Privacy policy
This policy explains what personal data EPH Services Private Limited (Jaipur, Rajasthan, India) collects through PepTrvl Biz, why, who it is shared with, and the choices you have. It is written for the people who use the portal and the travellers they book for.
1. What we collect
- Account details — name, work e-mail, mobile number, role, and your company’s name, GSTIN, PAN (read from the GSTIN) and office address.
- Traveller details — the names, contact details, date of birth, gender and, when a booking needs them, ID or passport details of the people you book for, and preferences such as meals or seats.
- Bookings and payments — what was searched, requested, approved and booked, prices, invoices, wallet and credit transactions.
- Sign-in and security — when you sign in, the one-time codes we e-mail (kept only until they expire or are used), and basic technical data such as IP address and browser, used to keep accounts safe.
2. Why we use it
- To make, change and cancel bookings, and send tickets, vouchers and invoices.
- To run your company’s travel policy, approvals, wallet and reports.
- To sign you in, keep accounts secure and tell you about important changes to your account.
- To meet our legal duties, such as GST invoicing and record keeping.
We use personal data for these purposes with the consent given when an account is created or a booking is made, and as needed to perform the service your company asked for. We do not sell personal data.
3. Who we share it with
- Travel suppliers — airlines, hotels and our supplier partners (such as TBO, HyperGuest and RateHawk) receive the traveller details a booking needs.
- Your company — administrators and approvers in your company see the bookings and traveller details within their company.
- Service providers — our hosting provider, Contabo GmbH (Germany-based hosting provider); our e-mail provider; and OpenAI, which processes the text or images you give the travel assistant (for example a passport photo you ask it to read).
- Authorities — when the law requires it.
Some of these providers process data outside India. We share only what each needs and require them to protect it.
4. How long we keep it, and how we protect it
We keep account and booking records for as long as your company uses PepTrvl Biz and afterwards for as long as tax and accounting law requires. Passwords are stored only in a scrambled (hashed) form; sign-in codes expire after 10 minutes. Access to data is limited to the people who need it to run the service.
5. Your choices and rights
Under the Digital Personal Data Protection Act, 2023 you may ask us for a summary of your personal data, ask us to correct or complete it, ask us to erase it where the law allows, withdraw consent, and nominate someone to act for you. Your company administrator can correct most details in the portal. Some records must be kept by law even after you leave.
6. Cookies and storage on your device
The portal stores your sign-in on your device (in the browser’s storage and two small cookies) so you stay signed in, for up to 30 days when you tick “Keep me signed in”. We do not use advertising cookies.
7. Grievance officer and contact
For any question or complaint about your personal data, write to our grievance officer, Anand, at anand@epeppy.com. We will respond within the time the law sets. For anything else: info@epeppy.com or +91 99293 73779 (24×7).
This policy follows the Information Technology Act, 2000, its rules, and the Digital Personal Data Protection Act, 2023. We may update it; the date at the top shows the latest version.