Data Controller.

    In the event that the Sub-processor provides services from countries that do not have data protection regulations equivalent to the Union of India ("Third Countries"), the Data Processor undertakes to:

  10. The Data Processor shall transfer all personal data to the Data Controller on the Data Controller’s request in the formats, at the times and in compliance with specifications set out in the requirements notified in writing by the Data Controller to the Data Processor from time to time.
  11. The maximum total liability for direct damages that may be caused to the customer due to breach of the obligations of this Section or for any other cause, will be limited to an amount of 20,000 Euros. Ziptrrip will not be liable to the customer for indirect damages, such as for loss of profit or business, due to breach of the obligations of this Section or for any other cause.
  12. The Data Processor agrees that in the event that it is notified by the Data Controller that it is not required to provide any further services to the Data Controller under this Section, the Data Processor shall transfer a copy of all information (including personal data) held by it in relation to this Section to the Data Controller in a format chosen by the Data Controller and/or, at the Data Controller’s request, destroy all such information using a secure method which ensures that it cannot be accessed by any third party and shall issue the Data Controller with a written confirmation of secure disposal.
  13. The Data Processor accepts the obligations in this clause in consideration of the Data Controller using its services.
    Corporate contact details exchanged between the Data Controller and the Data Processor to enable the provision of the Services will be treated by the other party in order to allow the development, compliance and control of the agreed provision of the Services, being the basis of the processing the fulfilment of the contractual relationship while this relationship subsists and after its termination, until the eventual responsibilities prescribe.
  14. The terms of this Section shall be governed by the Indian regulations in terms of Personal Data Protection, as well as by the resolutions and guidelines of other competent bodies in this matter. In order to resolve any discrepancy regarding the interpretation and/or the enforcement of the provisions of this Section, the Data Controller and the Data Processor submit to the jurisdiction of the Courts and Tribunals of India with express waiver of any other legislation or jurisdiction that may correspond.

APPENDIX 1: SECURITY MEASURES TO BE ADOPTED BY THE DATA PROCESSOR

  1. The Data Processor will ensure that in respect of all personal data it receives from or processes on behalf of the Data Controller it maintains standard security measures related to:
    1. the harm that might result from unlawful or unauthorised processing or accidental loss, damage or destruction of the personal data;
    2. the nature of the personal data;

  2. In particular, the Data Processor shall, when mandatory according to the applicable data protection law:

    1. have in place and comply with a security policy which:
      1. defines security needs based on a risk assessment;
      2. allocates responsibility for implementing the policy to a specific individual or members of a team;
      3. is provided to the Data Controller on or before the commencement of the corresponding service agreement;
      4. is disseminated to all relevant members, volunteers and staff; and
      5. provides a mechanism for feedback and review.
    2. ensure that appropriate security safeguards and virus protection are in place to protect the hardware and software which is used in processing the personal data in accordance with best industry practice;
    3. prevent unauthorised access to the personal data;
    4. ensure its storage of personal data conforms with best industry practice such that the media on which personal data is recorded (including paper records and records stored electronically) are stored in secure locations and access by personnel to personal data is strictly monitored and controlled;
    5. have secure methods in place for the transfer of personal data whether in physical form (for instance, by using couriers rather than post) or electronic form (for instance, by using encryption);
    6. put password protection on computer systems on which personal data is stored and ensure that only authorised personnel are given details of the password;
    7. take reasonable steps to ensure the reliability of any members, volunteers and employees or other individuals who have access to the personal data;
    8. ensure that any employees or other individuals required to access the personal data are informed of the confidential nature of the personal data and comply with the obligations set out in Section 10 of this Privacy Policy;
    9. ensure that none of the employees or other individuals who have access to the personal data publish, disclose or divulge any of the personal data to any third party unless when strictly necessary for the provision of the Services or directed in writing to do so by the Data Controller;
    10. have in place methods for detecting and dealing with breaches of security (including loss, damage or destruction of personal data) including:
      1. the ability to identify which individuals have worked with specific personal data;
      2. having a proper procedure in place for investigating and remedying breaches of the data protection principles contained in the GDPR; and
      3. notifying the Data Controller as soon as any such security breach occurs.
    11. have a secure procedure for backing up and storing back-ups separately from originals;
    12. have a secure method of disposal unwanted personal data including for back-ups, disks, print outs and redundant equipment.

APPENDIX 2: DATA PROCESSING INFORMATION

Categories of data subjects:

The personal data transferred concern the following categories of data subjects:

Categories of data:

The personal data transferred concern the following categories of data:

Special categories of data:

The personal data that might be transferred do not concern special categories of data.

Processing operations:

The personal data that might be transferred will be subjected to the basic processing activity of providing the travel services.

Duration of Processing:

The personal data shall be processed for the term of the contractual relationship between Ziptrrip and the customer, and after the end of this relationship for any reason, for the statutory periods of limitation applicable in each case. After these statutory periods of limitation, the personal data shall be deleted or alternatively anonymized.

APPENDIX 3: AUTHORISATION FOR SUB-PROCESSORS

Pursuant to Clause 10(g) of Section 10, the Data Controller hereby accepts and authorises the Data Processor to engage the sub-processors in the processing of the Personal Data.

The Data Processor hereby represents and warrants that the same data protection obligations as set out in Section 10 have been imposed on the listed sub-processors above, set out in a contract, providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements.

The Everything platform for corporate travel.

Download our app on
Schedule a Demo

Sign up to schedule a demo

The Everything platform for corporate travel.

B-903, Plot-09, Sai Saakshaat, Sec-6 Kharghar, Raigarh, Raigad, Maharashtra, 410210

Resources
FAQs
Privacy
Corporate
Our Customers
Customer Stories
Company
About Ziptrrip
Contact Us

© Ziptrrip 2023. All rights reserved.

Privacy Policy
Terms and conditions