Data processing agreement

This Data Processing Agreement ("DPA") forms part of the terms of service between your agency (the data fiduciary) and Just Travel India Software Private Limited (the data processor). It applies to personal data of travellers, leads, suppliers, drivers and other people that your agency stores in Just Travel India.

1. Instructions

Just Travel India processes this personal data only to provide the service and on your documented instructions – the settings you choose and the actions your staff take in the app. We do not use it for our own marketing and we do not sell it.

2. Your responsibilities

You confirm that you have a lawful basis (such as consent or a booking contract) to collect your customers' data and to send them messages on WhatsApp, SMS or email through Just Travel India.

3. Confidentiality and security

• Only Just Travel India staff who need access to support you can access agency data, under confidentiality obligations, and every support login is recorded.
• We apply technical and organisational measures appropriate to the risk, including tenant isolation, role-based permissions, encryption of sensitive fields (ID numbers, API keys, bank details), backups and access logging.

4. Sub-processors

We use these categories of sub-processors: cloud hosting in India, email delivery, WhatsApp Business messaging providers, payment gateways (your own Razorpay account) and AI providers for optional features (which never receive customer mobile numbers, emails or ID numbers). We will give 15 days' notice before adding a new sub-processor category, and you may object.

5. Breaches

We will notify the agency owner without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your obligations to the Data Protection Board and affected people.

6. Data principal requests

If a traveller contacts us directly about their data, we will pass the request to you. We will help you respond to access, correction and erasure requests using the export and edit tools in the app.

7. Return and deletion

You can export your data at any time. After an account is closed or paused, data is retained for 90 days and then deleted only after notice to the owner, except where the law requires us to keep records longer.

8. Audits

On reasonable request, once a year, we will share information that shows our compliance with this DPA, such as security summaries or third-party reports.

Contact: [email protected]