OnArrival Travel - Privacy Policy



Document Version: v3.0 — GDPR/SOC2/PII COMPLIANT
Last Updated: May 26, 2025
Effective Date: June 1, 2025
Regulatory Compliance: GDPR, DPDP Act 2023, CCPA, SOC 2 Type II, ISO 27001



1. Introduction and Regulatory Commitment

OnArrival Travel Tech Pvt. Ltd. ("OnArrival," "we," "our," or "us") operates as an API-first, modular travel technology platform that aggregates flights, hotels, activities, insurance, visa information, and ancillary services. We provide our technology through cloud-hosted SaaS (multi-tenant), on-premise/VPC deployments for enterprise clients, and white-label web & mobile micro-frontends.

Our Business Model:

Dual Data Processing Roles: We operate with distinct data processing responsibilities:

This Privacy Policy demonstrates our compliance with:

1.1 Data Controller Information

Legal Entity: OnArrival Travel Tech Pvt. Ltd.
Registration Number: U72900KA2023PTC174829
Registered Address: 9th Floor, Infinity Tower, Koramangala 4th Block, Bangalore 560095, Karnataka, India
Data Protection Officer: Priya Sharma, CIPP/E, CIPM
DPO Contact: dpo@onarrival.com | +91 80 1234 5678

1.2 EU/UK Representative (GDPR Art. 27)

EU Representative: DataRep Solutions GmbH
Address: Alexanderplatz 7, 10178 Berlin, Germany
Contact: eu-rep@onarrival.com

UK Representative: DataRep UK Ltd.
Address: 15 Bishopsgate, London EC2N 3AR, United Kingdom
Contact: uk-rep@onarrival.com



2. Scope and Application

2.1 Territorial Scope

This Privacy Policy applies to the processing of personal data:

2.2 Material Scope

This Policy covers personal data processing through our API-first platform ecosystem:

Special Deployment Considerations:

2.3 Temporal Scope

Applies to all personal data processing from the effective date forward and retroactively to data collected under previous versions where lawful basis permits.



3.1 GDPR-Compliant Definitions

Personal Data (GDPR Art. 4(1)): Any information relating to an identified or identifiable natural person ('data subject'), including:

Special Categories of Personal Data (GDPR Art. 9):

Processing (GDPR Art. 4(2)): Any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

3.2 Data Classification Framework

Sensitivity Level 1 - Public Information:

Sensitivity Level 2 - Internal Use:

Sensitivity Level 3 - Confidential:

Sensitivity Level 4 - Restricted:

3.3 Processing Roles in B2B2C Context

OnArrival as Data Controller:

OnArrival as Data Processor:

Joint Controller Arrangements:

Partner as Primary Controller:



4. Lawful Basis Framework (GDPR Art. 6 & 9)

4.1 Primary Lawful Bases

4.1.1 Contract Performance (Art. 6(1)(b))

4.1.2 Legitimate Interests (Art. 6(1)(f))

4.1.3 Legal Obligation (Art. 6(1)(c))

4.1.4 Explicit Consent (Art. 6(1)(a))

4.2 Special Category Data Processing (GDPR Art. 9)

4.2.1 Explicit Consent (Art. 9(2)(a))

4.2.2 Substantial Public Interest (Art. 9(2)(g))



5. Comprehensive Data Collection

5.1 Information You Provide Directly

Traveler-Provided Data (Controller Role):

Payment Information (Tokenized Processing):

Corporate SSO and Enterprise Data:

API and Developer Platform Data:

Support and Communication Data:

5.2 Automatically Collected Information

Frontend Monitoring and Analytics:

System and Infrastructure Logs:

Device and Technical Information:

Network and Security Data:

5.3 Third-Party Sources and Supplier Integration

Global Distribution Systems and NDC Sources:

Hotel and Accommodation Partners:

BYOS (Bring Your Own Supplier) Integrations:

Fraud Prevention and Risk Scoring:

Revenue Management and Pricing Intelligence:



6. Data Processing Purposes and Activities

6.1 Primary Business Functions

Travel Service Delivery:

Customer Relationship Management:

Payment and Financial Operations:

6.2 Platform Operations and Security

Security and Fraud Prevention:

Analytics and Performance Optimization:

Developer Platform Support:

6.3 Marketing and Communication

Direct Marketing (Existing Customers):

Targeted Advertising:

Market Research and Surveys:



Strictly Necessary Cookies (No Consent Required):

Functional Cookies (Implied Consent):

Analytics Cookies (Explicit Consent Required):

Marketing Cookies (Explicit Consent Required):

7.2 Consent Management Platform (CMP)

Implementation Features:

Compliance Features:

7.3 Alternative Tracking Technologies

Mobile SDK Data Collection:

Server-Side Tracking:



8. Data Sharing and Third-Party Disclosure

8.1 Service Provider Categories

Travel Industry Partners:

Technology Infrastructure Providers:

Financial Service Providers:


Government and Law Enforcement:

Compliance and Audit:

8.3 Business Transfer Scenarios

Merger and Acquisition:

Business Restructuring:



9. International Data Transfers

9.1 Transfer Mechanisms and Safeguards

Adequacy Decisions (GDPR Art. 45):

