Your Privacy, Our Promise

At Leisure Club Holidays, we value your trust and are committed to protecting your personal information.

Your Journey, Our Passion

Last Updated

Last updated on 22 October 2026.

1. Who We Are and What This Policy Covers

Leisure Club Holidays is the Data Fiduciary for the personal data described in this policy. A Data Fiduciary decides why and how personal data is processed. Even when a service provider processes that data on our instructions, we remain accountable for it.

This policy covers our website, our enquiry and booking forms, our customer accounts, our chat assistant, and our newsletter. It is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified on 13 November 2025).

The core duties in the Act and Rules apply from around 13 May 2027. We have implemented them ahead of that date, and this notice is the itemised notice required by rule 3 of the Rules.

2. What We Collect, Why We Collect It, and Our Lawful Basis

We collect only what we need, and only for the purpose stated below. If a purpose changes, we will ask you again before we start using your data for it.

Personal data	Why we use it	Lawful basis
Name, email address and mobile number	To answer your enquiry, prepare and confirm your booking, and contact you about it.	Consent for enquiries; performance of a contract once you book.
Travel dates, destinations, package selection, room and passenger details	To price your trip, hold availability, and issue your itinerary, vouchers and invoices.	Performance of a contract.
Passport, visa, Aadhaar, PAN and other identity documents, including scans and photographs	To apply for visas, meet airline and immigration requirements, and keep the statutory travel record.	Legal obligation; performance of a contract.
Date of birth, gender, nationality and address	To complete travel and identity documents accurately.	Legal obligation; performance of a contract.
Payment transaction details	To process, reconcile and refund your payment, and to meet tax and accounting obligations.	Legal obligation; performance of a contract.
Booking records, confirmations and correspondence	To service your booking and to resolve any dispute.	Performance of a contract; legal obligation.
Emergency contact details	To reach you, or your family, in an emergency while you are travelling.	Consent.
Website analytics events — page, package, search and time on page	To understand which packages are useful and improve the website.	Consent, which you can withdraw at any time.
Chat assistant messages	To answer your question and help you find a suitable package.	Consent; performance of a contract.
IP address and browser type, stored only as a one-way hash	Rate limiting and abuse prevention. It is never stored in readable form and is never used to build a profile of you.	Legal obligation (security of the service).
Account, profile and document data	To give you an account, keep track of your bookings, and let you manage your travel documents.	Performance of a contract.

3. Consent, and How to Withdraw It

Where we rely on your consent, it is free, specific, informed and given by a clear action — ticking a box. We never pre-tick a consent box for you, and we never make you pay for refusing.

You can withdraw consent at any time, and withdrawing it is exactly as easy as giving it. Every form on this site carries a link to this policy and a control to change your choice.

Website analytics — use the "Cookie preferences" link in the footer to accept, reject, or change your choice at any time.
Marketing messages — every promotional email carries an unsubscribe link, and you can also ask us to stop by writing to us.
Enquiries and account data — write to us and we will confirm and action it.

When you withdraw consent, we stop the processing it covered and delete the data it was collected for, except where another lawful basis applies or the law requires us to keep it.

4. Your Rights as a Data Principal

Under sections 11 to 14 of the Act, you have the following rights over your personal data. We honour them free of charge.

Access (section 11): Ask for a summary of the personal data we hold about you, the activities we carry out on it, and the organisations we have shared it with.
Correction (section 12): Ask us to correct data that is inaccurate or incomplete, or to complete data that is missing.
Erasure (section 12): Ask us to erase data that is no longer needed for the purpose it was collected for.
Grievance redressal (section 13): Raise a concern with our Grievance Officer. We answer every grievance within 30 days.
Nomination (section 14): Nominate someone else to exercise these rights on your behalf if you are unable to do so.

How to exercise a right: use our privacy request form, or write to [email protected]. We verify who you are before we act, so please include enough information for us to find your records.

Our request form covers: access, correction, erasure, nomination, grievance. We answer every request within 30 days.

5. Grievance Officer and Escalation

Our Data Protection Grievance Officer can be reached at [email protected] or by post at Office No. 2, 1st Floor, Bakul Society, Near Shaheed Circle, Opposite Krishna Vijay Misal, Gangapur Road, Nashik – 422013. We respond to every grievance within 30 days.

If you are not satisfied with our response, or we do not respond within 30 days, you can complain to the Data Protection Board of India — the body established under the Act. You can file a complaint through its official portal at https://www.dpb.gov.in. Please note the Act expects you to raise the grievance with us first.

6. Who We Share Your Data With

We share personal data only with the service providers below, only for the purpose stated, and only under a contract that holds them to the same standard we hold ourselves to. We do not sell, rent, or disclose your personal data to anyone else.

