Privacy Notice

TratwoForWork is a corporate travel operations platform operated by J M Mehta Travel and Tour Co. Pvt. Ltd. (trading as Tratwo), a company incorporated in India.

For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary. Our contact for data-related matters is listed under the Grievance Officer section below.

We collect and process the following categories of personal data:

Meal preferences and dietary information are collected solely to communicate preferences to hotels on your behalf. This data is not included in reports, analytics exports, or shared with any third party other than the relevant hotel.

• To manage and deliver your corporate travel bookings (flights, hotels, visas, insurance, forex, car rentals)
• To send travel documents, boarding passes, and booking confirmations
• To provide automated alerts (passport/visa expiry, flight delays, boarding pass reminders)
• To communicate hotel preferences on your behalf to hotels
• To generate travel reports for your company's travel manager and finance team
• To comply with legal obligations, including FEMA/RBI forex regulations and DPDPA 2023
• To provide customer support via our centralised inbox

We process your data only for the purposes described above. We do not sell your personal data or use it for advertising.

Your data is stored in a Supabase (PostgreSQL) database hosted in the South Asia (Mumbai, India) region. High-sensitivity fields (passport numbers, emergency contacts, loyalty programme numbers, PAN) are encrypted at the application layer using AES-256-GCM before being written to the database.

Travel documents uploaded to the platform are stored in a private, encrypted Supabase Storage bucket. Access is granted only via signed URLs that expire after 1 hour.

Access to your data within the platform is governed by role-based access controls. Sensitive fields (such as passport numbers and loyalty programme numbers) are visible only to authorised operations staff and to you personally.

We share your data only as necessary to deliver the services you have requested:

• Airlines, hotels, visa agencies, and insurance providers — to make bookings on your behalf
• Resend — our email delivery provider, for sending confirmations and alerts
• Your company's travel manager and finance team — booking and spend data relevant to your company
• Regulatory authorities — where required by law (e.g. FEMA, RBI, DPDPB)

We do not share your data with advertisers, data brokers, or any party not listed above.

We retain your personal data for the following periods:

• Booking records: 7 years (statutory requirement for financial records under Indian law)
• Traveller profiles: for the duration of your company's active relationship with Tratwo, plus 2 years
• Consent records: permanently (append-only audit requirement under DPDPA)
• Audit logs: 5 years
• Deleted account data: purged within 30 days of a verified deletion request

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

To exercise any of these rights, email the Grievance Officer listed in Section 9. We will respond within 30 days.

TratwoForWork uses only essential session cookies required for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

We may update this privacy notice as our services evolve or as legal requirements change. When we make material changes, we will notify registered users by email and update the effective date at the top of this page. Continued use of the platform after notification constitutes acceptance of the updated notice.