Draft — to be reviewed by Hammocks Huts Holidays' legal adviser. This is a working draft, not final legal advice. Square brackets mark details still to be confirmed.
Privacy notice
We collect only what we need to plan and run your trip. This page says what that is, for the website, the traveller app and the crew app, and how to ask for your data to be shown, corrected or deleted.
Who we are
Hammocks Huts Holidays [registered company name to be confirmed], [registered office address to be confirmed] (“we”). We decide why and how your personal data is used, so we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
What we collect, and why
When you ask us about a trip
- Your name, mobile number, preferred way to be contacted, the trip you looked at, what you put in your basket, and any message you type (and a written copy of a voice note, if you use that option). We use this to call you and plan the trip.
- A one-time code sent by SMS or WhatsApp to check your number. The code is used once.
- Whether you agreed to be contacted about this trip (needed) and whether you also agreed to marketing (optional, separate). We keep the date and the version of the wording you agreed to.
When you book
- Names and ages of the people travelling, dates, stays, services and what you pay.
- Payments are taken by Razorpay. Your card, UPI or bank details go to Razorpay and never reach our servers. We keep the order and payment numbers, amount, status and refunds.
- Travel documents (for example passport or ID pages, visas, tickets) if we ask for them and you upload them from your trip page. They are PDF or image files up to 10 MB, kept in a private store outside the website, under a random file name. Only staff who need them for your trip can open them, and we record when a document was checked.
- Insurance: if you buy cover through our partner we keep the insurer, policy number, status and premium. We do not collect health declarations or pre-existing conditions.
On your trip page and in the traveller app
- You open your trip with a private link plus the last four digits of your mobile number. We keep the link, how many wrong tries were made, and a sign-in session (a cookie on the web; a token in the app).
- Messages and requests you send your advisor, and the replies.
- Photos you choose to upload to your memory pack after the trip. They stay private unless you turn on sharing, and you can turn it off at any time.
- SOS button: when you press it we record the press, the time and your trip. Your location is added only if you tick “share my location” for that press. We tell you to call 112 yourself; we do not contact emergency services for you.
- Traveller app: a random device ID made by the app, a sign-in token, and, if notifications are switched on, a push token for your phone. A copy of your trip is kept on your phone, encrypted, so it works without signal. Optional app lock uses your phone's fingerprint, face or PIN; we never see your biometrics. The app does not ask for your location, contacts, photos or files.
Messages from us
We send trip messages (confirmations, reminders, payment links, replies) by WhatsApp, SMS, email or app notification. Notifications on a lock screen use fixed, generic wording. Marketing messages go only to people who agreed to them. Reply STOP on a channel to stop everything on that channel; we then call you instead for anything important about a booking. To compare opt-outs without keeping your number in the list, we store a keyed hash of it.
Anonymous visitor statistics
The website counts which sections people read and how far through the planner they get. It uses no cookies and no lasting identifier: a random code that ends when you close the tab, the page address without anything after a question mark, step numbers and times. It never sees what you type, your IP address or your device details, and it sends nothing at all if your browser says Do Not Track or Global Privacy Control.
Other cookies
Only what the site needs: the trip-page sign-in cookie (HttpOnly, only for your trip pages), and a short-lived cookie that remembers a friend's invite code until you send an enquiry. Staff and supplier sign-ins use their own cookies. We do not use advertising cookies.
Crew app (guides and drivers)
- For the people who work for us: name, mobile number (their login), role, vehicle and a password stored only as a scrambled hash.
- Location only while a driver has tapped “Start sharing” for one pickup, and only while the app is in use. We keep the latest position only, not a trail. Sharing stops at the latest an hour after the pickup time, when the guest is met, or when the driver taps Stop, and the row is deleted at the latest 24 hours after it started. The guest being picked up sees the driver's first name, vehicle and an estimate of how far away they are.
- The camera is used to read the QR code on a guest's voucher. No photos are taken or saved. Each scan keeps the time, the result and, only while the driver is sharing, a position rounded to about 100 metres. The code itself is not stored.
- Crew see only the services they are assigned to: the lead traveller's first name, party size, pickup point and time and a note from staff. They do not see prices, surnames or phone numbers; calls to guests go through our office line.
Who sees your data
- Our staff, according to their role.
- The hotels, guides, drivers and other suppliers on a confirmed trip, only what they need to serve you (a name, party size, dates, special needs you asked us to pass on).
- Service providers who work for us: payment (Razorpay), messaging (WhatsApp, SMS and email providers), calling (our telephony provider), push notifications (Google Firebase, only if switched on), and the cloud server that hosts the site [hosting provider and region to be confirmed].
- Our insurance partner, if you choose cover.
- Authorities, where the law requires it.
We do not sell personal data and we do not use it for advertising.
How long we keep it
| What | How long |
|---|---|
| Anonymous visitor statistics | Deleted after 400 days (automatic). |
| Crew live location | Latest position only; cleared when sharing stops and deleted at the latest 24 hours after it starts (automatic). |
| Traveller app sign-in | A session ends 30 days after you last used the app, when your link expires or is switched off, or when you sign out. Signing out also deletes the push token and the offline copy on the phone. |
| Crew app sign-in | 14 days after last use, or when the office switches the account off or the crew member signs out. |
| Trip link | Expires 60 days after it is made or 30 days after the trip ends, whichever is later, and never more than 365 days from creation. Staff can switch it off sooner. |
| Enquiries, bookings, payments, invoices, travel documents, messages | [Retention period to be set by the legal adviser, taking account of tax, accounting and limitation rules.] Until then these are kept while needed for the trip and for those duties, and deleted or anonymised on a valid request unless the law says we must keep them. |
Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data we hold about you and how it is used, and give you a summary;
- correct or complete data that is wrong;
- erase data we no longer need, including the data tied to your phone number;
- stop using your data where you gave consent, by withdrawing that consent (this does not undo what we did before);
- deal with a grievance; and
- name another person to exercise these rights for you if you die or cannot act.
Use the request form (it works without an account), or write to the grievance officer below. We will ask you to confirm it is you, using the contact details you give, before we send or delete anything. Please allow up to 30 days [response time to be confirmed]. If you are not satisfied with our answer you may complain to the Data Protection Board of India.
You can also: sign out in the app (this removes everything it stored on your phone); reply STOP to a message; or switch off the app lock and notifications in your phone settings.
Children
Trips with children are booked by a parent or guardian, who gives us the child's details. We use a child's details only to plan and run the trip, and we do not send marketing or track children. [Parental-consent wording under the DPDP Act to be confirmed by the legal adviser.]
Security
Data is sent over HTTPS. Travel documents and photos are kept outside the public website under random names. The apps keep tokens in the phone's secure storage and the offline copy encrypted, and turn off Android backup so it cannot be copied to another phone. No system is perfectly secure; if there is a breach that affects you we will tell you and the Data Protection Board as the law requires.
Grievance officer
[Grievance officer name to be confirmed]
Email: privacy@hammockshutsholidays.com
Phone: [phone number to be confirmed] ([office hours to be confirmed])
Changes
If we change this notice we will update the version and date above, and tell you in the apps or by message if the change matters to you. See also our terms of use.