Standard Contractual Clauses (GDPR Art. 46(2)(c)):

Binding Corporate Rules (BCRs):

9.2 Transfer Impact Assessments (TIAs)

High-Risk Jurisdiction Assessment:

Supplementary Measures:

9.3 Specific Transfer Scenarios

US Transfers (Post-Schrems II Compliance):

Asia-Pacific Transfers:



10. Data Retention and Lifecycle Management

10.1 Retention Schedule by Data Category

Travel Booking and Transaction Data:

Customer Account and Profile Data:

Technical and System Data:

Special Category and Sensitive Data:

10.2 Automated Data Lifecycle Management

Retention Policy Enforcement:

Data Minimization Procedures:



11. Security Measures and Technical Safeguards

11.1 Technical Security Controls

Encryption and Cryptography:

Access Controls and Authentication:

Network and Infrastructure Security:

11.2 Organizational Security Measures

Security Governance:

Personnel Security:

11.3 Compliance Certifications and Audits

Industry Certifications:

Regular Assessments:



12. Individual Rights and Data Subject Controls

12.1 Fundamental Rights Under GDPR

Right of Access (Art. 15):

Right to Rectification (Art. 16):

Right to Erasure/Right to be Forgotten (Art. 17):

Right to Data Portability (Art. 20):

Right to Object (Art. 21):

Right to Restriction (Art. 18):

12.2 Automated Decision-Making and Profiling

Automated Decision-Making Protections (Art. 22):

Profiling Transparency:

12.3 Rights Exercise Mechanisms

Self-Service Privacy Dashboard:

Assisted Rights Exercise:



13. Children's Privacy and Special Protections

13.1 Age Verification and Restrictions

Minimum Age Requirements:

Enhanced Protections for Minors:

13.2 Family Travel Considerations

Family Account Management:

Educational and Youth Programs:



14. Data Breach Notification and Incident Response

14.1 Breach Detection and Assessment

Continuous Monitoring:

Risk Assessment Framework:

14.2 Regulatory Notification Procedures

Supervisory Authority Notification (GDPR Art. 33):

Data Subject Notification (GDPR Art. 34):

Multi-Jurisdictional Compliance:

14.3 Incident Response and Recovery

Immediate Response Procedures:

Recovery and Lessons Learned:



15. Privacy Governance and Accountability

15.1 Privacy Management Structure

Data Protection Officer (DPO):

Privacy Governance Committee:

Privacy by Design Implementation:

15.2 Data Protection Impact Assessments (DPIAs)

DPIA Triggers (GDPR Art. 35):

DPIA Process:

DPIA Documentation:

15.3 Vendor and Third-Party Management

Due Diligence Requirements:

Data Processing Agreements (DPAs):



16. Transparency and Reporting

16.1 Privacy Metrics and KPIs

Rights Exercise Statistics:

Compliance Metrics:

16.2 Annual Transparency Report

Public Reporting Commitments:

Stakeholder Communication:



17. Contact Information and Complaints

17.1 Privacy Contact Points

Primary Data Protection Officer:

Regional Privacy Contacts:

Postal Address: OnArrival Travel Tech Pvt. Ltd.
Data Protection Office
9th Floor, Infinity Tower
Koramangala 4th Block
Bangalore 560095, Karnataka, India

17.2 Complaint and Escalation Procedures

Internal Complaint Process:

Supervisory Authority Rights: Users have the right to lodge complaints with relevant supervisory authorities:

EU/EEA Data Subjects:

UK Data Subjects:

Indian Data Subjects:

California Residents:



18. Policy Updates and Amendments

18.1 Change Management Process

Material Change Definition:

Notification Procedures:

18.2 Version Control and Documentation

Document Management:

Implementation Timeline:

19. Multilingual Accessibility and Support

19.1 Language Availability

Primary Languages:

Translation Standards:

19.2 Support Accessibility

Accessibility Features:

Support Accommodations:

20.1 Policy Effectiveness

Effective Date: June 1, 2025, 00:01 IST
Supersedes: All previous privacy policies and privacy notices
Retroactive Application: Applies to all personal data held as of effective date where lawful basis permits
Grandfathering: Existing consent and preferences honored under new framework
Transition Period: 90-day grace period for user preference updates

Regulatory Compliance Statement: This Privacy Policy has been designed to comply with:

Legal Validity:

Professional Legal Review: This Privacy Policy has been reviewed by qualified privacy attorneys and data protection specialists in multiple jurisdictions to ensure comprehensive compliance with applicable laws and regulations.

© 2025 OnArrival Travel Tech Pvt. Ltd. All rights reserved. This Privacy Policy represents our commitment to protecting your personal data and privacy rights in accordance with the highest international standards.

Document Verification:

Core travel
FlightsHotelsFlight data
Ancillaries
VisaAncillariesVisa information
Derisking
Insurance
Industries
Travel sellersSuppliersEnterprisesTravellers
Usecases
Embedded travelInsurance managementVisa managementCorporate travelExpense management
Company
AboutCareer
Support
Contact usRequest demo
© 2024 OnArrival Pvt. Ltd.

|

Privacy policy

|

Terms & conditions