Privacy Policy | TraCarta

In Short

We collect only what we need to deliver our services and run this website.
Client data is used only for that client’s engagement. We never sell personal data.
You can ask to see, correct or erase your data at any time by writing to our Grievance Officer.

Who We Are

This policy is issued by TraCarta India Private Limited (“TraCarta”, “we”, “us”), CIN U63090HR2013PTC051042, a company incorporated in India with its registered office at M-3/58, DLF City Phase 2, Gurugram, Haryana 122002.

For personal data we decide how to use, we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). When we process personal data on behalf of a client during an engagement, we act as that client’s Data Processor and follow their instructions. We also follow the Information Technology Act, 2000 and, where it applies, the EU General Data Protection Regulation (GDPR).

What We Collect

Depending on how you interact with us, we may collect:

Contact detailsName, work email, phone number, company and role, from forms, email or calls.

Job applicationsYour resume, experience and any details you choose to share.

Engagement dataAirline invoices and credit notes, GST returns, ledgers and travel records, which may contain names of client employees who travelled.

Website dataDevice, browser, pages visited and approximate location, through cookies as set out in our Cookie policy.

We also keep a record of the files we exchange with you and who sent or received them.

How We Use It

To reply to enquiries and prepare reconciliation reviews and proposals.
To deliver our services: collecting airline invoices, matching them to returns and preparing what a client should claim.
To run SkyBoard, where a client chooses to use it, and give access only to the people the client authorises.
To assess job applications.
To meet legal, tax, audit and regulatory obligations.
To improve our website and services, using aggregated information wherever possible.

We process personal data on the basis of your consent, or for legitimate uses permitted under the DPDP Act, such as performing a contract you have asked for or complying with law.

How We Use Technology and AI

Our systems read and match airline documents automatically so that our specialists can focus on judgment. Client data is used only for that client’s engagement. We do not use one client’s data to deliver services to another, and we do not share client data with third parties to train their AI models.

Every eligibility decision on a claim is reviewed by a TraCarta specialist. See our Responsible AI statement for more.

Who We Share It With

We do not sell personal data. We share it only where needed:

Microsoft 365 and OneDrive, which we use to store, process and share engagement files securely. Microsoft holds ISO 27001 and SOC 2 certifications and applies encryption at rest and in transit.
Airlines and the GST department, where this is necessary to obtain invoices or support a client’s claim, on the client’s instructions.
Professional advisers and auditors, under confidentiality.
Authorities, where required by law.

We do not engage other outside firms to process client data. Any provider we use in future will first be checked by us and sign a data processing agreement. Where data is stored or processed outside India, we do so only as permitted under Indian law.

How Long We Keep It

We keep personal data only as long as needed for the purpose it was collected, or as long as the law requires.

At least 7 yearsEngagement records: reconciliation workbooks, airline invoices and supporting documents, for contractual, tax and audit needs.

Up to 12 monthsJob applications, unless you ask us to delete them sooner.

12 months after last contactEnquiries and newsletter details, or until you ask us to stop.

Then destroyedBy secure digital wipe or physical shredding.

How We Protect It

We protect personal data with safeguards set out in our internal information security policies:

Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
Role-based access on a need-to-know basis, with multi-factor authentication for important systems.
Logs of access to confidential data, and access rights reviewed at least once a year.
Encrypted backups, tested every month, so data can be restored if something goes wrong.
A data protection impact assessment before any new process or system that uses personal data.
Security policies reviewed and approved by senior management every year.

Our information security practices are compliant with ISO/IEC 27001, and we handle personal data in line with the GDPR.

If a personal data breach occurs, we will tell affected clients without undue delay and, where applicable, within 72 hours, and notify affected people and the Data Protection Board of India as required by law.

Your Rights

Under the DPDP Act you have the right to:

Get a summary of the personal data we hold about you and how it is used.
Correct, complete or update it.
Have it erased, where we no longer need it or you withdraw consent.
Withdraw consent at any time, as easily as you gave it.
Nominate someone to exercise these rights on your behalf.
Raise a grievance with us, and then with the Data Protection Board of India.

If we process your data on behalf of one of our clients, we may direct your request to that client.

Grievance Officer

For any question, request or complaint about your personal data, contact:

Karan ChanderFounding Partner and Grievance Officer, TraCarta India Private LimitedM-3/58, DLF City Phase 2, Gurugram, Haryana 122002connect@tracarta.in

We will acknowledge your request promptly and respond within the time allowed by law.

Changes to This Policy

We may update this policy from time to time. The date at the top shows when it last changed. Significant changes will be highlighted on this page.