Provider	Why	What they receive	Where
Account authentication provider	Account sign-in and session security.	Account identifiers and sign-in records.	Overseas data centres.
AI reply service	Generating replies in the website chat assistant.	The messages you type into the chat assistant.	Overseas.
Messaging platform	Opening a chat with our sales team when you submit a contact or booking form.	Your name, mobile number, travel date and message.	Overseas data centres.
Email delivery service	Sending booking confirmations and service emails.	Your name, email address and booking details.	Overseas data centres.
Cloud database service	Storing bookings, enquiries, profiles and travel documents.	All personal data we hold about you.	Cloud region in India.
Customer relationship management service	Managing leads and enquiry pipeline.	Name, email address, mobile number and enquiry details.	India.
Payment gateway	Processing booking payments.	Transaction and billing details required by the gateway.	India.
Media storage and delivery service	Storing and delivering images and uploaded documents.	The photos and files you upload.	Overseas (United States and European Union).
Maps and places service	Destination, hotel and activity lookups.	The place or destination you search for.	Overseas.
Routing and distance service	Calculating travel distance, time and route maps.	Coordinates of the places on your itinerary.	European Union.
Activities marketplace	Showing activities and traveller reviews.	Product and destination lookups.	Overseas.
Image provider	Providing placeholder destination photography.	No personal data — only the destination being displayed.	Overseas.

We also share your details with the hotels, airlines, transport providers, visa agencies and destination operators needed to deliver the trip you have booked with us — but only the part of the booking each of them needs.

7. Transfers Outside India

Some of the providers above operate outside India, so a limited amount of your personal data may be processed there — for example when you use the chat assistant, complete a payment, or upload a document. Section 16 of the Act permits these transfers by default, and we do not transfer personal data to any country the Government of India has restricted by notification. We apply the same safeguards to every transfer as we do inside India.

8. How We Protect Your Data

Encryption in transit for everything we send over the internet.
Access is limited to staff who need it for your booking.
Analytics data is never used to profile you.
Consent is recorded and can be withdrawn at any time.
Automatic deletion of raw analytics events after 90 days, and of aggregated statistics after one year.
A record of every consent decision you make is kept as proof that we asked and you answered.

No system is perfect. If a breach of personal data happens, we will notify you and the Data Protection Board without delay, and give the Board a full report within 72 hours of becoming aware of it.

9. If a Data Breach Happens

Contain the incident and switch off the access that caused it.
Work out what was exposed, which records it touched, and which people it affected.
Notify the Data Protection Board and every affected person without delay, with a detailed report within 72 hours of becoming aware.
Tell you what happened, what we did about it, and what we are doing so it does not happen again.

10. How Long We Keep Your Data

We keep personal data only for as long as we need it for the purpose it was collected for, and then we delete or anonymise it. These are the actual periods our systems apply — they are enforced automatically, not a promise on paper.

What we hold	How long we keep it
Enquiries that did not become a booking	24 months
Newsletter and offer subscriptions	24 months
Chat assistant conversation transcripts	12 months
Raw website analytics events	3 months
Aggregated daily analytics	12 months
Customer travel and identity documents	60 months
Passport applications	60 months
Records of consent you have given	Kept for as long as the consent is relied on, and for the statutory limitation period afterwards

11. Website Analytics and Cookies

We use essential storage to make the site work — sign-in, security, and your privacy choices. This does not need your consent.
With your consent we also collect first-party analytics: the pages you visit, the packages you look at, the searches you run, your device type, and where you came from.
Analytics data never leaves our own systems. We run no advertising pixels, and we never sell data.
IP addresses are not stored in readable form.
Raw analytics events are deleted automatically after 90 days. Only anonymous daily summaries are kept, for up to one year.
You can accept, reject, or choose what we collect from the banner, and change your mind later using the "Cookie preferences" link in the footer.
Any event carrying an email address, a phone number, or a field we did not ask for is rejected and never stored.

12. Children's Data

A child means a person under 18 years of age. We do not knowingly collect personal data from a child. If a booking involves a child, the parent or lawful guardian provides the information and accepts this notice on the child's behalf.

We do not use any personal data to track, monitor or advertise to children, and we do not build profiles of them.

13. Your Responsibilities

Please review your confirmation vouchers carefully and keep copies of your ID proofs, tickets and travel documents.
Report any error or discrepancy within 24 hours of the voucher being issued, so we can correct it while it still matters.
You are responsible for carrying valid travel documents — passport, visa, permits and tickets — for the whole journey.
Keep your account password to yourself. If you think someone else has used your account, tell us straight away.

14. Contact Us and Changes to This Policy

Write to us at [email protected] or call +91 94226 38006, or post to Office No. 2, 1st Floor, Bakul Society, Near Shaheed Circle, Opposite Krishna Vijay Misal, Gangapur Road, Nashik – 422013.

We will publish any change to this policy on this page and update the date at the top. If a change affects how we use data we already hold, we will tell you and, where consent is the basis, ask you again.

This policy is governed by Indian law, and the courts at Nashik, Maharashtra and the courts of Goa State have jurisdiction over disputes arising from it.